Cyber Threat Intel Daily Briefing — 2026-10-19

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-19 12:15 UTC · REPORT BRIEF-20261019-121547

OPEN // LE

01

Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

The persistent, stealthy FortiGate implant was deployed against a telecommunications organization. The post Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 19 Oct 2026 11:13:23 +0000 https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/

02

Big Fish: OpenBSD Root Exploit Chains a 37-Year-Old BSD Bug With a Kernel Flaw

OpenBSD flaws, including a 37-year-old BSD bug, enable local attackers to bypass security protections and gain root access. Patches are available. Cybersecurity firm Calif published a full exploit and write-up this week for a local privilege escalation on OpenBSD 7.9 that chains two separate kernel

SRC: Security Affairs Mon, 19 Oct 2026 10:34:45 +0000 https://securityaffairs.com/201285/hacking/big-fish-openbsd-root-exploit-chains-a-37-year-old-bsd-bug-with-a-kernel-flaw.html

03

Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited

Attackers are exploiting vulnerability CVE-2026-106931 in SiteGuard Server Edition to run commands as root or SYSTEM. EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition. Threat actors are already exploiting it in the wild

SRC: Security Affairs Mon, 19 Oct 2026 07:43:12 +0000 https://securityaffairs.com/201258/security/japans-siteguard-waf-flaw-cve-2026-106931-is-already-being-exploited.html

04

Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers

A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by thre

SRC: The Hacker News Mon, 19 Oct 2026 11:59:44 +0530 https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html

05

Spyware found on devices belonging to prominent Serbian critics as elections loom

The confirmed and suspected targets include a university rector backing Serbia's protests and a prosecutor who investigated a Trump-linked Belgrade development, weeks before parliamentary elections. The post Spyware found on devices belonging to prominent Serbian critics as elections loom appeared f

SRC: CyberScoop Mon, 19 Oct 2026 10:00:00 +0000 https://cyberscoop.com/pegasus-spyware-serbia-critics-elections/

06

One Compromised Login Exposed Millions of California Students’ Records

Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006. The post One Compromised Login Exposed Millions of California Students’ Records appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 19 Oct 2026 11:55:50 +0000 https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/

07

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tool

SRC: The Hacker News Mon, 19 Oct 2026 15:36:40 +0530 https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html

08

Attackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365

Attackers stole ConnectWise application credentials to access Microsoft 365 tenants, prompting the company to suspend cloud services. ConnectWise suspended its Cloud Backup service and took both SaaS Security and Cloud Management offline over the weekend after discovering that unknown attackers had

SRC: Security Affairs Mon, 19 Oct 2026 09:32:56 +0000 https://securityaffairs.com/201236/hacking/attackers-abuse-stolen-connectwise-application-credentials-to-target-microsoft-365.html

09

OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key ther

SRC: The Hacker News Mon, 19 Oct 2026 11:37:08 +0530 https://thehackernews.com/2026/10/opencode-console-breach-may-have.html

10

MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks

Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics. The post MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 19 Oct 2026 09:37:04 +0000 https://www.securityweek.com/mitre-attck-v20-catalogs-ai-abuse-mfa-bypass-water-utility-attacks/

11

Microsoft: October Windows Server updates break Exchange sign-in, mail flow

Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. […]

SRC: BleepingComputer Mon, 19 Oct 2026 04:58:41 -0400 https://www.bleepingcomputer.com/news/microsoft/microsoft-october-windows-server-updates-cause-exchange-issues/

12

Anthropic Acquires Confidential AI Startup Opaque Systems

Opaque Systems has developed technology that lets AI systems use sensitive data while keeping it protected by the underlying hardware. The post Anthropic Acquires Confidential AI Startup Opaque Systems appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 19 Oct 2026 07:45:25 +0000 https://www.securityweek.com/anthropic-acquires-confidential-ai-startup-opaque-systems/

13

16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password

A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication. Researcher Quentin Kaiser presented a talk at Hexacon in Paris documenting a vulnerability in Broadcom’s proprietary 802.11 implementation that has been present

SRC: Security Affairs Mon, 19 Oct 2026 00:36:33 +0000 https://securityaffairs.com/201268/iot/16-year-old-broadcom-wi-fi-bug-lets-attackers-take-over-routers-without-a-password.html

[ SOURCE ] OpenPhish (18 indicator(s))