Cyber Threat Intel Daily Briefing — 2026-10-22

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-22 12:15 UTC · REPORT BRIEF-20261022-121531

OPEN // LE

01

GitLab warns of new max severity code execution vulnerability

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. […]

SRC: BleepingComputer Thu, 22 Oct 2026 07:41:48 -0400 https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/

02

Splunk, SolarWinds Release Fresh Security Updates

Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information. The post Splunk, SolarWinds Release Fresh Security Updates appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 22 Oct 2026 10:45:24 +0000 https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/

03

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.

SRC: The Hacker News Thu, 22 Oct 2026 16:14:05 +0530 https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html

04

Cisco Patches 34 Vulnerabilities Across Multiple Products

Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks. The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 22 Oct 2026 10:05:21 +0000 https://www.securityweek.com/cisco-patches-34-vulnerabilities-across-multiple-products/

05

Encryption isn’t enough to protect data wherever it goes

Once data is in use, encryption falls short. A tested approach that replaces sensitive values with realistic substitutes could make stolen information far less useful to hackers. The post Encryption isn’t enough to protect data wherever it goes  appeared first on CyberScoop.

SRC: CyberScoop Thu, 22 Oct 2026 10:00:00 +0000 https://cyberscoop.com/vaultless-keyless-pseudonymization-cybersecurity-policy-op-ed/

06

Authorities disrupt nearly 11,000 cybercrime networks in Africa

Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. […]

SRC: BleepingComputer Thu, 22 Oct 2026 04:27:11 -0400 https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/

07

FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations

SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory th

SRC: Security Affairs Thu, 22 Oct 2026 06:48:43 +0000 https://securityaffairs.com/201464/cyber-crime/fbi-and-cisa-warn-of-safepay-ransomware-attacks-on-600-organizations.html

08

High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7

Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents. The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 21 Oct 2026 14:45:00 +0000 https://www.securityweek.com/high-severity-flaws-exploited-in-three-days-as-ransomware-dominates-q3-rapid7/

09

Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group

Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said. The post Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group appeared first on CyberSc

SRC: CyberScoop Wed, 21 Oct 2026 21:58:21 +0000 https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/

10

Russian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by Ukraine

A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space. A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countri

SRC: Security Affairs Wed, 21 Oct 2026 21:29:04 +0000 https://securityaffairs.com/201446/breaking-news/russian-satellite-makes-a-close-approach-to-a-commercial-radar-satellite-used-by-ukraine.html

11

Lazarus hackers use post-quantum cryptography for malware delivery

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. […]

SRC: BleepingComputer Wed, 21 Oct 2026 16:31:48 -0400 https://www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/

12

Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation

Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in s

SRC: The Hacker News Thu, 22 Oct 2026 16:45:42 +0530 https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html

13

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub

SRC: The Hacker News Thu, 22 Oct 2026 13:58:48 +0530 https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html

14

TiDB Breach Exposes Flawed Cloud Security Assumptions

Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost.

SRC: DarkReading Wed, 21 Oct 2026 21:15:39 GMT https://www.darkreading.com/cloud-security/tidb-breach-flawed-cloud-security

15

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Dock

SRC: The Hacker News Wed, 21 Oct 2026 23:31:57 +0530 https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html

16

UAE Transitions 50% of Gov't Services to Agentic AI

The United Arab Emirates says it's creating a foundation of security and safety as it transforms its public service footprint.

SRC: DarkReading Thu, 22 Oct 2026 05:00:00 GMT https://www.darkreading.com/cybersecurity-operations/uae-transitions-50-government-services-agentic-ai

17

Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook

The $25 billion award far exceeds a $5 billion fine the Federal Trade Commission levied against Facebook in 2019. The post Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 22 Oct 2026 07:26:54 +0000 https://www.securityweek.com/meta-ordered-to-pay-new-mexico-25-billion-for-deceiving-users-about-privacy-on-facebook/

18

Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security

The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.

SRC: DarkReading Wed, 21 Oct 2026 20:14:42 GMT https://www.darkreading.com/cloud-security/marvell-microsoft-oracle-standardize-data-center-hardware-security

19

Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens

Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization.

SRC: DarkReading Wed, 21 Oct 2026 20:03:14 GMT https://www.darkreading.com/cloud-security/cloud-security-alliance-survey-data-loss-prevention-detects-data-loss

[ SOURCE ] OpenPhish (18 indicator(s))