October 20, 2026
- Plex2Shell has moved from a public exploit chain to active compromise. A honeypot began seeing scans within a day of disclosure and later captured successful infections delivering cryptominers and residential-proxy software. Plex Media Server users should be on version 1.43.3. The researcher behind the chain said AI heavily accelerated component mapping and verification, but human judgment guided the work. Ars Technica This is the material change from the public chain in earlier coverage. (discussion)
· Vulnerabilities & Exploits
- ROMULUS is a newly documented ClickFix delivery platform distributing LegionLoader and other malware. Operators use bogus landing pages to persuade visitors to run malicious commands themselves, packaging the now-common social-engineering pattern into reusable delivery infrastructure. The Hacker News
· Threat Activity
in OpenCode’s Distillation Breach Exposes AI Provider Keys
October 14, 2026
- GitLab's CVSS 10.0 CI/CD regex flaw now has Nordic CERT advisories behind it. CVE-2026-97229 is an integer overflow in the CI/CD regular-expression compiler allowing unauthenticated arbitrary code execution on the server; all versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2 are affected. CERT-SE urges urgent patching for internet-exposed instances and log review for signs of intrusion (CERT-SE, CERT.dk) (earlier coverage).
· Vulnerabilities & Exploits
- Ledger published its Donjon analysis of the implant, found in a signer sold by Southeast Asian reseller CryptoBilis: a hidden component whose microcontroller reads and decodes the 24-word recovery phrase off the screen during setup, then transmits it over LTE via a provisioned eSIM (CoinDesk). Losses linked to the implant are now put at $86 million (SecurityWeek). Ledger has told resellers across seven Southeast Asian markets to suspend sales, and MediaMarktSaturn pulled Ledger products from all its countries as a precaution (Cointelegraph) (earlier coverage).
· Supply Chain
- The French refrigeration attacks have expanded beyond Danfoss. CERT-FR revised alert CERTFR-2026-ALE-012 on 13 October to add Copeland xweb and Dixell xweb controllers alongside Danfoss AK-SM/AK-SC, and says attacks are probably still ongoing. Attackers raised temperatures to 50°C overnight on 11 October across hundreds of stores including Carrefour, Auchan and Les Mousquetaires chains, forcing mass disposal and millions of euros in losses (The Hacker News, SecurityWeek). Claroty Team82 separately published vulnerability research on the Danfoss controllers (Claroty) (earlier coverage).
· Threat Activity
- Preinstalled firmware malware on low-cost MediaTek-based Android phones is turning devices into residential proxies and running covert app installs and ad fraud; Bitdefender tracks it as Midnight Mimosa (The Hacker News).
· Threat Activity
in Three Chained Zero-Days Put Root on a Fully Patched Ivanti VPN
October 13, 2026
- C2Agent is described by Unit 42 as LLM-operated Windows malware with MCP support and a "skills" system that abuses the victim's own AI coding tools for post-exploitation — "living off the AI". Its payload URL,
agent.x90[.]dev/data/copilot.txt, was still live at the time of posting (@Unit42_Intel).
· AI-Enabled Attacks - Labyrinth is a malware-as-a-service cyber range for Ludus: Forgejo → Jenkins/Docker build runners → OLLVM/Garble obfuscation → Erebus packaging → Sphinx/LitterBox detonation against an Elastic-instrumented EDR host, with the verdict returned in Mythic. Ships a no-EDR baseline target, RITA+Zeek sensor and a CommandoVM operator workstation; deploy takes 30–60 minutes (GitHub).
· New Tools & Releases
- Japan's National Cybersecurity Office issued a 9 October advisory after confirming multiple intrusions at organisations holding large volumes of personal data, naming web-system vulnerability exploitation, supply-chain compromise and poor data management as the paths in (NCO advisory, PDF). Karaoke operator Daiichi Kosho says 8,724,000 records — 8,631,000 customers and 93,000 employees — were at risk after malware was found on a single contractor PC at Nippon Columbia between 1–2 October (BleepingComputer).
· Threat Intelligence
in Malware That Lives Off the Victim's AI Tooling
October 12, 2026
- Midnight Mimosa is preinstalled Android malware with system-level control. Bitdefender’s research, summarized by Security Affairs, found the implant in firmware on low-cost MediaTek phones from multiple brands across more than 150 countries. It silently installs applications, grants permissions, performs ad fraud, and turns devices into residential-proxy relays. Bitdefender could not determine how it entered the firmware or whether the signing-certificate owner knew about it.
· Threat Activity
in GlobalProtect Auth Bypass Becomes a Ransomware Initial-Access Path
September 4, 2026
A North Korea-linked macOS implant called Gaslight embeds fake system error messages to trick AI analyzers into abandoning malware analysis while the payload executes. CISA added seven actively exploited vulnerabilities to its KEV catalog, including pre-auth flaws in SonicWall SMA 1000, JFrog Artifactory, and BerriAI LiteLLM, with post-exploitation involving reverse shells and crypto miners. ShinyHunters published stolen data from McKesson, Neogen, Elekta, and Jack Henry after extortion deadlines expired, while Shai-Hulud infostealer now targets 469 credential locations including AI tool configs. OpenAI's GPT-6 Astra crossed a critical cybersecurity threshold, finding two unknown zero-days during testing and marking what the company calls the start of the AGI era.
August 2, 2026 weekly
- Russian FSB espionage: Attribution firmed — Microsoft tied worldwide hotel captive-portal hijacking (CaptiveCrunch) to Midnight Blizzard / Storm-2945 (SVR), an evolution of prior weeks' hotel-Wi-Fi MFA-bypass thread, while TA488 (Laundry Bear) moved from the Zimbra vector to an Outlook Web Access XSS zero-day (CVE-2026-42897). Microsoft
· Developing Stories
in The Week Both Frontier Labs Admitted Their Models Attacked Real Companies
July 11, 2026
- GigaWiper, flagged by Microsoft, is a modular Golang Windows backdoor bundling a standalone wiper, ransomware encryption, multi-pass wiping, and persistence, with C2 over RabbitMQ and Redis — an evolution of several prior malware families. The Register, SecurityWeek
· Threat Activity & Malware
- Operation "Muck and Load" — tracked by Socket and highlighted by NCSC-FI — abuses malicious Go modules and multi-stage PowerShell loaders across 222 GitHub repositories, using commit-farming, public dead drops, and protected archives to stage RATs, infostealers, spyware, and cryptominers. Socket via NCSC-FI, SecurityWeek
· Threat Activity & Malware
- SCMBANKER targets Mexican banking, fintech, and crypto customers via ClickFix fake-CAPTCHA lures dropping a PowerShell toolkit (tracked by Elastic as REF6045). The Hacker News
· Threat Activity & Malware
in Progress Orders ShareFile Storage Controllers Offline Over Active Zero-Day Threat
June 29, 2026
- Turla has added new malware, StockStay, to Russia's espionage campaigns against Ukraine, per Google threat researchers. (The Record)
· Threat Activity
in Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week
June 23, 2026
- Brazil's Emergency Alert System hijacked off a decade-old infostealer credential — an actor ("mizanthropiaz") pushed false alerts to hundreds of thousands across São Paulo, Rio, and Brasília after logging in with a username/password harvested by malware in 2016 and never rotated; reports describe no MFA, no IP allowlisting, no rate-limiting, and a static "2+2" CAPTCHA. A textbook case of identity hygiene failure at national scale. The Record
· Threat Activity
- AryStinger botnet enslaves 4,000+ D-Link devices — undocumented malware turns outdated routers and NAS boxes into a proxy network, raising risk of DNS tampering and traffic theft on EOL hardware. BleepingComputer · Malwarebytes
· Threat Activity
in Five Eyes Warns Frontier AI Will Reshape Offensive Cyber Ops as a New Entra ID Conditional Access Bypass Surfaces