{"date_iso":"2026-10-19","date_human":"Monday, October 19, 2026","generated_utc":"2026-10-19 12:56 UTC","read_minutes":4,"patch_tuesday":false,"top_stories":[{"title":"ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants","link":"https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Cyber Security News","Huntress","Infosecurity Magazine","The Hacker News"],"coverage":5,"cve_ids":[],"summary":"ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application\u2026","source":"The Hacker News","date_rel":"18 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxTJ5xsWsmrBmF1q18Gi5uaokNeC6-M0VbSf0T5X3KMQH7QGMhC7mz4XB6TUJuE7P9tjknMAqaGQ-Iz_7UuQ-NdKKXJTgqLhHMipRcd57VUOpwfJ2xxO8Hq_PX8hotdp_KZddNDzfQFw3bLHbYYLasThNbqGlidzhZ485ApBIKh2KUgn4g6PeBbhMwhc0T/s1600/ms-connect.jpg","description":"ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise","related":[{"title":"Microsoft fixes classic Outlook bug that hid Copilot buttons","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-bug-that-hid-copilot-buttons-in-classic-outlook/","source":"Bleeping Computer","date_rel":"11m ago"},{"title":"ConnectWise Shuts Off Cloud Services After \u2018Unauthorized Access\u2019 to Microsoft 365 Tenants","link":"https://www.infosecurity-magazine.com/news/connectwise-shuts-off-cloud/","source":"Infosecurity Magazine","date_rel":"2h ago"},{"title":"Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack","link":"https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/","source":"Bleeping Computer","date_rel":"17 Oct"},{"title":"Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts","link":"https://cybersecuritynews.com/connectwise-credentials-microsoft-365-accounts/","source":"Cyber Security News","date_rel":"17 Oct"},{"title":"Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants","link":"https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html","source":"The Hacker News","date_rel":"17 Oct"},{"title":"ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks","link":"https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access","source":"Huntress","date_rel":"16 Oct"}]},{"title":"Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic","link":"https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html","reason":"Windows","category":"News","sources":["Microsoft Security","The Hacker News","The Register Security"],"coverage":3,"cve_ids":["CVE-2026-108465"],"summary":"A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for\u2026","source":"The Hacker News","date_rel":"2h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAw5A6yrE0NkMreq5lBZaS4ndrFrorAZaVrjJ218aS1RcJoQVYOJOVejIn8rBH5RHIIZ_cpvtzHnQMwMMWVOFbpfcs01tolLCmlYAY3qy-onWaOUQhzB6H2VjlWaUgBCL_0vAjRB7VmumClnaiIxDds6j9wD3lt9vD-kptWl6bUft29O6Z0cTNgBQV6t76/s1600/npm-apex.jpg","description":"A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. \"The tools delivered information-stealing malware and backdoors for macOS and Windows machines,\" Elastic","related":[{"title":"MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon","link":"https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html","source":"The Hacker News","date_rel":"17 Oct"},{"title":"Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor","link":"https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html","source":"The Hacker News","date_rel":"16 Oct"},{"title":"Networking problems after the October 2026 Windows update? NTLM might be to blame","link":"https://www.theregister.com/security/2026/10/16/networking-problems-after-the-october-2026-windows-update-ntlm-might-be-to-blame/5303503","source":"The Register Security","date_rel":"16 Oct"},{"title":"CVE-2026-108465 Windows Update Delivery Optimization Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108465","source":"Microsoft Security","date_rel":"16 Oct"}]},{"title":"OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys","link":"https://thehackernews.com/2026/10/opencode-console-breach-may-have.html","reason":"Google","category":"News","sources":["CCCS Alerts & Advisories","Cyber Security News","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional\u2026","source":"The Hacker News","date_rel":"6h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzRSuvywT7bfHRl45krYywOIqL__Cw1hXchChbx5ylDNZaHxVDEf8O1pmzajCnItG1rwxKq0k2GHdMeDW_DvQP8Wk5MEiwlE2dZXn9grvDpAOpViWonNWsFMkTXoKpcFj8lk0UuMrGx-xVHRU_KufidsDcY7e0RUSG62aapDC9y9opt8V_rmgxkCG9v6A/s1600/opencode.jpg","description":"An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without","related":[{"title":"Google Unveils New Android AI Protections to Block Scam Calls, Phishing Links and OTP Theft","link":"https://cybersecuritynews.com/google-unveils-new-android-ai-protections/","source":"Cyber Security News","date_rel":"6h ago"},{"title":"Google security advisory (AV26-1060)","link":"https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-1060","source":"CCCS Alerts & Advisories","date_rel":"16 Oct"},{"title":"UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing","link":"https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html","source":"The Hacker News","date_rel":"16 Oct"}]},{"title":"US Cybersecurity Job Postings Fall 26%, Hitting Four Year Low","link":"https://www.infosecurity-magazine.com/news/cybersecurity-job-postings-fall/","reason":"Cybersecurity Postings Fall","category":"News","sources":["Infosecurity Magazine","SecurityWeek"],"coverage":2,"cve_ids":[],"summary":"CyberSN observed a particularly big dip in cybersecurity leadership positions such as CISO and Cybersecurity Director in 2026 compared to 2025","source":"Infosecurity Magazine","date_rel":"2h ago","thumbnail":"","description":"","related":[{"title":"US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars","link":"https://www.securityweek.com/us-cybersecurity-job-postings-fall-26-as-ai-security-engineer-demand-soars/","source":"SecurityWeek","date_rel":"18 Oct"}]},{"title":"Microsoft Confirms October Windows Updates Can Break Exchange Server Email Services","link":"https://cybersecuritynews.com/october-updates-break-exchange-server/","reason":"Exchange","category":"News","sources":["Bleeping Computer","Cyber Security News"],"coverage":2,"cve_ids":[],"summary":"Microsoft has confirmed that Windows Server security updates released on October 13, 2026, can disrupt Exchange Server email services, blocking webmail access and leaving messages undelivered. The issue affects some\u2026","source":"Cyber Security News","date_rel":"9h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/October-Updates-Break-Exchange-Server.webp","description":"Microsoft has confirmed that Windows Server security updates released on October 13, 2026, can disrupt Exchange Server email services, blocking webmail access and leaving messages undelivered. The issue affects some on-premises systems running Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. Microsoft has published a workaround and advises administrators not to uninstall the Windows updates. The failures stem from changes in Windows Server, not the separate October Exchange Server security updates. Servers can experience problems even without installing\u2026","related":[{"title":"Microsoft: October Windows Server updates break Exchange sign-in, mail flow","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-october-windows-server-updates-cause-exchange-issues/","source":"Bleeping Computer","date_rel":"3h ago"}]},{"title":"Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI","link":"https://cybersecuritynews.com/google-fixes-10-chrome-vulnerabilities/","reason":"Chrome","category":"News","sources":["Cyber Security News","SecurityWeek","Volexity"],"coverage":3,"cve_ids":[],"summary":"Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The\u2026","source":"Cyber Security News","date_rel":"17 Oct","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Google-Fixes-Chrome-Vulnerabilities-Including-Memory-Corruption-Flaw-Found-With-Claude-AI.webp","description":"Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026. Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux over the coming days and weeks. Users should install the update when it becomes available and check Chrome\u2019s About page to\u2026","related":[{"title":"Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP","link":"https://www.volexity.com/blog/2026/10/16/mind-the-patch-gap-part-3-analysis-with-volexity-volcano-threat-intel-and-mcp/","source":"Volexity","date_rel":"16 Oct"},{"title":"In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit","link":"https://www.securityweek.com/in-other-news-ics-sniper-attack-hacking-xworm-malware-operators-250k-chrome-exploit/","source":"SecurityWeek","date_rel":"16 Oct"}]},{"title":"BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs","link":"https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs","reason":"Ivanti","category":"News","sources":["CCCS Alerts & Advisories","Dark Reading"],"coverage":2,"cve_ids":[],"summary":"Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.","source":"Dark Reading","date_rel":"16 Oct","thumbnail":"https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4a126b2e0eae913e/6ad27ebc7cb22e18dd04a52b/Locusts-ZU_09-Getty.jpg?width=720&quality=80&disable=upscale","description":"","related":[{"title":"Ivanti security advisory (AV26-1035) - Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035","source":"CCCS Alerts & Advisories","date_rel":"16 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-110372","vendor":"Brainstorm Force","product":"OttoKit","severity":"CRITICAL","score":9.8,"description":"Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.","cwe":"CWE-266","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-40-privilege-escalation-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110372"},{"id":"CVE-2026-110886","vendor":"QuantumCloud","product":"Conversational Forms for ChatBot","severity":"CRITICAL","score":9.8,"description":"Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/conversational-forms/vulnerability/wordpress-conversational-forms-for-chatbot-plugin-1-5-1-php-object-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110886"},{"id":"CVE-2026-111998","vendor":"vanus-labs","product":"vanus","severity":"CRITICAL","score":9.8,"description":"Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gR\u2026","cwe":"CWE-1392","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500","https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37","https://github.com/vanus-labs/vanus/issues/647"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111998"},{"id":"CVE-2026-108983","vendor":"GeoVision Inc.","product":"GV-ASManager","severity":"CRITICAL","score":9.8,"description":"A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.geovision.com.tw/cyber_security.php"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-108983"},{"id":"CVE-2026-109894","vendor":"Arraytics","product":"Booktics","severity":"CRITICAL","score":9.3,"description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.","cwe":"CWE-89","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-29-sql-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-109894"},{"id":"CVE-2026-107436","vendor":"WP Chill","product":"Strong Testimonials","severity":"HIGH","score":8.8,"description":"Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/strong-testimonials/vulnerability/wordpress-strong-testimonials-plugin-3-3-12-php-object-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-107436"},{"id":"CVE-2026-110895","vendor":"DevItems","product":"Support Genix","severity":"HIGH","score":8.5,"description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.","cwe":"CWE-89","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/support-genix-lite/vulnerability/wordpress-support-genix-plugin-1-4-54-sql-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110895"},{"id":"CVE-2026-110373","vendor":"Hamid Alinia","product":"Login with phone number","severity":"HIGH","score":8.1,"description":"Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.","cwe":"CWE-266","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/login-with-phone-number/vulnerability/wordpress-login-with-phone-number-plugin-1-8-77-privilege-escalation-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110373"},{"id":"CVE-2026-111441","vendor":"openGauss-server","product":"openGauss-server","severity":"HIGH","score":8.1,"description":"\u5728 openGauss-server \u7684 src/gausskernel/cbb/utils/hll/hll.cpp \u4e2d\uff0c\u5185\u7f6e\u51fd\u6570 HllObjectUnpack() \u5b58\u5728\u957f\u5ea6\u6821\u9a8c\u7f3a\u9677\u3002\u8be5\u51fd\u6570\u4ece\u7528\u6237\u63d0\u4f9b\u7684 packed HLL \u89e3\u6790 lenUsed \u4e0e lenTotal \u540e\uff0c\u4ec5\u68c0\u67e5\u8f93\u5165\u957f\u5ea6\u8db3\u4ee5\u8986\u76d6 HLL_HEAD_SIZE + lenUsed\uff0c\u968f\u540e\u6309 lenTotal \u5206\u914d\u7f13\u51b2\u533a\u3001\u6309 lenUsed \u8c03\u7528 memcpy_s() \u62f7\u8d1d\u8f93\u5165\uff0c\u65e2\u672a\u6821\u9a8c lenTotal >= l\u2026","cwe":"CWE-122","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","fix":false,"fix_url":"","refs":["https://gitcode.com/opengauss/openGauss-server/pull/9380"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111441"},{"id":"CVE-2026-16487","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","severity":"HIGH","score":8.1,"description":"A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an at\u2026","cwe":"CWE-345","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://access.redhat.com/security/cve/CVE-2026-16487","https://bugzilla.redhat.com/show_bug.cgi?id=2503686"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-16487"}],"vendor_spikes":[{"vendor":"Linux","count":399,"critical_count":0},{"vendor":"WordPress","count":21,"critical_count":0},{"vendor":"Apple","count":16,"critical_count":0},{"vendor":"Gitea","count":12,"critical_count":0},{"vendor":"Microsoft","count":11,"critical_count":0},{"vendor":"HashiCorp","count":8,"critical_count":0},{"vendor":"diem-project","count":8,"critical_count":0},{"vendor":"AUTOMATIC1111","count":4,"critical_count":0},{"vendor":"Unknown","count":4,"critical_count":0},{"vendor":"Canonical","count":4,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":7,"new_cve_count":585,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-108465":{"anchor":"#dev-2","rank":2,"coverage":3}}}