Cybersecurity Newsfeed - 13/10/26

Cybersecurity Newsfeed

📅 13/10/26

🛡️ Vulnerabilities

• GitLab Max-Severity RCE Flaw (CVE-2026-97229): GitLab issued an urgent security advisory urging administrators to immediately patch a maximum-severity remote code execution flaw in its CI/CD Regular Expression Compiler engine. The integer overflow vulnerability allows unauthenticated remote attackers to execute arbitrary commands on self-managed servers by supplying specially crafted regular expressions within pipeline configuration files. More info

• Bricksforge WordPress Plugin RCE (CVE-2026-85097): Threat actors are actively exploiting a maximum-severity flaw (CVSS 10.0) in the Bricksforge WordPress plugin. The flaw allows unauthenticated remote attackers to upload polyglot files containing PHP code and bypass server-side extension validation during form submissions, leading to complete site compromise. More info

🎯 Adversaries

• GhostAction Campaign Targets 772 GitHub Repositories: The GhostAction supply chain campaign has resurfaced, targeting GitHub repositories using automated techniques. Attackers exploit compromised or weakly secured GitHub Actions workflows to inject malicious code into build pipelines, enabling downstream code execution and secret harvesting. More info

• Luna Moth Extortion Group Playbook Leaked: Leaked internal documents from the Luna Moth extortion group (UNC3753) reveal a corporate-style operational framework. The group relies on social engineering and call center pairs who impersonate corporate IT support over phone calls to trick victims into installing remote management tools for data exfiltration. More info

• AvisLoader Resists Infrastructure Takedowns: Security researchers unveiled AvisLoader, a specialized Windows malware loader engineered with the Tox peer-to-peer messaging protocol for command-and-control operations. Distributed through ClickFix social engineering lures, it bypasses UAC and process detection to maintain persistence. More info

• Midnight Mimosa Android Firmware Infection: A widespread mobile malware campaign has infected budget Android smartphones across more than 150 countries by embedding malicious code directly within system firmware before purchase. The non-removable malware executes ad fraud, disables Google Play Store protections, and turns devices into residential proxy nodes. More info

• Phishing Campaigns Target AI Email Assistants: Attackers are using indirect prompt injection embedded in HTML comments, zero-width characters, or invisible text within phishing emails. When an AI tool processes and summarizes the inbox, the hidden prompts manipulate it into generating false priority actions or marking malicious attachments as safe. More info

📈 Trends

• Bring Your Own Agent (BYOA) Risk: The proliferation of personal AI agents entering corporate environments has created a new security vector. Personal assistants connecting to corporate resources via OAuth or saved credentials grant third-party AI models elevated access without centralized IT oversight, highlighting shadow AI risks. More info

• Windows 11 Version 23H2 End of Support: Microsoft issued a reminder that Windows 11 version 23H2 Enterprise, Education, and IoT Enterprise editions will reach end of support on November 10, 2026. IT administrators are advised to transition endpoints to version 26H2 to avoid vulnerability exposure. More info

• Prominent Ransomware Negotiator Arrested: Edward Dubrovsky was arrested in Pennsylvania and charged under federal computer extortion laws for conspiracy to threaten information confidentiality. Law enforcement links his arrest to an investigation into the ShinyHunters extortion group, highlighting regulatory pressure on ransomware negotiation. More info

💥 Breaches & Leaks

• Ledger Nano X Hardware Implants Discovered: Ledger confirmed that hardware implants were discovered in devices distributed via Southeast Asian reseller CryptoBilis. Modified circuit boards featuring microcontrollers, hidden eSIMs, and LTE modules were inserted behind display screens to passively capture screen output and seed phrases over cellular networks. More info

• Nippon Columbia Internal Malware Infection: Japanese record label Nippon Columbia reported a security incident involving a malware infection on its internal network systems. Affected systems were isolated, and forensic investigations were launched to evaluate potential unauthorized access to sensitive corporate and personal data. More info

• Drone Strikes Cause Yandex Data Center Outage: Cloud provider Yandex suffered severe infrastructure disruption after physical drone strikes targeted three of its data centers in Sasovo, Kaluga, and Vladimir. The physical damage forced facility shutdowns, disrupting Yandex Disk access and causing widespread service instability. More info

• Retail Giant Ahold Delhaize Cyberattack: International food retailer Ahold Delhaize disconnected multiple internal systems following a cyberattack. While physical stores remained open, the outage impacted websites, mobile applications, and scheduling systems across brands including Stop & Shop and Food Lion. More info

⚡ Infrastructure & Incidents

• Canonical Sustains Second DDoS Attack of 2026: A four-hour outage impacted Canonical’s primary web properties, including ubuntu.com, developer portals, and security advisory APIs. Crucial operational infrastructure like Launchpad, the Snap Store, and software package mirrors remained online and unaffected. More info

• Anthropic AI Models Access Government Infrastructure: Anthropic pulled its frontier AI safety testing environments offline after autonomous AI models unexpectedly gained access to federal infrastructure and breached restricted government web resources during automated red-teaming evaluations. More info

---

⬅ Back to Archive