Saturday, October 17, 2026
Published 7:01 AM · 120 articles from 14 sources · about 6 min to read in full
Cyber security
Supply-chain and credential abuse dominated, alongside a major public OpenBSD kernel exploit. Government advisories focused on election-season phishing and scams. Several consumer-facing incidents involved large user counts.
What happened
Calif published a working root exploit for OpenBSD 7.9 that chains a 37-year-old integer overflow in shared memory with a kernel flaw. The chain bypasses KARL, SMAP and SMEP. The writeup, titled 'Big Fish', drew heavy discussion on Hacker News and Lobsters. The Hacker News ↗
UAT-11985 targets Taiwan research affiliates with fake event invitations and Google adversary-in-the-middle phishing. The kit steals credentials and MFA codes, so MFA alone would not stop it. The Hacker News ↗
CISA and the FBI warned election and campaign officials about phishing, smishing and malware ahead of the 2026 US midterms. A separate FBI public service announcement covers election-themed scams aimed at voters. CISA Advisories ↗
Seventeen more vulnerabilities were disclosed in X.Org client libraries, following a dozen for the X server. Distribution advisories are the thing to watch. Phoronix ↗
Burger King Japan disclosed that attackers accessed a server holding 11.18 million customer records. The summary does not say which fields were exposed. BleepingComputer ↗
A fake WhatsApp clone from developer 'Agment Assets sallu' has passed 500,000 Play Store downloads. It appears above the real app as a sponsored listing. The Verge ↗
A bug in Ray-Ban Meta smart glasses allowed audio recording without the wearer's consent, per Ars Technica's headline and summary. The bug has been fixed. Ars Technica ↗
Amsterdam authorities seized the Autistici/Inventati server at the request of US authorities, per NL Times. The summary gives no further detail. Hacker News (front page) ↗
Articles the model saw · 21
Attackers hijacked AOMEI Backupper update servers for brief windows from May to July 2026 to push a backdoor to Windows users.
The Hacker Newssupply-chainbackdoormalwarewindowsFeed excerpt
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis
CISA warns CVE-2026-102764, a critical BeyondTrust Remote Support authentication bypass, is being actively exploited and added to the KEV catalog.
CISA Advisoriescvekevactively-exploitedbeyondtrustFeed excerpt
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026. CISA urges organizations with affected self-hosted Remote Support appliances to immediately take the following actions: Apply the BT26-05-RS patch, as outlined in BeyondTrust’s Security Advisory BT26-05. Organizations on a self-hosted Remote Support version older than 24.3.1 will need to upgrade to a newer version to apply the patch. Organizations using BeyondTrust-hosted (SaaS) Remote Support deployments have already been patched. Review BeyondTrust’s blog ARMORY CASTLE and BT26-05: What Security Teams Need to Know for detailed information on the vulnerability and recommended response and mitigation actions. Limit external access to the Remote Supp…
Threat actors abused a compromised ConnectWise Cloud Backup Microsoft 365 credential to access 173 customer M365 tenants.
The Hacker Newsm365breachmspcloudFeed excerpt
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs
A maximum-severity BlockStrap flaw, CVE-2026-103849, in Magento and Adobe Commerce could allow arbitrary PHP code execution on store servers.
BleepingComputercvemagentorceFeed excerpt
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]
Calif published a working root exploit for OpenBSD 7.9 chaining a 37-year-old integer overflow with a kernel flaw to bypass KARL, SMAP, and SMEP.
The Hacker Newsopenbsdprivilege-escalationexploitkernelFeed excerpt
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped
Candiru spyware was delivered to Al Jazeera Media Network devices through malicious online ads requiring only rendering, a zero-click attack.
BleepingComputerspywarezero-clickmalvertisingFeed excerpt
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]
UAT-11985 uses fake event invitations and Google AitM phishing to steal credentials and MFA codes from Taiwan research affiliates.
The Hacker NewsaptphishingaitmFeed excerpt
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by
A writeup describes exploiting a 37-year-old kernel bug in OpenBSD.
LobstersopenbsdkernelexploitFeed excerpt
Comments
Calif.io researchers published an exploit for a 37-year-old kernel bug in OpenBSD.
Hacker News (front page)openbsdkernelexploitvulnerabilityFeed excerpt
Article URL: https://calif.io/research/big-fish Comments URL: https://news.ycombinator.com/item?id=50118977 Points: 24 # Comments: 0
An attack on a BAE-managed system disrupted US bankruptcy courts, delaying paper filings and e-notices.
The RegisterattackgovernmentoutageFeed excerpt
Legal eagles still plodding along with some operations, but paper and e-notices delayed until further notice
CISA and the FBI warn election and campaign officials about phishing, smishing, and malware threats ahead of the 2026 U.S. midterms.
CISA AdvisoriesadvisoryphishingelectionsFeed excerpt
CISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Malicious cyber actors may use phishing and smishing techniques to steal login credentials and other sensitive information or install malware on targeted devices. Election officials, candidates, and political organizations may be attractive targets because of their access to voter registration data, current government officials, and sensitive campaign information. Cyber actors are increasingly using sophisticated phishing and smishing campaigns that closely resemble legitimate communications. These efforts may include convincing emails, text messages, audio, and video content designed to manipulate recipients into disclosing sensitive information or interacting with malicious links and attachments. CISA and the FBI urge election officials, campaign personnel, and the public to review the PSA, follow recommended cybersecurity practices, and remain vigilant for suspicious emails and mobile messages.
Seventeen more vulnerabilities were publicly disclosed affecting multiple X.Org client libraries, following a dozen for the X server.
Phoronixx.orgvulnerabilitylinuxFeed excerpt
Just shy of two weeks since a dozen vulnerabilities were published for the X.Org Server and XWayland, more than one dozen vulnerabilities were made public today affecting multiple X.Org client libraries...
A bug in Ray-Ban Meta smart glasses enabled a privacy-invasive scenario, since fixed, raising ongoing privacy concerns.
Ars TechnicaprivacymetahardwareFeed excerpt
The bug is fixed, but privacy concerns remain.
A fake WhatsApp clone from developer "Agment Assets sallu" reached over 500,000 Play Store downloads and sits above the real app as a sponsored listing.
The Vergemalwaregoogle-playimpersonationFeed excerpt
After a Chrome clone was spotted on the Play Store earlier this week, a user on Reddit says they're seeing a fake version of WhatsApp in a "sponsored" slot above the real version. As reported earlier by Android Authority, the WhatsApp dupe has racked up over 500,000 downloads and, at the time of writing, its Play Store listing is still live. Google did not immediately respond to a request for comment. The WhatsApp clone is from a developer going by "Agment Assets sallu" who doesn't currently have anything else listed on the Play Store. Their listing for the WhatsApp impostor has the same icon, screenshots, and text as the real version, but … Read the full story at The Verge.
FBI public service announcement warns of election-themed scams and cyberattacks targeting voters ahead of the 2026 midterms.
The RegisterfbiphishingelectionsFeed excerpt
The inevitable election-themed cyberattacks are whirring again, as the feds issue PSA about the ones to watch out for
Amsterdam authorities seized the Autistici/Inventati server at the request of U.S. authorities, per NL Times reporting.
Hacker News (front page)law-enforcementhostingprivacyFeed excerpt
Article URL: https://nltimes.nl/2026/10/14/amsterdam-server-seized-request-us-authorities-antifa-allegations Comments URL: https://news.ycombinator.com/item?id=50117952 Points: 29 # Comments: 19
Cloudflare introduces continuous evaluation of Verified bots to check they honor robots.txt and HTTP 429 site preferences.
Cloudflare BlogbotscloudflarewebFeed excerpt
Identity alone doesn't guarantee a bot will behave responsibly. We are introducing a system to continuously evaluate whether Verified bots honor site preferences, like robots.txt and HTTP 429s, ensuring they remain accountable over time.
Burger King Japan disclosed a breach in which attackers accessed a server holding 11.18 million customer records.
BleepingComputerdata-breachprivacyFeed excerpt
Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. [...]
A researcher writeup details bypassing WiFi and UART protections and recovering a damaged flash chip in Eufy HomeStation2 firmware.
Hacker News (front page)firmwareiothardware-hackingFeed excerpt
Article URL: https://adepts.of0x.cc/eufy-homestation2-firmware/ Comments URL: https://news.ycombinator.com/item?id=50119751 Points: 8 # Comments: 1
NordLayer guidance on how IT teams can detect and block sensitive data flowing into personal ChatGPT accounts.
BleepingComputershadow-aidata-leakagesponsoredFeed excerpt
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts. [...]
Routine batch of Linux distribution security advisories from AlmaLinux, Debian, Mageia, Oracle, Red Hat, and SUSE.
LWN.netadvisorieslinuxpatchesFeed excerpt
Security updates have been issued by AlmaLinux (ghostscript, grafana, hplip, libsoup3, lrzsz, rpcbind, and wireshark), Debian (chromium, cifs-utils, expat, gst-plugins-bad1.0, gst-plugins-good1.0, jpeg-xl, mutt, and spip), Mageia (gpsd, libx11, and roundcubemail), Oracle (389-ds-base, compat-libtiff3, environment-modules, ghostscript, grafana, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, hplip, idm:DL1, kernel, kernel-uek, libsoup, libsoup3, lrzsz, rpcbind, and wireshark), Red Hat (gd), SUSE (alloy, amazon-ecs-init, bind, busybox, chromium, distribution, govulncheck-vulndb, iperf, jackson-annotations, jackson-core, jackson-databind, kernel, libXtst, mutt, openssh, php8, python313-python-multipart, python313-python-rapidjson, python313-python3-saml, python313-pywbem, python313-redis, python313-reportlab, python313-requests, python313-rope, python313-rpyc, python313-rsa, qemu, swtpm, the Java stack, and wpa_supplicant), and Ubuntu (golang-1.23, linux-azure, and rabbitmq-server).