InfoSec News 20261014
Publicada em: 14/10/2026
TOP NEWS
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.
Tracked as CVE-2026-104935, this high-severity authentication bypass vulnerability lets remote threat actors without privileges execute arbitrary commands on targeted ICS systems in low-complexity attacks that don't require user interaction.
Link
TLP1: Green
Global takedown hits network behind 1 billion phishing messages
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide.
Since the start of the year, more than 750 million malicious messages have been aimed at Microsoft customers via email and SMS texts.
Following an investigation initiated by Microsoft and Japan’s National Police Agency (NPA) into a wave of fraudulent activity, "a sprawling Chinese-language cybercrime marketplace" was discovered, with tools and services for phishing campaigns.
Link
TLP1: Green
Microsoft fixes VPN issues caused by September Windows updates
Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates.
The Always On VPN remote access solution replaced the legacy DirectAccess technology and works with domain-joined, non-domain-joined, and Microsoft Entra ID–joined Windows 10, Windows 11, and Windows Server devices.
Link
TLP1: Green
Cybersecurity State: Surveillance, Cyberwarfare, Cybercriminality and Hacktivism
Hidden Audio Recorder Found at OpenAI as Employee Faces Federal Charges
OpenAI employee charged with planting hidden audio recorders to capture sensitive discussions about AI research and company strategy.
On September 30, OpenAI staff found a small audio recording device jammed into a USB port on the back of a television in an executive conference room in their San Francisco office. The device had been there since September 28, its contents were encrypted, and whoever put it there had wrapped it in toilet paper to hide it.
Link
TLP1: Green
Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals
Microsoft on Wednesday announced legal action disrupting three powerful phishing platforms used by Chinese cybercriminals to send hundreds of millions of malicious messages impersonating over 75,000 organizations worldwide.
The tech giant worked with Japan’s National Police Agency and healthcare cybersecurity organization Health-ISAC to obtain a U.S. court order seizing and redirecting domains that were part of the infrastructure underlying YAM Store, CoGUI and Iron Man.
Link
TLP1: Green
Russian travel booking platform suspends reservations after cyberattack
Russian online travel agency Anywayanyday has temporarily suspended new bookings after a cyberattack on its IT infrastructure, leaving customers unable to purchase airline and train tickets or book hotels through its platform, the company said on Wednesday.
The agency's website remains unavailable as it works to restore its systems. Previously confirmed reservations remain valid, Anywayanyday said, without providing a timeline for resuming normal operations.
Link
TLP1: Green
Breaches: Data Breaches and Hacks
AAA Architectural Hardware Data Breach on October 14, 2026
Description AAA Architectural Hardware Co. is a commercial architectural hardware supplier based in the USA (New York), providing doors, frames, hardware, and access control solutions. Leak Size: Unknown
Claimed By Akira Since March 2023, Akira ransomware threat actors have impacted a wide range of businesses and critical infrastructure entities in North America, Europe, and Australia. In April 2023, following an initial focus on Windows systems, Akira threat actors deployed a Linux variant targeting VMware Elastic Sky X Integrated (ESXi) virtual machines (VMs).
Link
TLP1: Green
Vulnerabilities: Vulnerability Advisories, Zero-Days, Patches and Exploits
Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities
Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise.
On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance running version 22.8R2.4, the latest build available at the time. Three chained zero-days gave an unknown attacker unauthenticated root access.
Link
TLP1: Green
Hirudo Android malware replaces banking apps to evade security checks
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks.
Researchers identified malicious copies of eight banking apps that use a hooking engine to bypass app-signature, Accessibility, and Play Integrity checks by substituting certificate information or returning empty lists.
Threat actors can use Hirudo to steal credentials, remotely control infected phones in real time, collect messages, capture screenshots, and record audio.
Link
TLP1: Green
Incident Response: Infrastructure, Training, SIEM and Incident Handling
The Blind Spots of Agentic Pentesting and How to Close Them
For years, security teams had a window of several weeks between a CVE going public and attackers exploiting it. Every year, that window got smaller. Then Mythos-class models arrived, and attackers can now weaponize a new CVE within hours. That leaves security teams very little time to find out whether they’re exposed.
A manual pentest usually goes through several phases: reconnaissance, vulnerability assessment, initial access, post-exploitation, and reporting. Traditional automated pentesting tools follow the same phases. Even before LLMs took off, some advanced tools used machine learning to choose the next step. For example, five years ago, we built our Attack Path Validation (APV) product with such a decision engine. But AI agents take it further.
Link
TLP1: Green
Technical Articles: Forensics, Reverse Engineering, Malware, Phishing, Pentesting, Software Security and Cryptography
How a leaked builder of XWorm turned a remote access trojan into a surveillance kit
Netskope tracks four XWorm versions in the wild, 46 plugins, and new tools for location, audio and live browser control, with detections up fourfold.
Since Netskope published its report on version 6.0 in July 2025, four new versions of the malware have been discovered: V6.4, V6.5 (“XWorm Reborn”), V7.2, and V7.4. Three of these versions were released after the malware generator tool became publicly available. The number of known plugin features has also increased from 35 to 46. This includes new modules, such as SteamTokenRecovery, Rootkit, ResetSurvival, and Cmstp-Bypass, as well as several plugins that were previously removed in V6.0 but have now been brought back.
Link
TLP1: Green
1Traffic Light Protocol (TLP) [1] for information sharing:
- Red: Not for disclosure, restricted to participants only.
- Amber: Limited disclosure, restricted to participants organizations.
- Green: Limited disclosure, restricted to the community.
[1]https://www.first.org/tlp