17.10.2026

CSO Online 16.10.2026 17:29
Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI’s official skills repository.
OpenAI maintains an official GitHub repository of skills that teach AI agents how to work with various platforms and services. As an official skill, these components are often given an implicit level of trust because they are contributed or vetted by verified vendors.

The Hacker News 16.10.2026 16:43
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.

Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis

The Hacker News 16.10.2026 16:16
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes.

The activity is being tracked by

CSO Online 16.10.2026 15:17
A chain of vulnerabilities in Google’s Chrome browser could have enabled researchers to take control of one billion Windows machines worldwide — and it cost them just $40,000 in AI compute time to discover it.
Researchers at Xbow USA worked for six days on developing the exploit, which earned them a $250,000 bug bounty from Google, the first under the new 2026 rules.

Heise Security 16.10.2026 14:29
Im Zuge der Geheimdienstrechtsnovelle drängen Wirtschaft und Zivilgesellschaft auf klare gesetzliche Leitplanken gegen das bewusste Offenhalten von IT-Lücken.

CSO Online 16.10.2026 11:37
The Linux kernel’s networking stack was found vulnerable to a guest-to-host escape attack, in which an attacker operating inside a virtual machine (VM) could cross the isolation boundary and access the underlying host.
Dubbed PwnEscape and tracked as CVE-2026-99999, a flaw allowed guest-controlled packet metadata to trigger a write that changes an IPv4 header after the kernel has already processed it. That flaw could be chained with additional exploitation techniques to achieve host-level code execution.

CSO Online 16.10.2026 10:24
Organizations running self-hosted BeyondTrust Remote Support should treat exposed appliances as potentially compromised after a suspected Chinese espionage group exploited a critical zero-day to gain root control, access credential vaults, and establish footholds for lateral movement, according to Mandiant and Google Threat Intelligence Group.
“Organizations should prepare for potential widespread exploitation following this disclosure,” Google Threat Intelligence Group (GTIG) and Mandiant said in a blog post. The post attributes the zero-day exploitation to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, and dates it to late August.

Golem 16.10.2026 08:47
Das Update verhindert eine Remotecodeausführung außerhalb der Sandbox von Chrome. Die Lücke entdeckte ein Mitarbeiter von Anthropic. (Chrome, Google)

The Hacker News 16.10.2026 06:55
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.

The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a

The Hacker News 16.10.2026 04:59
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH.

The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a