⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More

The worst problems don’t always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done.

This week had plenty of that. Trusted connections became a problem. Hardware wasn’t as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren’t supposed to.

Some attacks were clever. Others were painfully simple. The full recap shows just how much can go wrong, and how little it sometimes takes.

⚡ Threat of the Week

ConnectWise Suspends Cloud Backup Following Unauthorized Access — ConnectWise disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The IT management software provider said it took the action on October 17, 2026, at 07:00 UTC, adding it has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users.

• BeyondTrust Remote Support Flaw Exploited as 0-Day — The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a remote attacker to perform file operations on an affected appliance. According to Google-owned Mandiant, the attack involved the deployment of a lightweight PHP web shell codenamed SAWFLY for interactive remote access and a tunneling program called BARECLAW to route traffic through the device. Only a small number of organizations are assessed to be impacted.
• Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages — Microsoft says it has dismantled a criminal marketplace that sold three phishing kits, namely CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System, that were responsible for sending over 1 billion malicious messages to more than 75,000 organizations worldwide. Redmond said it took down Yam Store (aka Storm-3119), a coordinated underground network that offered commercial phishing-as-a-service (PhaaS) toolkits that allowed other threat actors to readily purchase and deploy phishing pages and steal data and credentials. The kits were also capable of advanced evasion, such as geofencing, fake CAPTCHA gates, IP address blocklists and allowlists, and anti-detection configurations. Yam Store functioned as an initial access broker, peddling not just phishing kits but also infrastructure built on compromised or fraudulently obtained Microsoft and Google cloud environments.
• Ledger Finds Unauthorized Hardware Implants — Cryptocurrency hardware maker Ledger temporarily paused sales of its products via CryptoBilis and other third-party resellers in Southeast Asia and Germany after a backdoor embedded into a handful of wallets led to the theft of an estimated $100 million in cryptocurrency. The implants are said to be an advanced version of a backdoor that hardware hacker Joe Grand found earlier this year and notified Ledger in March 2026. It’s not clear how this occurred, but signs point to a compromise of Ledger’s supply chain. One of the victims of the incident is a fraudster who engaged in a task scam and lost more than $4.8 million. “In this task scam, people were paid to fake sales and reviews of real items,” Chainalysis said. “Then a ‘negative balance’ appeared, and they were told to add their own money in order to get paid. On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet.” According to cybersecurity journalist Kim Zetter, Trezor wallet devices sold by third-party non-authorized sellers have also been found to contain implants that generated pre-determined seed phrases so as to allow the attackers to guess them easily and gain access to the accounts.
• Pwn2Own Ireland Demos 98 0-Days — The Pwn2Own Ireland 2026 hacking contest saw white-hat hackers exploiting 98 zero-day flaws, earning them a collective $1,262,000 in rewards. Ikotas Labs came first with 42.5 Master of Pwn points and $361,000 in cash after discovering 12 unique bugs. Xint and Team ZyGoat secured second and third spots. Ikotas Labs, Xint, and Mobile Hacking Lab broke into Google’s Pixel 10, earning them $150,000, $300,000, and $112,500, respectively. Vendors are expected to patch the zero-days disclosed during the competition within 90 days before the details are publicly disclosed.
• OpenAI Disclosed New Misalignment Cases — OpenAI said internal models hacked more websites, bypassed browsing restrictions, and used cryptocurrency from a wallet it couldn’t otherwise access, in the latest set of disclosures where its agents carried out unethical and likely illegal acts. In all, the company reported seven new incidents. The development came as the Indian Computer Emergency Response Team (CERT-In) said it received “multiple voluntary disclosures from AI model providers” whose models, during research and evaluation runs on the open internet, accessed personal data from Indian organizations. The agents found their way in through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles. CERT-In did not name the providers or affected organizations.
• OpenAI Engineer Charged — The U.S. Department of Justice charged an OpenAI engineer, Abdulrahman Alfozan, with attempting to intercept oral communications after allegedly planting a recording device in an executive conference room. Prosecutors claimed company security staff found a second device in his bag. CCTV footage placed the defendant near the conference room on several dates. Alfozan allegedly had no authority to access or participate in meetings held in the room, which is often reserved for the highest-level discussions. In a subsequent filing, federal prosecutors revealed that Alfozan had booked a one-way ticket from San Francisco to Saudi Arabia with his wife and a third family member before his arrest on October 9, 2026.
• Attacks on French Refrigeration Systems — Cyber attacks on Danfoss- and Copeland-managed refrigeration systems pushed temperatures as high as 50°C (122°F) for roughly six hours, impacting over 700 French supermarkets and forcing them to discard food. French cybersecurity authorities advised supermarkets to disconnect them from the internet. The attacks targeted Intermarché and Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc. The affected systems are said to be internet-facing and running outdated firmware. “The username is admin and the password changes every day automatically to.. the current date,” security researcher Kevin Beaumont said. “Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.” To make matters worse, the affected stores likely also failed to put the devices behind a VPN and create an allowlist of trusted IP addresses permitted to log in. “Two things would have changed the outcome,” Pen Test Partners said. “Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor’s own connection, change known and default credentials, and patch to a current release.” Multiple vulnerabilities have been disclosed in the affected models, with Claroty warning that the issues could be exploited to “defrost the food.”
• Collabora RCE Flaw Exploited to Backdoor Nextcloud Servers — Threat actors are exploiting a critical command execution flaw, tracked as CVE-2026-110447 (CVSS score: 9.2), in the Collabora Online – Built-in CODE Server app for Nextcloud to backdoor servers. It has been patched in version 26.4.303. The attacks involve issuing a malicious request to the app’s “proxy.php” endpoint to trigger command injection and plant a PHP web shell with the end goal of conducting reconnaissance and searching for password databases, password manager artifacts, and cryptocurrency wallets.

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-9192, CVE-2026-85947, CVE-2026-85948, CVE-2026-85955, CVE-2026-85956, CVE-2026-9191 (Progress Software MarkLogic Server), CVE-2026-97229, CVE-2026-92883, CVE-2026-16301, CVE-2026-14814 (GitLab), CVE-2026-103521, CVE-2026-103522, CVE-2026-103523, CVE-2026-103524, CVE-2026-103526, CVE-2026-103527, CVE-2026-103528, CVE-2026-103529, CVE-2026-103535, CVE-2026-103537, CVE-2026-107248 (Thelia), CVE-2026-105445 (Docker), CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, CVE-2026-89108, CVE-2026-89113 (SAP), CVE-2026-39919 (Ghostscript), CVE-2026-103849 aka BlockStrap, CVE-2026-92909, CVE-2026-91013, CVE-2026-100133, CVE-2026-92464, CVE-2026-105899, CVE-2026-106622, CVE-2026-105903, CVE-2026-106612, CVE-2026-106624, CVE-2026-75994, CVE-2026-106620, CVE-2026-90530, CVE-2026-106621, CVE-2026-106619, CVE-2026-90532, CVE-2026-48383, CVE-2026-48382, CVE-2026-105895, CVE-2026-103848, CVE-2026-75732, CVE-2026-90531, CVE-2026-83662, CVE-2026-106630, CVE-2026-106629, CVE-2026-106626 (Adobe), CVE-2026-110005 (Komodo Periphery Agent), CVE-2026-16753 (Lowcoder), CVE-2026-104937 (Shopware), CVE-2026-107656 (Fortinet FortiSandbox), CVE-2026-106173 (Fortinet FortiSIEM), CVE-2026-108184, CVE-2026-108185, CVE-2026-53420, CVE-2026-53418 (Zoom), CVE-2026-107815, CVE-2026-107821, CVE-2026-102523, CVE-2026-107819, CVE-2026-107814 (MariaDB), CVE-2026-78401, CVE-2026-78406, CVE-2026-16916, CVE-2026-16823, CVE-2026-19491 (IBM Verify Identity Access and Security Verify Access), CVE-2026-96951, CVE-2026-108398, CVE-2026-92707, CVE-2026-70242, CVE-2026-102866, CVE-2026-105016, CVE-2026-65674, CVE-2026-83498 (Microsoft Windows), CVE-2026-74580 aka Vghost, CVE-2026-99999 aka PwnEscape (Linux kernel), CVE-2026-110152, CVE-2026-110149, CVE-2026-110136, CVE-2026-110161, CVE-2026-110165, CVE-2026-110148, CVE-2026-110151, CVE-2026-110922 (Google Chrome), from CVE-2026-109704 through CVE-2026-109733 (Mozilla Firefox), CVE-2026-84419, CVE-2026-84420, CVE-2026-53562, CVE-2026-53563, CVE-2026-53564 (Citrix), CVE-2026-93637, CVE-2026-93635, CVE-2026-73571, CVE-2026-10631, CVE-2026-50055 (Zimbra Collaboration Suite), CVE-2026-0322 (Palo Alto Networks PAN-OS), CVE-2026-76519 (Cisco Secure Email Gateway), CVE-2026-110447 (Collabora Online – Built-in CODE Server app), CVE-2026-39949 (Cacti), CVE-2026-0702 (VidShop – Shoppable Videos for WooCommerce WordPress plugin), CVE-2026-106126 (Tenable Identity Exposure), CVE-2026-103947, CVE-2026-103946 (Tenable Nessus), CVE-2026-105672, CVE-2026-105673, CVE-2026-105674 (TP-Link Tapo C325WB), CVE-2026-92392, from CVE-2026-86409 through CVE-2026-86415, from CVE-2026-87862 through CVE-2026-87866, from CVE-2026-92387 through CVE-2026-92391 (curl), CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101, CVE-2026-97629 (F5 NGINX), CVE-2026-100156, CVE-2026-96679, CVE-2026-96681 (Bisheng), CVE-2026-34073 (multiple TLS libraries), CVE-2026-44825 (Apache Solr), CVE-2026-104334, CVE-2026-97676, CVE-2026-97678, CVE-2026-97673, CVE-2026-97655, CVE-2026-97679, CVE-2026-88962, CVE-2026-93674, CVE-2026-93675 CVE-2026-104335, CVE-2026-85025, CVE-2026-79724, CVE-2026-81941, CVE-2026-81204, CVE-2026-81211, CVE-2026-81940, CVE-2026-78569, CVE-2026-78575, CVE-2026-76059, CVE-2026-79742, CVE-2026-78571, CVE-2026-105740 (Langflow), CVE-2026-94134, CVE-2026-94135 (Apache Airflow), CVE-2026-81983 (Adobe Acrobat), CVE-2026-79610, CVE-2026-102700, CVE-2026-102701, CVE-2026-79611 (Xen Project/Citrix XenServer), CVE-2026-70111 (Microsoft Windows Server), CVE-2026-23870 (React Server Components), CVE-2026-103059, CVE-2026-70357, CVE-2026-101027, CVE-2026-89430, CVE-2026-104632, CVE-2026-94205 (Gitea), CVE-2026-16516, CVE-2026-83540, CVE-2026-84897, CVE-2026-83540 (WolfSSH), GHSA-673q-mjm6-r5xr, CVE-2026-96889, GHSA-p3m5-59mp-jv5r (Next.js), CVE-2026-108097, CVE-2026-108099 (Drupal), CVE-2026-15911 (confluent-kafka), CVE-2026-102764 (BeyondTrust Remote Support), CVE-2025-61624 (Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager), CVE-2026-104935 (Ivanti Connect Secure), and multiple vulnerabilities in Google BoringSSL.

🎥 Cybersecurity Webinars

• How to Find Hidden AI Agents on Employee Devices and Bring Them Under Control → AI agents are quietly becoming a new insider threat, gaining access to company data, credentials, and internal systems without adequate security oversight. Join this webinar to learn how to uncover hidden AI agents on employee devices, detect malicious agent skills, identify risky permissions, and put practical controls in place before they lead to a security incident.
• How to Find Security Gaps and Build Faster Defenses Against AI-Powered Cyberattacks → AI-powered cyberattacks are evolving faster than traditional defenses can keep up. Join this webinar to learn how to assess your organization’s AI threat readiness, uncover critical security gaps, strengthen detection and response capabilities, and build a practical defense strategy against emerging AI-driven threats.

📰 Around the Cyber World

• Meta said it addressed an issue after reports emerged that some Ray-Ban Meta smart glasses were recording people’s conversations without the wearer knowing. The recordings occurred without users saying the “Hey, Meta” prompt phrase. “This issue has been resolved,” Meta told Android Authority. “People can manage, review, and delete voice logs of their interactions with Meta AI via settings at any time.” Meta did not say what caused the smart glasses to record people without user consent, or how many of them were affected.
• Fortra said it’s tracking a 12-fold increase in emails using requests for quotation, project invitations, and procurement inquiries as phishing lures from October 2025 to September 2026. “These messages impersonate prospective buyers seeking pricing, availability, or project participation,” Fortra said. “Their purpose is not to obtain a legitimate quote, but to persuade a recipient to access an attacker-controlled file-sharing, document-viewing, or procurement portal.”
• A fake download site for the WatchGuard Mobile VPN with SSL (“watchguard-vpn[.]net”) has been observed using a browser pop-up prompt to steal the victim’s VPN server address, username, and password. As of October 13, the domain was offline. “In a unique twist, after collecting credentials twice (the first attempt gets rejected as ‘incorrect’ in a likely attempt to collect multiple credentials), the site then downloads the genuine, validly signed WatchGuard installer directly from WatchGuard’s own content delivery network (CDN), meaning there is no malicious file for endpoint security tools to flag,” Huntress said. “Meanwhile, unbeknownst to the victim, the threat actor now has access to their credentials, giving them access to victims’ networks.”
• A set of 42 malicious RubyGems packages has used typosquatting, brandjacking, and plausible utility names to target cryptocurrency and Web3 developers. The packages are designed to spawn a reverse shell and download a crypto theft kit capable of rerouting cryptocurrency transactions by replacing the destination address with an attacker-controlled wallet and harvesting wallet material, such as seed phrases and private keys. The names of some of the packages are: lightinng-invoice, cryoto-toolbox, etheremu.rb, bitcoin-rpc-lite, web3-sign-helper, and crypto-mnemonic-tools. The activity has been codenamed Ghost Dev by Open Source Malware.
• GreyNoise said it has observed a spike in scanning and exploitation attempts targeting Digital Video Recorders (DVRs) in Ukraine between September 21 and October 1, 2026. The majority of the activity attempts to exploit CVE-2021-36260, which allows unauthenticated command injection against unpatched Hikvision products.
• A series of email campaigns have been targeting the accommodation industry with fake guest complaints or reviews that deliver blockchain technology-abusing malware. “These emails appear to likely be a continuation of a prior series of predominantly Booking.com-spoofing emails that were seen delivering various remote access trojans (RAT) via ClickFix fake CAPTCHA websites,” Cofense said. The activity leveraged the Ethereum and TON blockchains, a technique called EtherHiding, to deliver EtherRAT and TONResolver malware.
• As AI agents increasingly are being used to automate coding workflows, it increases the risk associated with credential exposure, Trellix warned. “Agents constantly take credentials out of the safe places your operating system keeps them, and put them somewhere far more exposed,” Trellix said. “This happens as a normal side effect of everyday work. And even good security telemetry has a hard time distinguishing this from a developer doing their job — or from an attacker who is already inside.”
• MITRE released version 20 of its ATT&CK framework, adding entries that cover AI abuse, MFA bypass, and recent attacks on water utilities. This includes nine new Techniques and Sub-Techniques under the Enterprise domain for prompt injection, AI-enabled exfiltration, AI result poisoning, attacks on AI-assisted defenses, CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) evasion, and application-specific password theft. For Mobile, MITRE also un-deprecated a technique for delivering malicious apps outside official app stores, last included in v11.
• Fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands are being used to plant infostealers on compromised systems using ClickFix lures. Some of the prominent targets include the U.S. and India. “The attacks share one trait: the employee performs the decisive step,” ANY.RUN said. “They paste an ‘install command,’ run a convincing installer, or sign in to a fake window. That can put source code, cloud and AI API keys, active business sessions, ad accounts, and billing access at risk, turning a single user action into potential data exposure, account compromise, financial loss, or disruption to development and marketing operations.”
• An official OpenAI skill, render-deploy, suffered from a first-of-its-kind supply-chain vulnerability which instructed production apps to send their tokens to an unregistered domain (“render-internal[.]com”). “It builds apps that trust a domain nobody owns, so any attacker could register it and start receiving tokens from real production apps,” AIR Security said. “Vulnerable servers in the wild sent tokens to the domain, users are advised to update to the patched version of the skill.”

• The U.S. Federal Bureau of Investigation (FBI) warned that scammers could exploit the 2026 U.S. midterm election to perpetrate financial fraud schemes. “As previously reported, scammers use the names, images, logos, and slogans of candidates to fraudulently solicit campaign contributions, sell merchandise that is never delivered, or steal personally identifiable information (PII) that can be used for other fraud,” the FBI said. “Scammers also exploit artificial intelligence (AI) tools to generate highly realistic voices, images, and written messages that impersonate candidates, campaigns, government entities, and trusted contacts.”
• A new study from Semperis revealed that ransomware actors are threatening their victims with physical violence as part of triple extortion schemes. In all, 40% of attacks in the past 12 months involved psychological or physical threats against staff. “Bad actors are threatening victims with psychological intimidation in nearly 25% of all attacks in the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia,” Semperis said. “In 53% of cases, the victims reported that the hackers followed through on their threats; 24% of victims or family members were swatted; 25% of victims sought psychological and medical treatment because of the ransomware attack; and 24% of victims or families hired personal security.”

Conclusion

If there’s one thing this week made clear, it’s that small gaps can lead to big problems. A weak password, an old bug, a trusted connection, or a device that wasn’t checked properly. None of these sounds unusual on its own. But attackers keep finding ways to turn them into something much worse.

The lesson isn’t to worry about every new threat. It’s to pay closer attention to the things we already know can go wrong. Check what’s exposed, question what you trust, fix what you can, and don’t assume something is safe just because it’s been working fine. Sometimes the simplest checks prevent the biggest headaches.