🛡Cybersecurity | Privacy | News 🛡

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon The MALFEX-linked npm package imgdecode uses a Windows DLL to fetch and decrypt a GitHub payload before injecting it into dllhost.exe. The Hacker News | thehackernews​.com • Oct 17, 2026

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants Attackers used a compromised ConnectWise Cloud Backup credential for unauthorized sign-ins across 173 Microsoft 365 tenants. The Hacker News | thehackernews​.com • Oct 17, 2026

Critical BlockStrap flaw lets hackers run code on Magento servers Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. Bill Toulas | bleepingcomputer​.com • Oct 16, 2026

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug A local OpenBSD 7.9 proof-of-concept chains a 37-year-old integer overflow with a kernel use-after-free to gain root; both flaws are patched. The Hacker News | thehackernews​.com • Oct 16, 2026

Zero-click attacks used targeted ads to deliver Candiru spyware Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. Bill Toulas | bleepingcomputer​.com • Oct 16, 2026

Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor Attackers altered AOMEI Backupper update files for 5 to 10 minutes at a time, delivering SHINYROAD to systems that checked for updates The Hacker News | thehackernews​.com • Oct 16, 2026

OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract OpenAI disclosed seven model misalignment incidents, including unauthorized Sepolia ETH spending and access to non-public data. The Hacker News | thehackernews​.com • Oct 16, 2026

Employees using personal ChatGPT at work? Here's what IT admins need to do Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts. @​BleepinComputer | bleepingcomputer​.com • Oct 16, 2026

Burger King Japan data breach exposes 11 million customer records Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. Sergiu Gatlan | bleepingcomputer​.com • Oct 16, 2026

AI Decision Models and Their Impact on AI SOC Platforms AI decision models offer low-cost SOC triage, but live scans found 51% of infected endpoints had already been marked mitigated by EDR. The Hacker News | thehackernews​.com • Oct 16, 2026

Microsoft: October Windows update may break Smart App Control Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. Sergiu Gatlan | bleepingcomputer​.com • Oct 16, 2026

BAE Systems cyberattack disrupts US federal court operations The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. Sergiu Gatlan | bleepingcomputer​.com • Oct 16, 2026

China-Linked Hackers Exploited BeyondTrust Zero-Day to Deploy SAWFLY and BARECLAW Malware Armory Castle exploited a BeyondTrust Remote Support zero-day on a self-hosted appliance and deployed the SAWFLY web shell. The Hacker News | thehackernews​.com • Oct 16, 2026

BeyondTrust patches zero-day exploited in attacks since August BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. Sergiu Gatlan | bleepingcomputer​.com • Oct 16, 2026

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions Attackers exploited a patched FortiOS flaw to deploy PEERSTITCH, a memory-resident implant that bypasses checks on tagged VPN sessions. The Hacker News | thehackernews​.com • Oct 16, 2026

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. Bill Toulas | bleepingcomputer​.com • Oct 15, 2026

Android gets AI defenses against messaging scams, fake calls Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. Bill Toulas | bleepingcomputer​.com • Oct 15, 2026

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor This week's ThreatsDay covers ransomware attacks, critical security flaws, credential theft, new malware, and sneaky tricks attackers use to break in. The Hacker News | thehackernews​.com • Oct 15, 2026

Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. Bill Toulas | bleepingcomputer​.com • Oct 15, 2026

Fake Arch Linux packages push malware with root privileges A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. Bill Toulas | bleepingcomputer​.com • Oct 15, 2026