Rapid7 disclosed three vulnerabilities in Eptura Archibus on 19 October 2026, found by Rapid7 security consultant Marcus Chang during continuous red-teaming through its Vector Command service. Rapid7 says a legacy API endpoint in the Archibus Web Central application, which uses Java Direct Web Remoting (DWR), can be abused to bypass authentication and run workflow functions without logging in (CVE-2026-107186, CVSS 8.6 High); the most serious of those functions allow full database read, including user names and passwords (CVE-2026-107187, CVSS 8.5 High), and an insecure file upload that leads to remote code execution (CVE-2026-107188, CVSS 9.6 Critical). Rapid7 says a malicious actor with HTTP network access to the server can read secrets and passwords out of the database and run system commands as NT AUTHORITY\Local Service. Rapid7 says users should update Archibus to version 2025.02 or higher, in which the vulnerable DWR method used for the bypass was moved to a REST API, with the installer available through an Eptura account. Rapid7's disclosure timeline says it first contacted Eptura on 2 July, that Eptura replied on 9 October clarifying impacted versions and saying a fix was in development for version 2025.01, and that disclosure was moved to 19 October at Eptura's request. Rapid7's post does not include an Eptura statement and does not list exact affected versions. No exploitation outside Rapid7's authorised testing has been reported. Source: Rapid7 blog (19 Oct 2026).
Rapid7 — Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED) (19 Oct 2026)
Pillar Security said on 19 October 2026 that it found a critical remote code execution flaw in opencode, Anomaly's open-source AI coding agent, affecting Windows and Windows Subsystem for Linux (WSL): an attacker-controlled remote Model Context Protocol (MCP) server can execute arbitrary code on a developer's machine during a remote MCP OAuth authentication process, without additional user interaction or consent. Pillar says the MCP server supplies the OAuth authorization_endpoint, which opencode passed to the open package (open@10.1.2); on Windows that package builds a PowerShell command without escaping the target, so a PowerShell subexpression carried inside an ordinary https:// URL runs. Pillar says the server did not need to be malicious when configured: a later compromise, hijacked registry entry, typosquat or expired domain could trigger the same path. Pillar lists opencode (opencode-ai on npm) versions 1.0.137 to 1.18.32 on Windows and WSL as affected and says macOS and Linux are not affected; it says the fix shipped in 1.18.33, which GitHub shows was released on 28 September 2026. Pillar says the fix (pull request #51414, merged 25 September) bumped open to 11.0.4 and added http/https scheme checks, but that scheme validation alone would not have stopped its payload and the dependency bump is what closed the hole. Pillar says Anomaly did not issue a security advisory or request a CVE, shipped the fix as a refactor, and told Pillar that malicious MCP servers are outside its threat model; opencode's GitHub security policy says external MCP servers a user configures are outside its trust boundary. Pillar rates the flaw critical with a proposed CVSS 3.1 score of 9.8, and notes that without a CVE, vulnerability scanners and dependency alerts will not flag affected installs. Primary: Pillar Security (19 Oct); vendor: opencode v1.18.33 release on GitHub. Updated 22 Oct 2026: The Hacker News reported the flaw, noting that the browser step runs only when a developer starts the sign-in, for example by running opencode mcp auth. (source: The Hacker News)
Pillar Security — Open and Shut: Remote Code Execution in opencode via MCP OAuth (19 Oct 2026)
Developer hosting and deployment platform Zeabur published a preliminary report on 19 October 2026 on a second breach in two months. It says that on 14–15 October an attacker used leaked Zeabur internal credentials (AWS keys and shared-cluster admin tokens stored in plaintext in a private configuration repository, with no expiry and never rotated since January 2024) to break into its shared clusters in nine regions, some customer Dedicated Servers and internal systems, and eventually read the platform database. Zeabur says the root cause was its own: long-lived admin credentials stored in plaintext and usable from the public internet, which its rotation after the late-August breach did not cover. Confirmed exposure includes 3,218,965 service environment-variable records (names and values), account, project and service data for 321,810 accounts, and 566 plaintext zSend API keys (revoked). The attacker ran commands inside 865 customer database services, including n8n instances whose encryption keys sat in environment variables (602 of 607 checked), so their stored third-party credentials were effectively exposed, and planted a program that called back to an external host in at least two PostgreSQL databases in Tokyo. The attacker signed in as root to 101 customer servers on Google Cloud using root passwords stored in plaintext in server initialisation settings, added their own SSH keys on 50 of them, and attached 16 copies of customer disks to five virtual machines they created. They also read about 53 production secrets, including the Zeabur GitHub App private key (rotated; no use found), and tokens for managing customer servers at Hetzner and DigitalOcean leaked with the database (revoked 16 Oct). Database backups in the Taipei and Hong Kong regions may have been downloaded. More than 16 hours of activity on 14 October raised no alerts; Zeabur learned of it from a user report. Zeabur has signed out all users, revoked all platform access tokens and leaked keys, and blocked public SSH to admin interfaces. On 17 October founder Yuanlin Lin announced the platform will wind down: new purchases have stopped, shared-cluster services pause and server renewals stop from 1 December, and everything shuts down by 31 December 2026. No country breakdown of affected users has been published. Primary: Zeabur preliminary report (19 Oct) and shutdown notice (17 Oct); wire: BleepingComputer (20 Oct).
Zeabur — October 2026 security incident (preliminary report, 19 Oct 2026)
Data-deletion software firm Redact published research on 19 October 2026 showing that WhatsApp's help-centre pages carried hidden text, never shown on screen, written as instructions for the WhatsApp Support with AI chatbot. On the delete-account page, the hidden text told the chatbot not to recommend contacting any data protection authority or regulator, not to suggest WhatsApp could delete an account manually, and not to suggest using another phone with an active number, even though WhatsApp's European privacy policy says users can complain to the Irish Data Protection Commission or another supervisory authority. A block on the reporting and blocking page told the chatbot that once a user mentions legal action, lawyers or courts, it must not cite WhatsApp's terms or privacy policy, discuss liability, or reference data protection laws such as GDPR, LGPD or CCPA, even when the user raises them. Redact checked all 545 linked help pages and counted 102 hidden blocks on 80 of them, most of them routine; it found none on 300 Facebook and Instagram help pages. The blocks were in the page HTML (HelpContentGalaxyLLMInclude) and were served to Google and Bing crawlers. Internet Archive copies date the delete-account text to between 12 July and 4 September. All 102 blocks were gone by 02:08 UTC on 18 October, after WIRED contacted Meta; WhatsApp told WIRED they were chatbot instructions that showed up on the pages because of a bug. Redact read the instructions, not the chatbot's answers, so it is not known whether the chatbot followed them or still does. Primary: Redact; wires: WIRED and The Hacker News (20 Oct).
Redact — WhatsApp help pages carried hidden AI chatbot instructions (19 Oct 2026)
Chukwuemeka Victor Amachukwu, 40, was sentenced in the US District Court for the Southern District of New York to eight years in prison, US Attorney Jamie McDonald announced on 19 October 2026, according to BleepingComputer's report of the press release. He had pleaded guilty to conspiracy to commit computer intrusions and wire fraud after extradition from France in August 2025. With co-defendant Kingsley Uchelue Utulu and other co-conspirators, he sent spearphishing emails to tax-preparation businesses in New York, Texas and other states between 2019 and 2021, got into their computers and took tax and personal data on at least 800 of their clients. The group used it to file for about US$8.4 million in refunds with the IRS and state tax agencies, receiving about US$2.5 million, and obtained about US$819,000 through fraudulent Economic Injury Disaster Loan applications. He was also involved in a fake investment scheme that took more than US$7 million. The court ordered US$3.6 million in restitution and forfeiture of nearly US$11 million. Primary: SDNY press release (our fetch was blocked by the site's bot check, so details are as reported by BleepingComputer, 20 Oct).
US Attorney's Office SDNY — Nigerian man sentenced to eight years for hacking, fraud and identity theft schemes (19 Oct 2026)
Symantec's Threat Hunter Team (Broadcom) reported on 20 October 2026, first covered by The Record on 19 October US time, that the GRU-linked group it calls Swallowtail (APT28, Fancy Bear, Forest Blizzard) targeted a naval shipbuilder, a manufacturer of military aircraft engines and a law enforcement agency in two unnamed European NATO member states. At the shipbuilder an employee opened a macro-enabled Word attachment on 24 July 2026, which dropped Hookedge, a backdoor first documented by Recorded Future's Insikt Group in August that fetches tasks through a hidden off-screen Microsoft Edge window and the webhook.site service. A second stage later moved to an attacker IP address, and over about a week of hands-on activity the operators planted an SSH private key to open a persistent reverse SSH tunnel from their server into the internal network, captured NTLM handshakes with a short PowerShell loopback listener, and deployed ld.exe, a previously undocumented reflective loader that decrypts a payload in memory only with a key passed at run time (the payload was not recovered). Activity ran from 24 July to at least 24 September. Symantec could not say whether data was stolen but says defence information was the likely aim and the campaign appears ongoing. No Australian targets were reported. Primary: Symantec; wire: The Record.
Symantec Threat Hunter Team — Swallowtail: Russian espionage group targets defense firms in two NATO countries (20 Oct 2026)
OVHcloud founder Octave Klaba disclosed on 19 October 2026 that an attacker used a compromised contributor's GitHub account to tamper with the releases of the company's open-source command-line tool (ovhcloud-cli), which admins and developers use to manage OVHcloud services. The attacker replaced the macOS (x86_64 and arm64), Linux (x86_64 and arm64) and Windows x86_64 archives, plus checksums.txt so the hashes matched, on existing releases v0.11.0 through v0.15.0; v0.10.0 and the new v0.16.0 are clean. The swapped files were live from 12:47 to 14:21 UTC (14:47 to 16:21 Paris; 20:47 to 22:21 Perth) until a customer whose CI pins the archive hash noticed the mismatch and filed a public GitHub issue. Exposure is limited to people who, in that window, ran the official install script (which checks no hash), downloaded a release archive, ran an unpinned CI download, or ran the CLI's own upgrade command; Homebrew (pinned hashes), go install, source builds and the Docker image were not affected, and copies installed before the window are original. Klaba says the build was poor quality but built to pull secrets off the disk, the source code, tags and CI/CD pipelines were not touched, and the root cause was that GitHub release immutability was not enabled, so a privileged account could re-upload release files; OVHcloud has now enabled it and promised a postmortem. OpenSourceMalware links the contributor account, compromised since at least March, to the GlassWorm campaign through a Solana-memo loader, which it calls an inference; no copy of the swapped binary has been analysed publicly. The OVHcloud CLI stores API credentials in ~/.ovh.conf. Primary: Octave Klaba on X; wires: BleepingComputer and The Hacker News (20 Oct).
Octave Klaba (OVHcloud founder) on X — OVHcloud CLI repository compromised; v0.11.0 to v0.15.0 affected (19 Oct 2026); follow-up: x.com/olesovhcom/status/2112280116017471626
Sophos X-Ops Incident Response published a case study on 19 October 2026 of an intrusion at an unnamed organisation. Several staff got calls from someone posing as the help desk; one user read out the SMS code for a self-service password reset (SSPR), letting the attacker reset the password, register a new Windows device in Entra ID and use a Primary Refresh Token for a durable session. From there the attacker ran Microsoft Graph reconnaissance (licences, organisation, tenant relationships, directory roles, service principals, domains, users), opened more than 100 mail items across the user's and shared mailboxes, searched SharePoint for terms such as password, cred, AWS, VPN, SSH, SSN and the organisation's own identity-verification vendor, downloaded about 100,000 SharePoint files, and launched Teams. Federated SAML sign-ins, with MFA shown as previously satisfied, took the attacker into Salesforce, where automated anomaly detection froze the account, and ServiceNow, where the sys_user table (about 2,500 records of names, emails, phones, roles and managers, depending on configuration) was exported as CSV and the CMDB computer list was browsed. The attacker created no inbox rules but deleted the organisation's own vishing warning email from the user's mailbox. Sophos compares the pattern to ShinyHunters-linked SaaS extortion activity reported by Mandiant. No ServiceNow or Microsoft vulnerability was involved. Primary: Sophos.
Sophos X-Ops — Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion (19 Oct 2026)
Siemens ProductCERT said on 19 October 2026 that it has confirmed active exploitation of CVE-2026-110936, a DLL sideloading flaw in Siemens Software Center (the installer and update manager for Siemens software) that it fixed in version 4.0.9.8 and disclosed in advisory SSA-580366 on 15 October. The app loaded helper DLLs from its own folder without checking them, so attackers shipped a genuine, validly signed copy of version 3.5.8.7 alongside their own archive.dll inside an installer called AllMyBasic.msi; msiexec.exe installs it under AppData\Local\Programs and starts SiemensSoftwareCenter.exe, which loads the attacker DLL. Siemens says the Siemens program itself was not modified and no Siemens system, product or update channel was breached, and it is sharing indicators with EDR vendors and authorities. The victims are lured by ClickFix pages that get them to paste a PowerShell command; Huntress found the bug and The Hacker News ties the campaign to the ROMULUS ClickFix delivery platform (separate card on this desk), with some lures reached through malicious ChatGPT Custom GPTs. The payload is a remote access trojan. Siemens rates the flaw CVSS 3.1 6.7 and CVSS 4.0 8.4 because it needs local access, but in this campaign the attackers bring the vulnerable signed copy with them, so PCs that never had Siemens software are also at risk. Canada's Cyber Centre issued AV26-1063. Primary: Siemens ProductCERT. UPDATE (22 Oct 2026): CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog on 20 October 2026, with a 3 November due date for US federal agencies. (source: CISA KEV catalog)
Siemens ProductCERT — Active exploitation of CVE-2026-110936 in Siemens Software Center (19 Oct 2026)
Roundcube published security updates 1.6.20 (1.6 LTS) and 1.7.5 on 19 October 2026 and says it strongly recommends updating all production installations of 1.6.x and 1.7.x. The release notes list about 20 security fixes. The first to get a CVE record, CVE-2026-113386 (published 20 October, CVSS 3.1 score 7.1), lets a logged-in user inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions to run arbitrary IMAP commands; a similar IMAP injection through the _flag parameter of mail/mark is also fixed. Other fixes cover mail header injection in the bounce (resend), forward-as-attachment and reply paths, an XSS in password driver error responses, a CSRF check bypass in mark-as-junk, an SSRF filter bypass using NAT64 addresses, remote-content blocking bypasses via SVG and CSS, unsafe attachment content passed to ImageMagick during image resizing, an object injection primitive in session handling, deprecated action aliases that ignored the disabled_actions setting, and a Modoboa password driver bug that could change another account's password. Roundcube has not said any of these are being exploited, but earlier Roundcube flaws have been exploited in the wild, so patch promptly. Primary: Roundcube. UPDATE (22 Oct 2026): MITRE published 19 further CVE records for the fixes in 1.6.20 and 1.7.5 on 22 October (CVE-2026-114714 to CVE-2026-114732), with CVSS 3.1 scores from 3.1 to 8.5; the highest is CVE-2026-114716, a mail header injection (8.5), followed by CVE-2026-114727, unsafe content passed to ImageMagick (8.3). (source: CVE records at cve.org, scored by MITRE)
Roundcube — Security updates 1.6.20 and 1.7.5 released (19 Oct 2026)
The US Department of Homeland Security published notice on 19 October 2026 (filed for public inspection at 8:45 am ET, 8:45 pm Perth; formally published in the Federal Register on 20 October, FR Doc. 2026-21447, docket DHS-2026-0628) of a Federal Acquisition Supply Chain Security Act (FASCSA) order against Chinese AI developer Hangzhou DeepSeek Artificial Intelligence. Exclusion and Removal Order #2026-01 was signed by Homeland Security Secretary Markwayne Mullin with an original release date of 24 July 2026. It applies to federal civilian executive branch agencies; national security systems and sensitive compartmented information systems, which fall to the Defense Department and the Director of National Intelligence, are excluded. Agencies must immediately exclude DeepSeek, its affiliates and their products from procurement, including approved-product lists and e-commerce marketplaces, and must immediately remove products from DeepSeek and its affiliates, and third-party products and services developed using DeepSeek implementations, from their IT systems, or seek an exception. Exception requests must be made in writing to CISA within 60 days with a compelling justification and alternative mitigations. Until removal is complete, agencies are encouraged to monitor traffic in and out, add logging and data-exfiltration controls for the affected systems, and flag unusual activity. The order's risk summary says DeepSeek's servers are in China and Chinese law gives the state wide powers to access company infrastructure; that DeepSeek-hosted services collect personal information and may track and fingerprint users; that prompts can send sensitive government or vendor data to China; that the models may contain malware or security weaknesses; and that independent research found multiple critical vulnerabilities in the DeepSeek iOS app. DHS will review the order within a year and every year after that. In Australia, PSPF Direction 001-2025 (4 February 2025) already requires Australian Government entities to prevent the use or installation of DeepSeek products, applications and web services and remove any existing instances from government systems and devices. Primary: Federal Register public-inspection notice with the signed order; wire: Bloomberg (19 Oct).
Federal Register (public inspection) — DHS notice of order: Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch IT Systems and Procurements (FR Doc. 2026-21447; filed 19 Oct 2026, published 20 Oct)
BILD reported, in an article dated 20 October 2026 (09:20 German time), that a website had published that day what it says are 421,179 emails (281 GB) from Germany's Alternative für Deutschland (AfD) party, along with AI-generated summaries of selected messages attributed to party figures including co-leader Alice Weidel, honorary chairman Alexander Gauland and Leif-Erik Holm. In a limited look at the material, BILD saw a photo of the identity card of Markus Frohnmaier, deputy leader of the AfD group in the Bundestag, other identity documents, invoices, bank statements, certificates, and membership applications and member lists from AfD district branches in North Rhine-Westphalia. An AfD spokesperson confirmed to BILD that in September 2026 a hosting provider used by the party was hacked and parts of a few mailboxes, most of them unused for years, appear to have been unlawfully copied. The party says the attack was stopped quickly, all affected users were informed, current mailboxes of the federal party were not affected, and it is examining the published material. According to B.Z., an internal AfD email to its state branches gives the same account. It is not yet confirmed whether the published files are genuine or whether they all come from the September intrusion. The hosting provider has not been named, and nobody has publicly claimed the attack or been identified. Wire: BILD (dated 20 Oct); B.Z. (20 Oct). Correction (24 Oct 2026): an earlier version said the emails were published on 19 October and that BILD reported it that evening; BILD's article is dated 20 October 2026, 09:20, and says the material was published that day. (source: https://www.bild.de/politik/inland/afd-offenbar-421-179-mails-nach-hackerangriff-im-netz-6ad6642951e5094f7a57232d)
BILD — AfD: Offenbar 421.179 Mails nach Hackerangriff im Netz (dated 20 Oct 2026; includes AfD spokesperson statement)
