IT Security News: Afternoon roundup, 2026-10-19 Summary Supply chain vulnerabilities and the rapid exploitation of critical enterprise software dominated recent updates, highlighting how deeply interconnected cloud platforms remain vulnerable to persistent threat actors. At the same time, the rapid integration…
OpenCode Breach Exposes User API Keys in What Company Calls a Distillation Attack
An intruder broke into a legacy system at OpenCode late on October 16, gaining access to third-party AI provider API keys that users had stored inside…
Critical Langflow Flaw Under Attack: What Needs Patching?
Attackers are targeting a critical Langflow RCE flaw despite available fixes. Security teams should verify patches, restrict MCP access, and check for…
ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users
Managed service providers said an attacker used compromised credentials to gain access to tenants.
US Ransomware Negotiator Suspected of Helping ShinyHunters Extort Victims
Federal investigators suspect a US ransomware negotiator helped ShinyHunters operate an extortion site used to pressure nearly 100 organisations.
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1…
GenAI Security Gateway: An End-to-End Architecture
LLMs are powerful application components, but they should not be exposed directly to untrusted users or unvetted documents. A request can contain an…
Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls. The new…
IT Security News Hourly Summary 2026-10-19 19h : 12 posts
12 posts published in the last hour 16:31WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot 16:31NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 16:07IT Security News Roundup: 2026-10-19 Afternoon 16:03DHS to ban DeepSeek from federal civilian agencies 16:03Inside the Underground…
WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot
Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the…
NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1…
DHS to ban DeepSeek from federal civilian agencies
The order cites national security concerns, including sending data to servers in China, the potential malware and the overall risk to federal IT systems.
Inside the Underground Market for Know Your Client Services
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks.…
European and Ecuadorian cooperation leads to 20 arrests in major hit against drug trafficking
The operation, codenamed Operation CANTABRIA, underscores the success of strong cooperation between European and Ecuadorian law enforcement agencies,…
F5 releases out-of-band patches for critical NGINX vulnerabilities
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let…
AI Use in Connecticut Utilities Faces Security Review
Artificial intelligence is rapidly entering the computer networks that help run and protect the United States’ electric grid, and federal regulators are…
Microsoft fixes classic Outlook bug that hid Copilot buttons
Microsoft has fixed a known issue that removed the Copilot Chat and Copilot buttons in the classic Outlook desktop mail client for some Windows users.…
Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules.
Microsoft fixes game, app crashes caused by recent Windows update
Microsoft has resolved a bug that caused games and apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 Windows 11…
IT Security News Hourly Summary 2026-10-19 18h : 11 posts
11 posts published in the last hour 15:33Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds 15:33Boards confident on cybersecurity, AI oversight, but tech changes outpace readiness 15:33Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack 15:33OnlyFans Copyright…
Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds
Known exploited vulnerabilities take a median time of 87 days to be patched, according to a new Moody’s report
Boards confident on cybersecurity, AI oversight, but tech changes outpace readiness
Nearly half of corporate directors think board members need cybersecurity expertise, a new survey found.
Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.
OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government…
ConnectWise Cloud Backup Breach: What Microsoft 365 Admins Should Check Now
ConnectWise contained compromised Cloud Backup app identities, but Microsoft 365 admins still need to check tenants for unauthorized changes and…