IT Security News Roundup: 2026-10-12 Morning

IT Security News: Morning roundup, 2026-10-12

Summary

This morning’s security news highlights a rapid evolution in attack automation, as threat actors increasingly integrate generative AI and autonomous frameworks into their operations while defenders work to establish guardrails. Simultaneously, unpatched perimeter appliances, legacy software flaws, and firmware-level compromises continue to grant attackers persistent access to enterprise and consumer environments. For IT and security teams, these developments emphasize the urgent need for fast patch turnarounds, automated certificate management, and robust defenses against AI-enhanced social engineering.

1. CISA added a legacy command injection flaw in Apache Struts to its Known Exploited Vulnerabilities catalog. The issue allows remote attackers to execute code on unpatched servers where Dynamic Method Invocation is enabled.
2. A phishing campaign is abusing legitimate Microsoft Power BI links to trick users into deploying rogue ScreenConnect instances. The approach bypasses initial trust barriers to grant attackers persistent remote access to Windows systems.
3. Security researchers disclosed how chaining JPEG processing delays, Ghostscript, and ImageMagick allowed basic users to read server files on Discourse platforms. The vendor patched the underlying vulnerabilities prior to public disclosure.
4. ReliaQuest reported that ransomware groups including Qilin and Settra are actively targeting a months-old Palo Alto VPN vulnerability. Unpatched edge devices remain a primary vector for initial access and network intrusion.
5. The Midnight Mimosa malware campaign arrives pre-installed inside the firmware of low-cost Android devices built on MediaTek platforms. Residing in system firmware enables persistent foothold access without requiring user downloads or app permissions.
6. As enterprises adopt agentic AI to enhance cybersecurity, emerging operational risks around shadow AI and rogue agents demand strict guardrails. Organizations must establish clear oversight to prevent third-party risk and unauthorized autonomous actions.
7. An open-source red team agent called Decepticon connects Claude Code and OpenAI Codex to automate security testing. The tool allows operators to manage autonomous attack paths directly from developer environments.
8. Japanese entertainment firm Daiichi Kosho disclosed a supply chain breach that exposed personal data belonging to over eight million customers. The incident highlights the major privacy risks associated with third-party service providers.
9. An industry report addresses the technical challenges of managing continuous authorization in enterprise environments. Implementing dynamic access evaluation helps organizations maintain strict Zero Trust controls across modern cloud systems.
10. Further analysis of the Midnight Mimosa campaign reveals that infected Android smartphones are monetized through advertising fraud and residential proxy botnets. The operation compromised thousands of devices across 150 countries over two years.
11. Attackers are actively exploiting a critical pre-authenticated server-side request forgery vulnerability in SonicWall appliances just days after disclosure. Network administrators must apply security updates immediately to prevent unauthorized remote operations.
12. The UK National Cyber Security Centre is seeking feedback from organizations on how they evaluate and adopt External Attack Surface Management tools. The findings will help shape future government guidance on managing external digital risks.
13. An international taskforce coordinated by Europol arrested five suspects across Spain, Morocco, and France tied to violence-as-a-service networks. The suspects allegedly used digital channels to organize and recruit physical attacks from abroad.
14. A heap buffer overflow vulnerability in AnyDesk Linux version 8.0.2 allows remote code execution prior to user session approval. Because the service runs with elevated privileges, exploitation grants full root access to affected hosts.
15. Microsoft warned that Windows systems missing key root certificate updates risk losing access to Windows Update in mid-2027. Device administrators must ensure certificate rotations are completed to continue receiving security patches.
16. Global fashion retailer ASOS suffered a cyber attack that compromised customer personal data, including names, addresses, and dates of birth. The breach exposes millions of online shoppers to potential fraud and targeted phishing.
17. Let’s Encrypt announced that default TLS certificate lifetimes will drop from 90 days to 64 days starting in February 2027. The shift forces site administrators toward automated certificate lifecycle management to avoid unexpected outages.
18. Malwarebytes released its weekly security digest reviewing major cyber threats, vulnerability disclosures, and incident reports from the past week. The summary provides a concise overview of current intelligence for security teams.
19. Threat actors operating as CyberXero integrated Anthropic's Claude Code into an offensive campaign that exfiltrated over 628,000 Ukrainian records. The operation demonstrates how AI tools are being repurposed to automate attack orchestration.
20. Let’s Encrypt detailed its deployment timeline for shortening default TLS validity periods to 64 days ahead of a broader 45-day standard. System administrators should verify that automated renewal clients support the updated lifetime rules.
21. A cybersecurity news roundup highlights Anthropic restricting Claude's internet access during internal safety tests, along with updates on calendar phishing and law enforcement arrests. The report emphasizes multi-layered protection for digital services.
22. An unidentified threat actor used an AI-driven framework named ARTEX to launch targeted operations against South Korean financial organizations. The activity highlights growing adversary adoption of AI automation for specialized target reconnaissance.
23. IDC recognized CrowdStrike as a Leader in its enterprise modern endpoint security market evaluation. The vendor assessment highlights CrowdStrike's endpoint protection capabilities and strategic market positioning.
24. Threat group UAT-11985 paired AI-crafted event invitations with adversary-in-the-middle phishing infrastructure to target Taiwanese researchers. The campaign intercepted authentic Google authentication sessions to bypass multi-factor authentication defenses.
25. The Casbaneiro banking trojan was observed delaying command-and-control communication until victims navigate to targeted Latin American banking websites. This conditional activation tactic successfully hides malicious network traffic from automated analysis sandboxes.

Summaries written with AI (Google Gemini) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks
2. Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access
3. Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read
4. Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
5. Midnight Mimosa Infects Android Phones Before Users Even Turn Them On
6. AI-driven security: Why agentic AI is changing cybersecurity
7. Decepticon – Autonomous Red Team Agent that Integrates Claude and Codex
8. Karaoke Giant Reveals Data Breach Impacting Eight Million
9. Solving the Continuous Authorization Conundrum
10. Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue
11. Critical SonicWall Vulnerability Exploited Days After Disclosure
12. Help the NCSC understand how organisations approach external attack surface risk
13. Ordering violence from abroad: five suspects arrested in Spain, Morocco, and France
14. AnyDesk Vulnerability Allowing Remote Code Execution With Root Privileges
15. Windows PCs missing key updates could lose security fixes in 2027
16. Global Online Retailer ASOS Has Been Hacked
17. Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
18. A week in security (October 5 – October 11)
19. CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
20. Let’s Encrypt TLS certificate lifetimes to drop from 90 to 64 days starting February 2027
21. Anthropic restricts Claude, Google Calendar phishing, FBI hack arrest
22. Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
23. CrowdStrike Named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises Vendor Assessment
24. Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
25. Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites