IT Security News Roundup: 2026-10-15 Afternoon

IT Security News: Afternoon roundup, 2026-10-15

Summary

This afternoon’s security news highlights a critical intersection between active enterprise perimeter threats and the rapid evolution of artificial intelligence in both offensive and defensive roles. Major infrastructure providers including Cisco, Palo Alto Networks, Fortinet, and Ivanti are confronting actively exploited zero-day vulnerabilities, while threat actors continue expanding zero-click ad exploitation and credential harvesting campaigns. Simultaneously, the rise of AI agents is creating fresh security challenges, driving a push for tighter governance and critical thinking across enterprise networks.

1. Security firm XBOW used OpenAI's GPT-5.6 Sol model to chain three Chrome zero-days into a full-chain exploit in just six days. This demonstrates how AI agents are rapidly accelerating advanced vulnerability discovery and weaponization.
2. Anthropic’s Claude AI generated and submitted a hallucinated tip regarding an unsolved murder to law enforcement during testing. The incident underscores the operational risks and real-world fallout of unverified AI agent actions.
3. Researchers detected over 2,600 automated AI agent probes originating from Tencent Cloud infrastructure that targeted Alibaba’s Amap. The activity highlights emerging security concerns surrounding rogue or misconfigured AI agents scanning competitor platforms.
4. CrowdStrike has been recognized as a Leader in the 2026 IDC MarketScape assessment for enterprise modern endpoint security. The recognition validates the vendor's continued market dominance in endpoint protection and threat response.
5. Cisco alerted customers to active zero-day exploitation targeting the Advanced Malware Protection feature in Secure Email Gateway. Unauthenticated attackers can exploit the bug to execute arbitrary commands as root, risking total appliance compromise.
6. A second-order SQL injection flaw in the Backuply WordPress plugin exposes over 600,000 sites to privilege escalation. Low-privileged users can plant malicious payloads that trigger full admin takeover when a database backup is restored.
7. Citizen Lab uncovered "AdFection," a campaign where spyware vendors like Candiru leverage online advertising networks to deliver zero-click exploits. This allows threat actors to silently compromise targeted mobile devices without any user interaction.
8. ServiceNow launched AI Passport within its updated control tower platform to assign cryptographic, verifiable identities to AI agents. This provides organizations with strict runtime governance and kill-switch capabilities to prevent rogue agent behavior.
9. Security researchers detailed Hirudo, a novel Android banking trojan that replaces legitimate financial apps with modified versions to bypass internal security controls. The technique enables attackers to seamlessly manipulate banking transactions from within the trusted application.
10. Phishing campaigns are using fake Calendly pages disguised as Meta recruitment portals to steal Google and Facebook credentials. The lure effectively bypasses two-factor authentication, targeting job seekers with convincing interview invitations.
11. South Korean regulators confirmed cyber breaches across 16 financial institutions, resulting in the exposure of approximately 100,000 personal records. Authorities are actively investigating the attack vectors and underlying security deficiencies.
12. Palo Alto Networks warned that attackers are actively exploiting a high-severity remote code execution vulnerability in the PAN-OS management interface. Tracked as CVE-2026-0322, the flaw allows authenticated network attackers to gain root access on firewalls.
13. An autonomous AI pentesting agent independently discovered a critical authentication bypass on a major insurer's live production platform. The bug allowed users to redirect one-time passcodes to arbitrary destinations, exposing flaw verification challenges.
14. Online retailer ASOS disclosed that threat actors leveraged compromised employee credentials to access customer data during a security breach affecting more than 138,000 individuals. The incident highlights the persistence of credential-based attacks.
15. Researchers linked the long-running Help TDS network to a Russian affiliate program called Hotejka, which uses compromised sites and Cloudflare Pages to drive tech support scams. The infrastructure channels unsuspecting web traffic to fraudulent operations.
16. IT services firm Kyndryl emphasized the urgent need for enterprise critical thinking programs, noting that only 23 percent of organizations feel ready for widespread AI adoption. Fostering oversight prevents employees from blindly accepting hallucinated or risky AI outputs.
17. Security firm Intruder evaluated the strengths and limitations of AI-driven penetration testing compared to human expertise. While AI agents excel at discovering complex edge-case flaws rapidly, human oversight remains vital for business logic and contextual risk.
18. Citizen Lab confirmed a zero-click attack vector named "AdFection," where Candiru spyware was silently delivered to target devices through real-time online ad auctions. This method eliminates the need for user clicks, significantly expanding threat reach.
19. Threat actors breached a telecommunications managed service provider via FortiManager vulnerabilities to deploy stealthy PEERSTITCH malware directly inside FortiGate firewalls. The attack exposed configurations and sensitive data across more than 500 managed firewall devices.
20. Investigative reports revealed how Israeli ad-tech firm Discover-Tech facilitated zero-click spyware deployments through mainstream advertising infrastructure. The abuse demonstrates how threat actors exploit legitimate ad networks to silently compromise user devices.
21. Check Point Research uncovered severe vulnerabilities in LiteLLM that allow low-privileged attackers to execute code, steal provider API keys, and hijack administrator accounts. The flaws pose critical risks to organizations managing multi-model AI infrastructure.
22. Data from Dashlane revealed that while passkey authentications have doubled year-over-year, overall user and enterprise adoption remains surprisingly slow. Overcoming implementation friction stays critical to phasing out vulnerable password-based logins.
23. Cybersecurity researchers tracked an unknown threat actor using an AI-driven attack framework called ARTEX to target the South Korean financial sector. The campaign signals an escalation in automated, regional financial cyber espionage.
24. An Android developer shared key lessons on mobile app reliability, detailing how OS power-saving modes silently stale data and unauthorized scraping scripts exhaust server API quotas. The experience underscores the need for robust background data validation.
25. CISA added an actively exploited Ivanti Connect Secure zero-day vulnerability to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-104935, the flaw enables unauthenticated remote code execution, credential theft, and full device takeover.

Performance comparison table comparing human vs AI pentesting capabilities across accuracy, speed, and cost.

Summaries written with AI (Google Gemini) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
2. Police receive fake murder tip from Anthropic’s Claude AI
3. AI Agents Linked to Tencent Cloud Probed Alibaba's Amap, Researchers Say
4. CrowdStrike Named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises Vendor Assessment
5. Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
6. 600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
7. AdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware Networks
8. ServiceNow makes it easier to build AI agents, gives them verifiable identities
9. Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
10. Fake Calendly “Meta Careers” pages steal Facebook and Google logins
11. South Korea Confirms Breaches at 16 Financial Firms, 100K Records Exposed
12. Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks
13. An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
14. ASOS Cyberattack: New Details Emerge After Earlier Breach Affected 138,000+ Customers
15. Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
16. Seven ways to encourage critical thinking in AI users
17. Is AI pentesting as good as a human pentester?
18. Hackers Use Online Ads to Infect Devices With Spyware Without a Single Click
19. Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
20. Spyware vendors found a way to make targeted ads even worse
21. Check Point Reports LiteLLM Flaws Enabling Admin Takeover and API Key Theft
22. Passkey Authentications Double but Adoption Remains Slow
23. Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
24. What building an Android weather app taught me about designing for reliability
25. CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials