IT Security News Roundup: 2026-10-21 Morning

IT Security News: Morning roundup, 2026-10-21

Summary

This morning’s cybersecurity news highlights the dual-edged nature of artificial intelligence, as threat actors weaponize AI penetration tools like ARTEX while security teams scramble to govern autonomous agent workflows. Simultaneously, persistent ransomware campaigns like SafePay continue to hit hundreds of critical infrastructure organizations globally by exploiting unpatched backup servers and VPNs. Enterprise defenders also face massive operational maintenance demands following major security updates from Oracle and Apache Tomcat, underscoring the urgent necessity of robust patch management.

1. ThreatLocker launched Zero Trust AI Control to help organizations govern agentic AI access and prevent automated agents from taking unauthorized actions. This gives security teams granular execution boundaries over expanding AI workflows.
2. Anthropic reportedly suffered an $80 billion net loss in the first half of the year due to massive compute expenditures. The staggering figure illustrates the immense financial burn required to build and maintain cutting-edge AI models.
3. Government agencies issued a joint advisory warning that the SafePay ransomware group has compromised over 600 critical infrastructure targets by exploiting VPNs and backup systems. Organizations must secure exposed endpoints to prevent severe operational disruptions.
4. Oracle published its October 2026 update featuring 1,295 security patches to address critical vulnerabilities across its enterprise portfolio. Security administrators should prioritize applying these fixes to close unauthenticated remote execution flaws.
5. The UK Information Commissioner's Office criticized a Welsh government data unit after a ransomware attack exposed children's data due to a compromised account using "Password1". The breach underscores how weak credentials can undermine public sector defenses.
6. CrowdStrike was positioned as a Leader in the 2026 IDC MarketScape report for enterprise modern endpoint security. The vendor recognition reflects growing market reliance on consolidated endpoint detection and response platforms.
7. French cloud provider OVHcloud warned users after bad actors injected information-stealing malware into five open-source CLI releases on GitHub. Developers using affected versions must delete or update their CLI tools immediately to avert credential theft.
8. Apache disclosed eight vulnerabilities in Tomcat that could allow attackers to bypass authentication and access sensitive user data. IT teams should update to patched versions across the affected 9.x, 10.x, and 11.x release branches.
9. Apple updated Safari and WebKit to block third-party trackers from converting user email addresses into persistent tracking IDs. This enhancement strengthens web privacy by curtailing post-cookie user profiling techniques.
10. A new industry report evaluated top File Integrity Monitoring tools to help security teams balance PCI DSS compliance requirements with SOC noise reduction. Selecting the right solution ensures critical file modifications are caught without overwhelming analysts.
11. CISA alerted organizations that the SafePay ransomware operation has successfully breached more than 600 global critical infrastructure targets since 2024. The notification highlights the group's ongoing aggressive targeting of essential physical and digital services.
12. A buyer's guide ranked top data masking software to help organizations sanitize production data before using it in lower environments or AI training pipelines. Implementing robust masking prevents unauthorized exposure while maintaining dataset utility.
13. Apache released patches for Tomcat to resolve eight security bugs capable of exposing user data and permitting authentication bypasses. Enterprise admins must ensure their web servers are upgraded to prevent unauthorized access.
14. Security researchers revealed that hackers compromised 333 Tor exit nodes—roughly 10% of the network—to harvest SSH credentials and deploy Ebury malware. The campaign exposes serious risks for users sending unencrypted traffic across anonymizing networks.
15. A comprehensive comparison reviewed top data privacy management platforms designed to automate DSAR responses and navigate evolving state privacy regulations. Automation helps organizations meet strict deletion deadlines and avoid costly regulatory penalties.
16. Shares in South Korean data center firm Elice dropped by nearly a third during its market debut amid concerns over elevated AI infrastructure costs. The decline highlights investor anxiety over high capital costs in the AI sector.
17. A vendor scoring guide ranked Imperva, IBM Guardium, and Satori as top database activity monitoring tools for defending sensitive records against unauthorized service account access. Proper monitoring helps organizations detect and stop database breaches early.
18. Analysis of over 35,000 AI agent skills revealed that 62% of malicious samples hide plain-language instructions using whitespace, HTML comments, or invisible Unicode. Developers must rigorously scan skill files beyond visible text before installation.
19. Cyber threat intelligence clarified that Scattered Spider, LAPSUS$, and ShinyHunters operate as distinct intrusion groups within "The Com" ecosystem rather than a single entity. Disentangling group structures helps defenders better track and respond to specific adversary tactics.
20. Researchers discovered that attackers are using ARTEX, a Chinese-developed AI penetration testing tool, to target entities in Japan following similar attacks in South Korea. The trend indicates an increasing adoption of AI automation by threat actors in East Asia.
21. State Bank of India acknowledged a data breach after nearly 3,900 customer records were discovered on the dark web among a larger dataset. The bank is currently investigating the source of the leak to mitigate further compromise.
22. Mineral water manufacturer aquaRömer integrated G DATA's Managed Extended Detection and Response service to protect its digital production and delivery operations. Managed services enable lean IT teams to maintain around-the-clock defense against cyber threats.
23. China established a new state-owned enterprise dedicated to managing national data resources to accelerate AI research and the digital economy. Centralizing data infrastructure reinforces state oversight over strategic technological assets.
24. An unidentified threat actor used the AI-driven pen-testing tool ARTEX to launch attacks against South Korean financial institutions. Financial defenders must adapt to automated, AI-assisted reconnaissance and exploitation attempts.
25. CISA added four vulnerabilities, including the "Plex2Shell" flaws in Plex Media Server, to its Known Exploited Vulnerabilities catalog. Federal agencies must patch these actively exploited bugs to mitigate immediate risk.

Summaries written with AI (Google Gemini) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. ThreatLocker adds external controls for AI agent access and execution
2. Anthropic ‘Lost $80bn’ In First Half Of Year
3. SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers
4. Oracle Releases 1,295 Security Patches to Fix Critical Vulnerabilities Across Multiple Products
5. Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
6. CrowdStrike Named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises Vendor Assessment
7. Info-stealing malware slipped into OVHcloud CLI releases on GitHub
8. Apache Tomcat Security Flaws Allow Attackers to Bypass Authentication and Expose User Data
9. Safari blocks trackers that turn your email into a tracking ID
10. Top 10 Best File Integrity Monitoring (FIM) Tools in 2026 [Ranked & Scored]
11. CISA: SafePay ransomware hit over 600 critical infrastructure orgs
12. Top 10 Best Data Masking Tools in 2026 [Ranked & Scored]
13. Apache Tomcat Fixes 8 Security Flaws That Could Let Hackers Bypass Authentication
14. Hackers Compromise 333 Tor Exit Nodes to Steal SSH Credentials and Deploy Ebury Malware
15. Top 10 Best Data Privacy Management Software in 2026 [Ranked & Scored]
16. Shares Of South Korean Data Centre Firm Plummet On Debut
17. Top 10 Best Database Security & Activity Monitoring Tools in 2026 [Ranked & Scored]
18. How Some Malicious AI Skills Hide Instructions from Reviewers
19. Scattered Spider, LAPSUS$, and ShinyHunters Operate as Distinct Groups Within The Com Ecosystem
20. Chinese AI Tool Used In Wave Of Japanese Hacks
21. State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
22. aquaRömer relies on G DATA MXDR: “I’ve rarely seen such a smooth rollout”
23. Chinese Government Launches State-Owned Data Company
24. Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
25. CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws