IT Security News Roundup: 2026-10-18 Evening

IT Security News: Evening roundup, 2026-10-18

Summary

This evening’s news highlights how rapidly modern threats can escalate across supply chains, critical infrastructure, and digital platforms. From commercial AI agents breaching operational technology in minutes to OAuth compromises exposing hundreds of cloud tenants, automation and systemic trust vulnerabilities are accelerating attack speeds. Meanwhile, international law enforcement actions and legislative debates underscore that defending digital and physical security requires constant vigilance at every level.

1. Attackers hijacked official Twitter accounts belonging to Ireland’s police headquarters to promote a cryptocurrency scam. The incident underscores how vulnerable high-profile public sector social media channels remain to account takeover attacks.
2. Legal scholar Kate Robertson warned that Canada's Bill C-22, known as the Lawful Access Act, introduces significant national security risks. The critique emphasizes the unintended dangers of expanding government surveillance and intercept capabilities.
3. Europol-coordinated operations resulted in the arrest of five individuals across Spain, Morocco, and France accused of managing violence-as-a-service networks. The arrests dismantle key leadership coordinating physical attacks and recruitment from abroad.
4. OffSec published a detailed preparation guide for the Offensive Security Certified Professional exam, covering structure, scoring criteria, and practical study strategies. It offers actionable advice for aspiring penetration testers tackling the hands-on test.
5. Testing by Booz Allen demonstrated that commercial AI models can breach operational technology networks and manipulate physical equipment in just 16 minutes. The finding reveals that AI drastically reduces the technical expertise needed for industrial cyberattacks.
6. Threat actors leveraged a compromised ConnectWise OAuth application credential to intrude into more than 170 Microsoft 365 tenant environments. The supply chain breach demonstrates how trusted managed service provider tools can turn into massive backdoors.
7. Attackers are actively exploiting an OS command injection vulnerability in SiteGuard Server Edition to execute unauthorized commands as root or SYSTEM. Organizations running the web application firewall must secure affected instances immediately to prevent full server takeover.

Summaries written with AI (Google Gemini) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Irish police force has its Twitter hacked in cryptocurrency scam
2. The Lawful Access Act’s threats to  Canada’s national security
3. Ordering violence from abroad: five suspects arrested in Spain, Morocco, and France
4. OSCP Exam Guide: What to Expect and How to Prepare
5. AI Can Hijack Industrial Systems in 16 Minutes
6. Compromised ConnectWise OAuth App Exposes Over 170 Microsoft 365 Tenants in Supply Chain Attack
7. Hackers exploit SiteGuard WAF flaw to run commands as admins