./Threat researchMon, 19 Oct 2026 12:28:44 GMT https://www.wiz.io/blog/anatomy-of-ai-driven-cloud-attacks1l0bt3wMon, 19 Oct 2026 11:26:53 GMTWiz Research. Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them.ResearchAI https://www.malwarebytes.com/blog/data-breaches/2026/10/millions-of-california-students-sensitive-data-stolen-in-breachzuzmh1Mon, 19 Oct 2026 11:10:14 GMTMalwarebytes Labs. The California Department of Education notified students about a data breach at contractor Educational Testing Service.ResearchBreach https://www.aikido.dev/blog/drata-and-aikido-audit-ready-pentesting-built-into-your-compliance-workflow1q3e3nbMon, 19 Oct 2026 11:00:00 GMTAikido Security. Drata and Aikido bring AI pentesting into your compliance workflow. Get verified findings, auditor-ready reports, and up to $4,000 in free pentest credits. Category: ComplianceResearch https://www.aikido.dev/blog/more-pentesting-same-budget-aiwq3dwcMon, 19 Oct 2026 09:00:00 GMTAikido Security. AI pentesting lets security teams test more often without raising the budget. Learn how upfront pricing and forecasts keep costs predictable. Category: NewsResearch https://www.malwarebytes.com/blog/news/2026/10/a-week-in-security-october-12-october-181msbiu2Mon, 19 Oct 2026 07:01:00 GMTMalwarebytes Labs. A list of topics we covered in the week of October 12 to October 18 of 2026Research https://horizon3.ai/news/press-release/horizon3-singapore-expansion-asean-headquarters/107fihqMon, 19 Oct 2026 01:10:00 GMTHorizon3.ai. Horizon3 announces its expansion in Singapore, supported by strategic investments from EDBI and SG Growth Capital. The company will establish its ASEAN headquarters and a Regional Centre of Excellence, expand local operations, and help organisations across…ResearchAI https://www.infostealers.com/report/infostealers-weekly-report-2026-10-12-2026-10-19/1laay6kMon, 19 Oct 2026 00:00:00 GMTInfoStealers. InfoStealers Weekly Report – In this comprehensive report, we provide you with valuable insights into the most pressing threats facing organizations today. As cyberattacks continue to grow in…ResearchMalware https://objective-see.org/blog/blog_0x57.htmlmaxdzcSun, 18 Oct 2026 21:00:39 GMTObjective-See. A sophisticated Lazarus Group implant has arrived on macOS. In this post, we deconstruct the Mac variant of a OSX.Dacls, detailing its install logic, persistence, and capabilities.ResearchMalwareAPT https://objective-see.org/blog/blog_0x56.htmlmi1eidSun, 18 Oct 2026 21:00:39 GMTObjective-See. Today we uncover two (local) security flaws in Zoom's latest macOS client. First, a privilege escalation vulnerability, and second, a method to surreptitiously access a user's webcam and microphone (via Zoom).ResearchVulnerability https://objective-see.org/blog/blog_0x55.html1knfaiqSun, 18 Oct 2026 21:00:39 GMTObjective-See. CVE-2017-7170 was a local priv-esc vulnerability that affected OSX/macOS for over a decade! Here (for the first time!), we dive into the technical details of finding the bug, the core flaw, and exploitation.ResearchVulnerability https://objective-see.org/blog/blog_0x54.html16vr7j3Sun, 18 Oct 2026 21:00:39 GMTObjective-See. The Lazarus group's latest implant/loader supports in-memory loading of 2nd-stage payloads. In this post we describe exactly how to repurposing this 1st-stage loader to execute *our* custom 'fileless' payloads!ResearchMalwareAPT https://objective-see.org/blog/blog_0x53.htmlv9s598Sun, 18 Oct 2026 21:00:39 GMTObjective-See. Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!ResearchMalware https://objective-see.org/blog/blog_0x52.html7d9yndSun, 18 Oct 2026 21:00:39 GMTObjective-See. A massively popular iOS application turns out to be a government spy tool! Here, we analyze the app; decrypting its binary and studying its network traffic.Research https://objective-see.org/blog/blog_0x51.html1f1lzkmSun, 18 Oct 2026 21:00:39 GMTObjective-See. The rather infamous APT group, "Lazarus", continues to evolve their macOS capabilities. Today, we tear apart their latest 1st-stage implant that supports remote download & in-memory execution of secondary payloads!ResearchAPT https://objective-see.org/blog/blog_0x50.html2pzuf7Sun, 18 Oct 2026 21:00:39 GMTObjective-See. A 0day logic flaw in Microsoft Excel leads to 'remote' code execution on macOS, via malicious macros.ResearchVulnerabilityZero-day https://objective-see.org/blog/blog_0x49.html1ayob0xSun, 18 Oct 2026 21:00:39 GMTObjective-See. A new macOS backdoor written by the infamous Lazarus APT group needs analyzing. Here, we examine it's infection vector, method of persistence, capabilities, and more!ResearchAPT https://objective-see.org/blog/blog_0x48.html1jpqds4Sun, 18 Oct 2026 21:00:39 GMTObjective-See. Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) File Monitor for macOS 10.15!Research https://objective-see.org/blog/blog_0x47.htmlvrs6wfSun, 18 Oct 2026 21:00:39 GMTObjective-See. Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) Process Monitor for macOS 10.15!Research https://objective-see.org/blog/blog_0x46.html15srb9uSun, 18 Oct 2026 21:00:39 GMTObjective-See. In this guest blog post, "Objective by the Sea" speaker, Csaba Fitzl writes about an interesting way to get root via Apps from the official Mac App Store!Research https://objective-see.org/blog/blog_0x45.htmlsl86h1Sun, 18 Oct 2026 21:00:39 GMTObjective-See. Recently, an attacker targeted (Mac) users via a Firefox 0day. In this third post, we analyze a second backdoor used in the attack, detailing its persistence, capabilities, and ultimate identify it a new variant of the cross-platform Mokes malware!ResearchZero-day https://objective-see.org/blog/blog_0x44.html1fi2060Sun, 18 Oct 2026 21:00:39 GMTObjective-See. Recently, an attacker targeted (Mac) users via a Firefox 0day. In this second post, we fully reverse OSX.NetWire.A, revealing (for the first time!), its inner workings and complex capabilities.ResearchZero-day https://objective-see.org/blog/blog_0x43.html1u3demrSun, 18 Oct 2026 21:00:39 GMTObjective-See. Recently, an attacker targeted (Mac) users via a Firefox 0day. In this first post, we triage and identify the malware (OSX.NetWire.A) utilized in this attack, identifying its methods of persistence, and more!ResearchZero-day https://objective-see.org/blog/blog_0x42.html1xkx5wmSun, 18 Oct 2026 21:00:39 GMTObjective-See. After the success of #OBTS v1.0, we decided to go international and plan #OBTS v2.0 in Europe! In this blog post, we re-live the highlights (from Monaco!) of "Objective by the Sea" v2.0.Research https://objective-see.org/blog/blog_0x41.html1md6589Sun, 18 Oct 2026 21:00:39 GMTObjective-See. @CodeColorist continues writing about bugs, such as CVE-2019-8521 and CVE-2019-8565 that provide a mechanism to elevate privileges to root on macOS.ResearchVulnerability https://objective-see.org/blog/blog_0x40.html1on2fu4Sun, 18 Oct 2026 21:00:39 GMTObjective-See. In part one of a guest blog post, @CodeColorist writes about several neat macOS vulnerabilities.ResearchVulnerability https://objective-see.org/blog/blog_0x3F.htmlyd9exzSun, 18 Oct 2026 21:00:39 GMTObjective-See. Let's tear apart a persistent piece of adware, decompiling, decoding, and decompressing it's code to uncover its methods and capabilities.Research https://objective-see.org/blog/blog_0x3E.htmlfiir0wSun, 18 Oct 2026 21:00:39 GMTObjective-See. A core Mojave utility is rather disastrously broken - causing a full-system lockup. Let's find out why!Research https://objective-see.org/blog/blog_0x3D.html1c5963hSun, 18 Oct 2026 21:00:39 GMTObjective-See. The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's (continue to) analyze their 1st-stage macOS implant: OSX.WindTail!ResearchAPT https://objective-see.org/blog/blog_0x3C.htmlscugxqSun, 18 Oct 2026 21:00:39 GMTObjective-See. Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!ResearchMalware https://objective-see.org/blog/blog_0x3B.html1rykklnSun, 18 Oct 2026 21:00:39 GMTObjective-See. The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's analyze their 1st-stage macOS implant: OSX.WindTail!ResearchAPT https://objective-see.org/blog/blog_0x3A.htmldb0vusSun, 18 Oct 2026 21:00:39 GMTObjective-See. A malicious Word document targeting macOS users, was recently uncovered. Let's extract the embedded macros, decode an embedded downloader, and retrieve the 2nd-stage payload!Research https://www.stepsecurity.io/blog/opencode-security-breachegd7ejSun, 18 Oct 2026 20:14:18 GMTStepSecurity. OpenCode reported a breach affecting Console users with linked AI providers. Here is what the vendor has said, and how to find OpenCode on your developer machines.ResearchBreachAI https://objective-see.org/blog/blog_0x8A.htmllvm9qdSun, 18 Oct 2026 00:00:00 GMTObjective-See. A newly discovered macOS ransomware sample attempts to rewrite, recompile, and replace itself with a metamorphic variant. In this blog post, we analyze Heartbreaker's encryption, persistence, and unusual self-rebuilding logic, then put it to the test against…ResearchRansomware https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access15ahe09Fri, 16 Oct 2026 23:00:00 GMTHuntress. ConnectWise (SkyKick) vendor credentials are being abused to access Microsoft 365 tenants. Disable the apps now and check your logs here.Research https://www.zscaler.com/blogs/security-research/ransomware-machine-speed-how-genai-shrinks-path-after-initial-accessllnzpbFri, 16 Oct 2026 22:48:36 GMTZscaler ThreatLabz. Artificial Intelligence technologies have made a huge impact on the security industry. But as with any public technology, adversaries have access to AI as well. They’re wasting no time incorporating AI into their malicious workflows and ransomware operators…ResearchRansomwareAI https://www.zscaler.com/blogs/security-research/cve-2026-88771-inside-exploitation-critical-netscaler-rce-vulnerabilityzv7tvtFri, 16 Oct 2026 21:28:21 GMTZscaler ThreatLabz. IntroductionOn September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1 score of 9.8…ResearchVulnerabilityZero-day https://www.aikido.dev/blog/escape-tech-alternativesgrl6lcFri, 16 Oct 2026 20:47:00 GMTAikido Security. We compare the top Escape.tech alternatives for offensive security in 2026: Aikido Security, XBOW, RunSybil, Terra, Burp Suite Professional, Invicti, StackHawk, Hadrian, and Pentera Category: DevSec Tools & ComparisonsResearch https://blog.nviso.eu/2026/10/16/keystrokes-in-disguise-forensic-analysis-of-a-digispark-hid-device/jb9hk1Fri, 16 Oct 2026 19:50:34 GMTNVISO Labs. A Digispark may look like a harmless USB development board, but it can easily be turned into a keystroke injection device that behaves like a USB Rubber Ducky. In this article, we show how such a device can be set up, used, and forensically analyzed, from…Research https://www.aikido.dev/blog/horizon-alternativespg26nvFri, 16 Oct 2026 19:48:00 GMTAikido Security. We compare the top Horizon3 alternatives for AI pentesting in 2026: Aikido Security, Pentera, RidgeBot, XBOW, Hadrian, RunSybil, and Terra Category: DevSec Tools & ComparisonsResearch https://censys.com/blog/web-scanning-in-censys-asm-just-got-deeper/1rihcczFri, 16 Oct 2026 18:36:14 GMTCensys. When you open your company’s website in a browser, you see the finished product: the navigation, the login form, the interactive widgets. It looks complete because your browser did the heavy lifting to build it. But much of what you see, and a lot of what an…Research https://www.volexity.com/blog/2026/10/16/mind-the-patch-gap-part-3-analysis-with-volexity-volcano-threat-intel-and-mcp/1mb6406Fri, 16 Oct 2026 18:27:25 GMTVolexity. Last month, Volexity published two blog posts in its Mind the (Patch) Gap series. The series details Volexity’s discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Google […]ResearchVulnerabilityZero-dayAPTAI https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/9q2cffFri, 16 Oct 2026 17:47:54 GMTUnit 42. Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishingResearch https://socket.dev/blog/deno-acquisitionn5idy9Fri, 16 Oct 2026 16:49:36 GMTSocket. Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.ResearchVulnerability https://www.microsoft.com/en-us/security/blog/2026/10/16/managing-open-weight-model-risk-in-enterprise-deployments/1aocqd6Fri, 16 Oct 2026 16:00:00 GMTMicrosoft Security Blog. New whitepaper from Microsoft and NVIDIA helps enterprises manage open-weight AI model risks with a shared taxonomy, evaluations, and controls.Research https://www.malwarebytes.com/blog/ai/2026/10/eiliko-robot-companion-exposes-private-chats-and-can-be-hijackeda0d25gFri, 16 Oct 2026 14:28:33 GMTMalwarebytes Labs. A researcher found serious flaws in Eiliko’s security, exposing private conversations and allowing remote changes to what the robot says.ResearchVulnerability https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-972291wm9uj3Fri, 16 Oct 2026 13:31:56 GMTRapid7. Overview On October 12, 2026, GitLab released 19.4.2 , 19.3.5 , and 19.2.8 to fix CVE-2026-97229 , an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar . GitLab assigned it a CVSS score of 10.0 and…ResearchVulnerabilityZero-day https://horizon3.ai/downloads/joint-solutions-briefs/ecb-cybersecurity-recommendations-nodezero/goxwkaFri, 16 Oct 2026 13:22:00 GMTHorizon3.ai. Explore how NodeZero autonomous penetration testing connects application, cloud, identity, and infrastructure weaknesses into validated attack paths, helping banks prioritize remediation and build evidence for the ECB’s cybersecurity supervisory…ResearchAI https://www.rapid7.com/blog/post/tr-rapid7-intelligence-wins-2026-peter-szor-award-outstanding-researchzorn2mFri, 16 Oct 2026 13:00:00 GMTRapid7. Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for our research, BPFdoor in Telecom Networks: Sleeper Cells in the Backbone , was of the latter kind.…ResearchAPTMalware https://www.huntress.com/blog/employee-spotlight-sarah-reddish1lrqjm7Fri, 16 Oct 2026 13:00:00 GMTHuntress. Go inside the hunt with Sarah Reddish, a SOC analyst on Huntress’ global SOC working in Triage & Analysis. See how she makes a difference every day.Research https://www.malwarebytes.com/blog/news/2026/10/spray-and-pray-job-applications-could-make-it-harder-for-you-to-spot-a-scam1ai6hkhFri, 16 Oct 2026 11:55:15 GMTMalwarebytes Labs. Sending out lots of job applications without keeping track could make a scammer’s message look like a reply you’ve been waiting for.Research https://www.malwarebytes.com/blog/ai/2026/10/openai-sued-over-children-safety-and-data-use6x0mhrFri, 16 Oct 2026 10:51:20 GMTMalwarebytes Labs. Eight US states and a mother of two accuse the ChatGPT maker of putting children’s safety and privacy at risk.Research https://www.welivesecurity.com/en/cybersecurity/inbox-flooded-signup-messages-email-bombing/17b9b4pFri, 16 Oct 2026 09:00:00 GMTWeLiveSecurity (ESET). If you’re suddenly being overwhelmed with sign-up emails, it could very well be a sign of something more seriousResearch https://horizon3.ai/news/press-release/horizon3-pax8-partnership-expansion-europe/1whyt42Fri, 16 Oct 2026 05:50:00 GMTHorizon3.ai. Horizon3 and Pax8 are expanding their partnership across Europe, making the NodeZero Proactive Security Platform available to MSPs through the Pax8 Marketplace. The expansion helps partners deliver autonomous penetration testing, prioritized remediation, and…Research https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file1h2r20nFri, 16 Oct 2026 05:15:00 GMTOpenSourceMalware. A cluster of 94 compromised repos have a second stage that autoruns a credential stealer and installs a cron jobResearchMalware https://www.recordedfuture.com/blog/tag-217-artex-south-korean-banks1gl58n4Fri, 16 Oct 2026 00:00:00 GMTRecorded Future. Learn how threat actor TAG-217 used the AI-driven ARTEX framework to target South Korean financial institutions in recent cyberattacks.Research https://horizon3.ai/news/press-release/keith-poyser-general-manager-emea-horizon3/18y7oc1Thu, 15 Oct 2026 22:10:08 GMTHorizon3.ai. Horizon3 has promoted Keith Poyser to General Manager, EMEA, following more than 260% regional revenue growth in the last fiscal year. Poyser grew the regional team from eight to more than 110 employees and will lead the company's next phase of expansion…Research https://horizon3.ai/news/press-release/ellen-sundra-chief-customer-officer-horizon3/uyeyizThu, 15 Oct 2026 22:07:03 GMTHorizon3.ai. Horizon3 has promoted Ellen Sundra to Chief Customer Officer, expanding her leadership across Sales Engineering, Customer Success, Support, Enablement, Renewals and Field CTOs. Her appointment strengthens the company's focus on customer adoption, long-term…Research https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/1vf7y91Thu, 15 Oct 2026 22:00:09 GMTUnit 42. Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.ResearchAPTAI https://www.rapid7.com/blog/post/it-multi-campus-universities-building-more-connected-security-programsl77bimThu, 15 Oct 2026 19:20:59 GMTRapid7. Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments, while campus-by-campus security can make…Research https://blog.talosintelligence.com/the-q3-vulnerability-pulse-discovery-exploitation/v366g2Thu, 15 Oct 2026 18:00:00 GMTCisco Talos. Is the cybersecurity world really facing a "Bugmageddon?" Thor breaks down the latest CVE and KEV trends in the latest Threat Source newsletter.ResearchVulnerability