Daily digest,
Discover-Tech's AdFection Scheme Delivers Candiru Spyware via Ads (+6 more)
Vulnerabilities
Critical CVE-2026-103849 Vulnerability in Adobe Commerce and Magento
A critical vulnerability (CVE-2026-103849) in Adobe Commerce and Magento allows unauthenticated remote code execution (RCE) through a template injection flaw, rated CVSS 10.0. Disclosed on October 13, 2026, the vulnerability affects several versions of Adobe Commerce and Magento, including 2.4.4 through 2.4.9 and Adobe Commerce B2B 1.3.3 to 1.5.3. Attackers can exploit this flaw by injecting malicious directives into email templates, which are then executed on the server. Although no active exploitation has been confirmed, researchers have identified four potential attack vectors. Adobe has released a patch, but it requires manual application, and standard Composer installs may not address the vulnerability. Security experts recommend immediate patching due to the potential for rapid exploitation, similar to past incidents with related vulnerabilities.
Vulnerability · 7 sources · score 70 · CVE-2022-24086, CVE-2025-54236, CVE-2026-100133, CVE-2026-103849, CVE-2026-71362
Critical OAuth Bypass Vulnerability in Mage OSS Disclosed
Mage OSS has a critical authentication bypass vulnerability (CVE-2026-111823) with a CVSS score of 9.8, allowing unauthenticated access to sessions when an unknown OAuth provider is accepted. The flaw arises from improper error handling in the OAuth callback handler, which fails to terminate session creation despite encountering an error. This vulnerability affects all versions up to 0.9.80 and poses significant risks, especially as Mage OSS manages sensitive credentials for various services. Although a proof-of-concept (PoC) has been released, there is currently no confirmed exploitation in the wild. Organizations are advised to treat this vulnerability as high-risk and implement immediate mitigations. This incident marks a troubling trend of trust-through-defaults failures in recent weeks, indicating broader issues in secure defaults across software stacks. The situation is evolving, and further verification regarding active exploitation is needed.
Vulnerability · 2 sources · score 70 · CVE-2026-111823
AI-Driven Cyber Campaign Targets Government Linux Servers
Unit 42 has identified a cyber campaign, tracked as CL-UNK-1211, targeting government entities and state-affiliated infrastructure from October 2025 to April 2026. The attackers utilized AI-generated code to deploy web shells, credential stealers, and custom malware aimed at accessing government emails and sensitive databases. Notably, the malicious scripts contained conversational annotations indicative of AI-generated content. The attackers employed various techniques, including modifying PHP configurations and hijacking .bashrc files to harvest credentials. They also attempted to erase traces of their activities by disabling endpoint protections and altering logs. The campaign's scope highlights the vulnerabilities in Linux environments, with no evidence of SolarWinds systems being compromised. The investigation is ongoing, and the full extent of the impact remains to be assessed.
Vulnerability · 2 sources · score 63 · CVE-2021-4034, CVE-2025-55182, SysGoRAT, CL-UNK-1211
Breaches
OpenCode Security Breach Exposes User API Keys
OpenCode reported a security breach on October 17, 2026, affecting 1.4% of its Console users. The breach was linked to a large-scale distillation attack, which compromised third-party API keys stored in user workspaces. Users have reported unauthorized charges on their accounts, with one user noting $400 in charges linked to Anthropic. OpenCode has notified all affected users via email and is working with Anthropic, OpenAI, and Google to address the incident. Users are advised to revoke and replace their API keys and review their account activity for any unauthorized usage. Access issues have also been reported by some users trying to log in. The situation remains ongoing as OpenCode investigates the breach further.
Breach · 3 sources · score 56
Napoleon Perdis Cyber Attack Exposes Data of 340,000 Customers
Napoleon Perdis, an Australian cosmetics brand, experienced a significant data breach affecting nearly 340,000 customers. The breach, linked to a third-party provider, Retail Express, compromised personal information such as names, dates of birth, email addresses, phone numbers, postal addresses, and purchase histories. The unauthorized access reportedly occurred between November 2025 and June 2026, impacting records of customers who made purchases before June 2025. However, banking information and passwords were not compromised. The company has assured that its current online store remains secure and that the affected system has been permanently shut down. Customers are advised to be vigilant against potential scams following the breach, and the Office of the Australian Information Commissioner has been notified.
Breach · 2 sources · score 52
Threat actors and malware
Discover-Tech's AdFection Scheme Delivers Candiru Spyware via Ads
A recent investigation by Citizen Lab revealed that Israeli ad firm Discover-Tech operated a spyware delivery scheme named AdFection, utilizing its Controlium platform to infect devices through malicious ads. The scheme targeted users by advertising ID, cookie, or IP address, deploying spyware from Candiru once an ad was loaded. Between 2024 and 2025, at least 45 devices belonging to Al Jazeera were compromised. Discover-Tech's ads reached various sensitive networks, including those of the U.S. Department of Defense and other critical institutions, raising significant cybersecurity concerns. The investigation documented over 3.7 billion advertising bids and linked Discover-Tech to a broader vulnerability in the digital advertising ecosystem. The U.S. government has previously sanctioned Candiru for its role in espionage activities against journalists and activists. The findings suggest that the ad delivery infrastructure can be exploited to bypass traditional cybersecurity measures.
APT · 6 sources · score 76 · Candiru, AdFection
Also worth knowing
NSA Advocates Zero Trust for Aging Critical Infrastructure Security
On October 8, 2026, the NSA released guidance urging the implementation of zero trust principles to protect aging operational technology systems, which are increasingly vulnerable to cyber threats. The guidance highlights the need for controlled access, segmentation, and monitoring to secure critical infrastructure sectors, including energy, water, and healthcare. It emphasizes that legacy systems often lack modern security capabilities, making them susceptible to attacks. The NSA's recommendations are particularly aimed at National Security Systems and the Department of War, but they also apply broadly to operators of essential services. The guidance reflects a shift from traditional network isolation to a focus on securing individual operational capabilities. The NSA warns of potentially catastrophic consequences for national security and public safety if these systems remain unprotected. The report aligns with previous CISA guidance from April 2026, which also addressed the unique challenges of securing operational technology environments.
Critical Infrastructure · 2 sources · score 57
New on leak sites
22 victims listed on ransomware leak sites by 11 groups in the 24 hours before this issue. The most active:
Also moving
- Ransomware groups: Qilin, Asahi
- Malware: Crossroad, Shinyroad, Agent.btz, BankBot, Bumblebee
- CVEs: CVE-2026-108131, CVE-2026-76835, CVE-2026-96222, CVE-2007-4559, CVE-2021-4034
- Campaigns: Operation Sindoor, UNC7017, AdFection, CL-UNK-1211
- Vulnerabilities: BlockStrap, Checkm8
- APT groups: Candiru, Cozy Bear
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.