# Today's Top Stories

KrebsOnSecurity reports that U.S. federal investigators pursuing the ShinyHunters hacking group — which recently stole sensitive data from the FBI — have identified executives at two ransomware negotiation firms who maintained unusually close relations with the extortion group. One U.S.-based executive allegedly helped ShinyHunters operate a ransom payment pressure website, raising serious questions about conflicts of interest within the incident response industry.

ConnectWise suspended its Cloud Backup service after confirming unauthorized access to the Cloud Backup environment, with researchers reporting attackers used ConnectWise credentials to authenticate into Microsoft 365 tenants of downstream MSP customers. The supply chain nature of the attack puts potentially hundreds of managed service provider clients at risk, though ConnectWise says customer impact remains unconfirmed.

A stealthy FortiGate implant linked to an exploited Fortinet vulnerability was deployed against a telecommunications organization, according to SecurityWeek. The persistence mechanism and stealth characteristics of the implant suggest a sophisticated threat actor targeting critical infrastructure, and practitioners running Fortinet edge devices should audit for indicators of compromise immediately.

The Rank Math PRO WordPress SEO plugin (version 3.0.123) was compromised in a supply chain attack between 20:02 UTC October 15 and 07:12 UTC October 16, with malicious downloads served directly from rankmath.com delivering a self-restoring backdoor. Any WordPress site that installed or updated the plugin during that window should be treated as fully compromised, as the malware is designed to persist after removal attempts.

F5 released out-of-band security patches addressing multiple NGINX web server vulnerabilities, including three rated critical-severity that enable remote code execution on unpatched systems. Given NGINX's ubiquity as a reverse proxy and web server, administrators should prioritize applying these patches immediately to prevent exploitation.

Threat actors began actively exploiting the Plex2Shell vulnerability chain — four chained flaws in Plex Media Server — within hours of a public PoC release, deploying cryptocurrency miners and Linux reverse proxy backdoors on compromised hosts. Security researcher boredhackerblog disclosed the exploit chain, and the rapid weaponization underscores the shrinking window between PoC publication and active exploitation.

Security researcher Quentin Kaiser disclosed an unpatched root code execution flaw in Broadcom's Wi-Fi setup software affecting Broadcom-based routers, demonstrated against home gateways from three Belgian ISPs — requiring only radio range proximity with no network password or pairing step needed. The flaw allows extraction of Wi-Fi credentials directly from affected devices and remains unpatched at time of disclosure.

MITRE released ATT&CK v20, adding coverage for AI abuse techniques, MFA bypass methods, and water utility attack patterns, along with 15 new detection strategies (six for Enterprise, nine for ICS) backed by 38 analytics. The update provides defenders with concrete detection guidance for emerging attack categories that have seen significant real-world activity over the past year.

DHS is moving to ban DeepSeek AI from all federal civilian agencies, citing national security concerns including data transmission to servers in China, potential malware risk, and threats to federal IT systems. The ban follows similar restrictions by other government bodies and reflects growing scrutiny of Chinese AI applications in sensitive government environments.

Hackers compromised AOMEI's update servers to distribute malware through the backup software's built-in promotional feature, briefly altering configuration files before restoring them to their originals to cover tracks. The attack targeted users of AOMEI's backup product via a trusted update channel, making it a notable supply chain incident affecting a widely-used Windows backup utility.