# Archive
Browse past daily curated stories
Tuesday, October 20, 2026
-
1Krebs on Security threat-intelFeds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
KrebsOnSecurity reports that U.S. federal investigators pursuing the ShinyHunters hacking group — which recently stole sensitive data from the FBI — have identified executives at two ransomware negotiation firms who maintained unusually close relations with the extortion group. One U.S.-based executive allegedly helped ShinyHunters operate a ransom payment pressure website, raising serious questions about conflicts of interest within the incident response industry.
-
2The Record threat-intelConnectWise suspends Cloud Backup service after supply chain attack
ConnectWise suspended its Cloud Backup service after confirming unauthorized access to the Cloud Backup environment, with researchers reporting attackers used ConnectWise credentials to authenticate into Microsoft 365 tenants of downstream MSP customers. The supply chain nature of the attack puts potentially hundreds of managed service provider clients at risk, though ConnectWise says customer impact remains unconfirmed.
-
3SecurityWeek generalExploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
A stealthy FortiGate implant linked to an exploited Fortinet vulnerability was deployed against a telecommunications organization, according to SecurityWeek. The persistence mechanism and stealth characteristics of the implant suggest a sophisticated threat actor targeting critical infrastructure, and practitioners running Fortinet edge devices should audit for indicators of compromise immediately.
-
4The Hacker News generalPopular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
The Rank Math PRO WordPress SEO plugin (version 3.0.123) was compromised in a supply chain attack between 20:02 UTC October 15 and 07:12 UTC October 16, with malicious downloads served directly from rankmath.com delivering a self-restoring backdoor. Any WordPress site that installed or updated the plugin during that window should be treated as fully compromised, as the malware is designed to persist after removal attempts.
-
5BleepingComputer generalF5 releases out-of-band patches for critical NGINX vulnerabilities
F5 released out-of-band security patches addressing multiple NGINX web server vulnerabilities, including three rated critical-severity that enable remote code execution on unpatched systems. Given NGINX's ubiquity as a reverse proxy and web server, administrators should prioritize applying these patches immediately to prevent exploitation.
-
6The Hacker News generalHackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors began actively exploiting the Plex2Shell vulnerability chain — four chained flaws in Plex Media Server — within hours of a public PoC release, deploying cryptocurrency miners and Linux reverse proxy backdoors on compromised hosts. Security researcher boredhackerblog disclosed the exploit chain, and the rapid weaponization underscores the shrinking window between PoC publication and active exploitation.
-
7The Hacker News generalUnpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
Security researcher Quentin Kaiser disclosed an unpatched root code execution flaw in Broadcom's Wi-Fi setup software affecting Broadcom-based routers, demonstrated against home gateways from three Belgian ISPs — requiring only radio range proximity with no network password or pairing step needed. The flaw allows extraction of Wi-Fi credentials directly from affected devices and remains unpatched at time of disclosure.
-
8SecurityWeek generalMITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
MITRE released ATT&CK v20, adding coverage for AI abuse techniques, MFA bypass methods, and water utility attack patterns, along with 15 new detection strategies (six for Enterprise, nine for ICS) backed by 38 analytics. The update provides defenders with concrete detection guidance for emerging attack categories that have seen significant real-world activity over the past year.
-
9CyberScoop generalDHS to ban DeepSeek from federal civilian agencies
DHS is moving to ban DeepSeek AI from all federal civilian agencies, citing national security concerns including data transmission to servers in China, potential malware risk, and threats to federal IT systems. The ban follows similar restrictions by other government bodies and reflects growing scrutiny of Chinese AI applications in sensitive government environments.
-
10BleepingComputer generalHackers hijack AOMEI update servers to secretly spread malware
Hackers compromised AOMEI's update servers to distribute malware through the backup software's built-in promotional feature, briefly altering configuration files before restoring them to their originals to cover tracks. The attack targeted users of AOMEI's backup product via a trusted update channel, making it a notable supply chain incident affecting a widely-used Windows backup utility.