9 stories · 6 sources · 1 critical · 3 high · ~10 min read

Coverage: Last 72 hours

Today’s Highlights

This cycle showcases critical vulnerabilities under active exploitation, operational risks from emerging supply chain threats, and evolutions in AI abuse and credential exposure. Unpatched infrastructure and overlooked SaaS integrations remain top attacker footholds. Notably, critical flaws in Broadcom Wi-Fi chipsets leave millions of routers exposed to code execution, and ConnectWise’s SaaS integrations have triggered incident response due to the compromise of Microsoft 365 tenants. Defenders should also monitor shifts in attacker tradecraft, with MITRE ATT&CK v20 officially mapping AI, MFA bypass, and critical infrastructure abuse.

Table of Contents

1. Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
2. Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
3. ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
4. MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon
5. Encryption Is Getting Squeezed From All Sides

Critical   High   Medium   Low

Top Stories

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

Source: SecurityWeek | Published: Oct 17 | Risk: HIGH | Impacted: Threat intel consumers, ad network-integrated platforms, privacy advocates | Topics: Threat Intel / Vulnerability

What happened: Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets. The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek.

Why it matters: The use of legitimate advertising networks for targeted spyware delivery dramatically increases the scale and stealth of zero-click attacks, especially against high-profile and geopolitically relevant targets.

How it works: Attackers leverage commercial ad infrastructure to selectively exploit browser and device vulnerabilities, enabling infection without user interaction while evading traditional security controls.

Practitioner Perspective

Defenders should treat ad network vectors as credible routes for sophisticated adversaries to establish initial access. Security teams must regularly review third-party content sources in their organization’s web footprint and assess the risk of third-party JavaScript execution. Detection engineering should prioritize identifying anomalous traffic originating from embedded advertising content, and digital risk teams should track vendor relationships linked to advertising delivery.

Recommended Actions

• Block or monitor advertising JavaScript domains in enterprise browsing environments using EDR solutions
• Regularly vet third-party content sources and require security attestations from digital marketing and advertising partners

Emerging Signals

Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers

Source: The Hacker News | Published: Oct 19 | Risk: CRITICAL | Impacted: Broadcom-based Wi-Fi routers, Corporate WLAN deployments, Retail and guest Wi-Fi hotspots | Topics: Ics Ot / Vulnerability

What happened: A vulnerability in Broadcom’s Wi-Fi Protected Setup allows attackers within range to execute root code on routers without network credentials. Security researcher Quentin Kaiser demonstrated this by extracting Wi-Fi passwords and opening remote shells on affected devices. Millions of routers worldwide are impacted, but no CVE has been assigned, and no fixes are available.

Why it matters: Millions of routers using Broadcom chipsets are exposed to remote takeover and credential theft by any attacker in physical proximity, absent any authentication or patch.

How it works: Broadcom Wi-Fi chipsets are embedded in many consumer and business routers. The bug involves Wi-Fi Protected Setup (WPS), which attackers can exploit to run code as root on the device without joining the network.

Affected / Fix: No patch or CVE yet; compensating controls advised.

Practitioner Perspective

Environments deploying Broadcom-based Wi-Fi routers must immediately assess exposure, as attackers can exploit these flaws for root shell access and Wi-Fi password harvesting. The risk is acute in areas where attackers can get within wireless range, think shared office buildings, public venues, and unmonitored facilities. With no CVE or vendor fix yet, compensating controls such as segmenting critical assets from Wi-Fi networks and disabling WPS are the only options. This scenario is ripe for internal threat actors or close-proximity criminal exploitation. Treat any unknown device appearing on Wi-Fi as suspect and respond as if credential compromise has occurred.

Recommended Actions

• Disable Wi-Fi Protected Setup (WPS) on all Broadcom-based access points immediately
• Isolate Wi-Fi networks from sensitive business systems and require separate VLANs where possible

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

Source: The Hacker News | Published: Oct 18 | Risk: HIGH | Impacted: ConnectWise Cloud Backup customers, Microsoft 365 tenants linked to ConnectWise, MSPs managing SaaS access | Topics: Cloud / Vulnerability

What happened: ConnectWise disabled seven application identities and suspended Cloud Backup services after attackers compromised Microsoft 365 tenants using stolen credentials. The company is investigating the incident and has temporarily taken SaaS Security and Cloud Management offline.

Why it matters: Credential compromise of SaaS application identities connected to Microsoft 365 can lead to lateral account takeover and privileged access abuse across customer environments.

How it works: ConnectWise Cloud Backup integrates with SaaS and Microsoft 365 tenants by using application identities for backup and management. Compromised credentials let attackers manipulate or exfiltrate tenant data.

Affected / Fix: ConnectWise has disabled affected identities and suspended impacted services; investigation ongoing.

Practitioner Perspective

MSPs and organizations using ConnectWise must treat this SaaS-backup compromise as a tier-0 incident, given attackers leveraged stolen Microsoft 365 tenant credentials to move laterally. Disabling affected application identities and validating the integrity of SaaS permissions are crucial while investigation continues. The cloud backup function’s suspension may leave gaps in recovery posture or DR workflows. All recent privileged activity in M365 and related systems should be treated as potentially attacker-driven until root cause is conclusively identified. Map third-party SaaS connectors and revoke or re-validate their permissions to stem further abuse.

Recommended Actions

• Review and revoke any ConnectWise Cloud Backup application identities associated with M365 tenants
• Hunt for abuse of privileged accounts and suspicious mailbox rules across all customer M365 tenants post-incident

MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon

Source: The Hacker News | Published: Oct 17 | Risk: HIGH | Impacted: npm users pulling imgdecode, app build pipelines integrating new dependencies, developer workstations running npm install | Topics: Supply Chain / Vulnerability

What happened: Cybersecurity researchers have discovered a malicious npm package that’s part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named “imgdecode,” was uploaded to the package registry on September 30, 2026, by a user named “malfexteste8.” It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest

Why it matters: Malicious supply chain injection via npm can grant remote code execution to attackers in any environment consuming the compromised package, with real risk of lateral movement across CI/CD or developer systems.

How it works: npm is a package manager for JavaScript and Node.js projects, malicious modules can deliver arbitrary code upon installation. The imgdecode package hides shellcode loader logic within a native Windows add-on.

Affected / Fix: Malicious imgdecode package still available on npm as of writing; removal and manual cleanup needed.

Practitioner Perspective

If your environment uses npm packages in builds or deployments, the presence of imgdecode in recent manifests is cause for immediate concern, as it delivers a native Windows shellcode loader capable of arbitrary payload execution. The distributed attack campaign (MALFEX) exploits the trust developers place in common package repositories, putting not only production but also developer endpoints and CI/CD runners at risk. Given ongoing downloads and the package’s ongoing availability, defenders must scan all build artifacts and developer systems for presence of this package. This threat further underscores the urgency to lock down supply chain hygiene and proactively threat-hunt within developer pipelines.

Recommended Actions

• Search for and remove the imgdecode package and all related dependencies from npm build manifests and production systems
• Scan developer systems and CI/CD runners for footprints linked to the malfexteste8 account or shellcode loader activity

Encryption Is Getting Squeezed From All Sides

Source: WIRED Security | Published: Oct 17 | Risk: MEDIUM | Impacted: Policy-makers, privacy advocates, Canadian organizations | Topics: Policy / Privacy

What happened: Canada’s planned surveillance law is the latest grim step in a series of threats to encryption that are spreading around the world.

Why it matters: Increasing legislative constraints on cryptography raise the risk of backdoors or forced disclosure, degrading privacy and exposing critical data flows across regional and sectoral boundaries.

How it works: These laws compel service providers to grant law enforcement or intelligence agencies expanded access to encrypted traffic, forcing changes in risk postures and compliance requirements for cross-border operations.

Practitioner Perspective

Legal and privacy teams must proactively review compliance and product strategies to identify potential exposure to new anti-encryption regulations. Technical staff should evaluate dependencies on end-to-end cryptographic controls and prepare to respond to future regulatory changes with robust risk assessments.

Recommended Actions

• Inventory systems relying on encryption for data protection and transmission
• Monitor international legislative developments on encryption and prepare communication to stakeholders about regulatory changes

Also Today

• OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys: On October 16, 2026, an intruder accessed a legacy system at OpenCode, potentially exposing third-party AI provider keys saved in OpenCode Console. This affected 1.4% of Console users who had linked external providers. OpenCode advised these users to revoke and replace their keys. Some users reported unauthorized usage charges, but OpenCode has not confirmed any misuse. The company is collaborating with Anthropic, OpenAI, and Google to address the issue.
• MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks: MITRE’s ATT&CK v20 framework introduces techniques for AI abuse, MFA bypass, and water utility attacks, including prompt injection, AI agent data theft, and bypassing CAPTCHA checks.
• Anthropic Acquires Confidential AI Startup Opaque Systems: Anthropic has acquired Opaque Systems, a company specializing in technology that enables AI systems to utilize sensitive data while maintaining hardware-level protection. Opaque’s team is joining Anthropic, and the company is ceasing its operations. Financial terms of the acquisition were not disclosed.
• US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars: Between January and September 2026, U.S. cybersecurity job postings declined by 26.4% compared to the same period in 2025, totaling 235,786 postings. Despite this overall decrease, demand for AI-related roles surged, with AI Security Engineer postings increasing by 268.3% and Cyber Data Scientist postings by 203.5%. Approximately 15% of all job postings now reference AI, up from 15.1% last year, with a peak of 20% in September 2026. The Research function had the highest AI-related postings at 32.7%, followed by Offense at 23.3%, GRC at 19.8%, and Plan at 18.9%.

Defensive Actions

• Disable WPS on all Broadcom-based Wi-Fi routers and segment sensitive assets onto separate VLANs
• Revoke and reissue any OpenAI, Anthropic, and Google API keys integrated within SaaS developer consoles such as OpenCode; audit all usage logs for AI-related workloads
• Hunt for presence of the imgdecode npm package across build pipelines and developer systems; remove immediately if detected
• Review SaaS integrations for orphaned or overly-permissive application identities, especially in Microsoft 365 and ConnectWise contexts
• Monitor and restrict third-party advertising scripts and JavaScript from loading in enterprise applications
• Track policy proposals and regulatory changes affecting encryption dependencies, and communicate potential risk clearly to technical and business stakeholders
• Maintain an incident response runbook for SaaS credential and supply chain exposure events, ensuring rapid detection and containment protocols are current

What We’re Watching

• New developments or patches for the unpatched Broadcom Wi-Fi vulnerability affecting millions of routers, monitor vendor advisories
• Ongoing incident investigations from the ConnectWise/MS365 compromise, especially evidence of lateral movement across MSP environments
• Emergence of additional supply chain attacks targeting npm packages post-MALFEX disclosure, monitor for similar patterns beyond imgdecode
• Adoption of MITRE ATT&CK v20 by major security vendors and the impact on SOC detection coverage for AI, MFA bypass, and critical infrastructure techniques
• International legislative updates on encryption regulation, particularly in Canada, as surveillance and privacy frameworks evolve

Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.

Categories: Cybersecurity Blog, Cybersecurity News

Tags: AI Security, Cloud Security, cybersecurity, Malware, Supply Chain, Threat Intelligence, Vulnerabilities