OSINT / CyberSec report 21.10.2026 00:15

1. Hackers abused the AI penetration testing tool Cairn to automate attacks compromising hundreds of websites, including those of John Deere, SharkNinja, and Cummins (Dark Reading).

2. Threat actors hijacked five OVHcloud CLI releases on GitHub for up to 94 minutes, replacing archives with secret-stealing malware via a compromised contributor account (The Hacker News).

3. ClickFix attackers exploited a high-severity DLL sideloading vulnerability CVE-2026-110936 in Siemens Software Center to deploy a remote access trojan (The Hacker News).

4. A new ClickFix delivery platform called ROMULUS is being used to distribute LegionLoader and other malware through bogus landing pages (The Hacker News).

5. Russian-linked APT28, also known as Fancy Bear, hacked defense contractors and a law enforcement agency in two NATO allies using a documented backdoor (The Record).

6. Ex-OpenAI engineer Abdulrahman Alfozan was detained by a US court over allegedly planting a recording device and having frequent WhatsApp communications with Saudi royal contacts (The Hacker News).

7. Fintech company Revolut suffered a massive outage disrupting most of its online banking services worldwide (BleepingComputer).

8. CenterPoint Energy, a US utility, disclosed a data breach affecting over one million Texas residents, exposing names and other personal information (Check Point Research).

9. Nikkei Inc. disclosed its third data breach in a month, exposing 1.83 million personal information records (BleepingComputer).

10. Hackers exploited Plex2Shell vulnerabilities in Plex Media Server to deploy cryptocurrency miners and a Linux proxy backdoor, just a day after a proof-of-concept went public (The Hacker News).

11. The popular WordPress SEO plugin Rank Math PRO was hijacked to deliver a self-restoring backdoor through downloads from the official site between October 15 and 16 (The Hacker News).

12. The GhostAction supply chain attack expanded to phish developers and deliver a credential stealer disguised as a fake font file in 94 GitHub repositories (The Hacker News).

13. A fake Web3 accelerator used malicious npm packages to spread information stealers and backdoors to Windows and macOS systems, hijacking AI agent traffic (The Hacker News).

14. Hackers hijacked AOMEI update servers to secretly spread malware through a built-in promotional feature in its backup software (BleepingComputer).

15. Staffing software company Bullhorn took its platform offline to contain a cyberattack that caused a system-wide outage (BleepingComputer).

16. ConnectWise suspended its Cloud Backup service after confirming unauthorized access, with researchers saying attackers authenticated into Microsoft 365 tenants using ConnectWise credentials (The Record).

17. Ahold Delhaize confirmed malicious actions behind cyber outages affecting its grocery brands across the US and Europe, forcing systems offline (The Record).

18. F5 released out-of-band patches for critical NGINX vulnerabilities that could let attackers execute code on vulnerable systems (BleepingComputer).