IT News Analysis

1

Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware

Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own machines. "ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators," security researcher Sai Molige said in an analysis. The cybersecurity company said it identified six IP addresses running ROMULUS -

Oct 20, 2026

2

SANS Has Taught Defenders Since 1989. AI Security Is the Newest Chapter.

Explore practitioner-built training, six GIAC AI certifications, and free resources to use this week.

3

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog , the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell . The vulnerabilities are below - CVE-2026-96652 (CVSS score: 5.3) - An unauthenticated server-side request forgery (SSRF) stemming via the "/player/timeline" endpoint by taking advantage of the fact that the "protocol" parameter is inserted into a programmatically-constructed player URL with no validation, allowing an attacker to force the Plex server to POST to a destination of their choice. CVE-2026-96654 (CVSS score: 6.9) - An improper neutralization of URL values included in the "searchOne" endpoint that could allow an attacker to call other plugins' functions and...

Oct 19, 2026

4

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a  security notice  published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the malware can recreate its hidden backdoor whenever someone visits the site. Rank Math has removed the affected files and released a clean version, 3.0.124. Installing it replaces the plugin but does not remove files, administrator accounts, or scheduled tasks the malware may already have placed elsewhere on the server, Wordfence said in an  advisory  on October 17. Who Is Affected The version number does not show whether a copy is affected. Rank Math's  changelog  dates 3.0.123 to October 7, more than a week before the window opened, and the notice limits the inciden...

Oct 19, 2026

5

⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More

The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren't supposed to. Some attacks were clever. Others were painfully simple. The full recap shows just how much can go wrong, and how little it sometimes takes. ⚡ Threat of the Week ConnectWise Suspends Cloud Backup Following Unauthorized Access — ConnectWise disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenant...

Oct 19, 2026

6

GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps taken by GitHub to prevent the workflow from running. According to the threat intelligence platform, the threat actor registered the domain " my-github[.]com " and pointed it at " 193.32.204[.]199 ," the same IP address that's used as an exfiltration endpoint for data harvested from running the malicious workflow. The domain was registered on October 9, 2026, 17 days after " my-gitlab[.]com " was registered. There is no evidence at this stage to suggest that the two code-hosting-themed domains are operated by the same threat actor. "It follows the sam...

Oct 19, 2026

7

Gartner® Hype Cycle™ for CPS Security, 2026

Prioritize cyber-physical systems security amid rising threats, regulations, vulnerabilities and emerging technologies.

8

From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software

In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features. Chained together, they produce this path: public internet → email → case record → agent prompt → agent action → case comment → outbound reply An unauthenticated outsider now has a route into an internal agent's instructions, and the agent's reply leaves through the same door. Nothing was misconfigured. The finding, documented by researchers in August 2026, is a clean example of how agents that arrive inside existing platforms fail: through the application around them, not the model inside them. The risk is in the application, and the application is the thing nobody re-reviewed Which intake fea...

Oct 19, 2026

9

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic said . "The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings." The scheme poses as a Web3 venture capital accelerator named Apex Accelerator to target cryptocurrency startups and founders. It's being tracked under the moniker REF8801 . The names of the npm packages, each of which targets both Windows and macOS machines, are listed below - @apexacc/cli (Apex Copilot CLI — AI advisor fo...

Oct 19, 2026

10

Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers

A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser  disclosed  on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device and in another opening a remote shell over the air. No CVE has been assigned to the flaw, and no fix has been deployed to the affected routers, Kaiser says. The flaw is in Broadcom's version of Wi-Fi Protected Setup (WPS), the feature that lets a device join a Wi-Fi network without the password being typed in. Broadcom's code mishandles the reassembly of fragmented WPS setup messages, so an attacker in range can send crafted messages that corrupt the router's memory. From there, Kaiser built two things: a way to read memory back off the device, and a way to run his own code on it. Ag...

Oct 19, 2026