IT News Analysis

1

Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election

The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the  Citizen Lab said  on October 19. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or open a file for it to work. The lab found the infection with high confidence, but its note provides no date within 2026, does not identify who was behind the attack, and notes that its investigation is ongoing. The election was  called in September  after nearly two years of protests that began when a railway station canopy collapsed in Novi Sad in November 2024, killing 16 people. The Citizen Lab, a research group at the University of Toronto, analyzed forensic artifacts from the phone at Đokić's request, working with the Serbian digital-rights group SHARE Foundation. SHARE ...

Oct 20, 2026

2

WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators

WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one. The text sat in the pages' code, never shown on screen, until it was removed by October 18. Whether the chatbot ever followed the instructions is not known:  Redact , the data-deletion software company that found the text, read the instructions, not the chatbot's answers. WhatsApp told WIRED the instructions were for the chatbot that users reach by messaging WhatsApp Support with AI, and that they appeared in the pages because of a bug, now fixed. A second block of hidden text on the page about reporting and blocking told the chatbot that once a user mentioned a lawyer, a lawsuit, or a court, it should not cite privacy laws such as the GDPR, even when the user raised them. A W...

Oct 20, 2026

3

SANS Has Taught Defenders Since 1989. AI Security Is the Newest Chapter.

Explore practitioner-built training, six GIAC AI certifications, and free resources to use this week.

4

What Security Teams Can Do To Tame Wild Code

A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them.  If you work in security, that success introduces a new set of questions. Whose credentials does the workflow use? Which records can it access? Who can see its output? If it starts exposing information it shouldn’t, can you trace what happened and stop further access?  Wild code takes root when useful builds spread faster than the processes for owning, securing, and maintaining them. It isn’t simply another name for unapproved software. Employees are creating new capabilities, not just adopting existing products. A small experiment can become an operational dependency before secu...

Oct 20, 2026

5

Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of  eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys. The Go team says the keys belong to one certificate authority it has not named, and that it is blocking them because of "specific security concerns around their operation." It handled the fix on its  URGENT track , the one reserved for its most serious issues, and recommends upgrading immediately. Two days earlier, on October 17, Mozilla added six intermediate certificates issued by eMudhra's emSign Root TLS CA - G3 to  OneCRL , the list Firefox uses to block certificates. The Mozilla bug behind those entries is  closed to the public , and neither Mozilla nor Go has said what prompted its action. Whether Chrome, Apple, or Microsoft have taken simil...

Oct 20, 2026

6

Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader

The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail , involved the use of a backdoor called HOOKEDGE and a previously undocumented loader that is designed to decrypt and run an encrypted payload in memory by using a cryptographic key that's supplied at runtime. Targets of the activity included a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines – entities that hold information that could be of use to a foreign intelligence agency, the Broadcom-owned threat intelligence unit said. "During one attack against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity,...

Oct 20, 2026

7

Gartner® Hype Cycle™ for CPS Security, 2026

Prioritize cyber-physical systems security amid rising threats, regulations, vulnerabilities and emerging technologies.

8

ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident

ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup. The company said it has completed the following actions since it began rolling out mitigations on October 17 at 5:00 a.m. UTC, three days after the incident was first identified - Disabling affected application connections and suspending Cloud Backup. Suspending SaaS Security and Cloud Management as a precaution because they are integrated with Cloud Backup. Enlisting the help of independent third-party specialists for incident response and remediation. Enhancing administrative-access protections. Publishing technical guidance to help partners investigate and remediate potential unauthorized activity in their own and managed customer environments. ...

Oct 20, 2026

9

Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware

An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC, and reached only people who installed or updated the OVHcloud CLI during that window, via a path that checks for no hash, on macOS, Linux x86_64 or arm64, or Windows x86_64. OVHcloud deleted the swapped archives and published a clean  v0.16.0  that evening as an immutable release, whose files GitHub will not let anyone change. The source code, the release tag, and the company's build pipeline were not touched: the bad build was a plain go build of a later commit, uploaded straight onto releases published between April and September. Who Was Exposed On v0.15.0, the attac...

Oct 20, 2026

10

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the affected service. "The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path," Siemens said in an advisory. "This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application." The issue has been patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon has been credited with discovering and reporting the shortcoming. In a separate alert, Siemens said attackers have abused a genuine ...

Oct 20, 2026