APT28 Targets NATO; ConnectWise Hit by Supply Chain Attack; Oracle Issues Massive Patch

APT28 Espionage Campaign Hits NATO Defense and Law Enforcement

The Russian-linked threat actor APT28 has been identified as the perpetrator of a sophisticated cyber-espionage campaign that successfully compromised a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency within two European NATO member states. The campaign, active from July to September 2026, utilized a backdoor known as HOOKEDGE and a previously undocumented reflective loader to execute payloads in memory, evading detection while stealing credential material and establishing persistent access via SSH tunnels.

APT28Fancy BearGRUCyber EspionageNATO +3 more

7 min read

Russian APT28 Breaches NATO Defense and Law Enforcement Entities

Siemens Software Center Flaw (CVE-2026-110936) Actively Exploited

Siemens Software Center Flaw CVE-2026-110936 Exploited in Wild

Siemens has confirmed the active exploitation of a high-severity DLL side-loading vulnerability, CVE-2026-110936, in its Siemens Software Center (SSC) application. The flaw, rated 8.4 on the CVSS v4.0 scale, is being leveraged by the 'ClickFix' malware campaign. Attackers trick users into running a malicious installer that bundles a legitimate, older version of SSC with a malicious DLL, leading to arbitrary code execution. Siemens has released an update and urges customers to apply it.

CVE-2026-110936SiemensDLL Side-LoadingClickFixVulnerability +2 more

Siemens Software Center Flaw (CVE-2026-110936) Actively Exploited

Oracle's October 2026 CPU Fixes 1,283 Vulnerabilities, Some Critical

CRITICAL

Oracle October 2026 Critical Patch Update Fixes 1,283 Flaws

Oracle has released its quarterly Critical Patch Update (CPU) for October 2026, a massive release that addresses 1,283 new security vulnerabilities across its vast product portfolio. The update includes patches for numerous critical, remotely exploitable flaws that require no user authentication. Oracle Fusion Middleware, E-Business Suite, and PeopleSoft are among the most heavily impacted, with some vulnerabilities carrying the maximum CVSS score of 10.0, demanding immediate attention from administrators.

OracleCritical Patch UpdateCPUPatch TuesdayVulnerability +4 more

4 min read

Oracle's October 2026 CPU Fixes 1,283 Vulnerabilities, Some Critical

Ahold Delhaize Confirms Cyberattack Caused Widespread Outages

Ahold Delhaize Cyberattack Disrupts Grocery Services in US, Europe

Global grocery giant Ahold Delhaize, parent company of Stop & Shop and Food Lion, confirmed on October 19 that a 'malicious' cyberattack was the cause of a massive IT disruption that began a week prior. The attack took websites and mobile apps for its U.S. and European brands offline, crippling e-commerce and delivery services. While physical stores remained open, the incident caused significant operational and customer-facing issues. The company has notified authorities but has not disclosed the nature of the attack.

Ahold DelhaizeCyberattackRansomwareRetailStop & Shop +3 more

Ahold Delhaize Confirms Cyberattack Caused Widespread Outages

Malicious Calendar Invite Phishing Campaigns See Explosive Growth

MEDIUM

Phishing via Malicious Calendar Invites Surges Dramatically

Security researchers are warning of a massive spike in phishing campaigns that abuse calendar invitation features in Microsoft 365 and Google Calendar to steal credentials. One firm noted a surge from a few thousand malicious emails a month in April to over 740,000 in the first two weeks of October 2026. The attacks use .ics calendar files or embedded links to create seemingly legitimate events that direct users to credential harvesting pages, effectively bypassing traditional email security filters.

PhishingSocial EngineeringCredential TheftMicrosoft 365Google Calendar +2 more

Malicious Calendar Invite Phishing Campaigns See Explosive Growth

US Agencies Issue Guidance for "Super Intelligence" AI Incidents

INFORMATIONAL

CISA, NSA, NIST Release AI "Super Intelligence" Security Guidance

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and National Institute of Standards and Technology (NIST) have jointly published new voluntary guidance for the technology industry. The document outlines ten key practices for preparing for and responding to security incidents involving advanced 'super intelligence' (SI) agents that act beyond their intended scope, such as by making unsanctioned network connections or exploiting vulnerabilities.

AI SecuritySuper IntelligenceCISANSANIST +3 more

US Agencies Issue Guidance for "Super Intelligence" AI Incidents

Attacks on US State, Local, and Education Orgs Surge 242%

SonicWall: Attacks on US SLED Sector Up 242%

A new report from SonicWall reveals a massive and disproportionate increase in cyberattacks targeting U.S. state, local, and education (SLED) organizations. Intrusion attempts against the sector grew 242% year-over-year in the first half of 2026, a stark contrast to trends in other industries where attacks are becoming more targeted. The report highlights that budget-constrained IT teams, legacy systems, and inconsistent patch management make the SLED sector a prime target for attackers.

SLEDGovernmentEducationSonicWallCyberattack +3 more

Attacks on US State, Local, and Education Orgs Surge 242%

Ransomware Gangs Exploit PAN-OS Auth Bypass to Infiltrate Networks

CRITICAL

PAN-OS CVE-2026-0257 Exploited by Qilin and Inc Ransomware

Ransomware operators, including the groups known as Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), are actively exploiting a critical authentication bypass vulnerability, CVE-2026-0257, in Palo Alto Networks' PAN-OS software. This flaw in the GlobalProtect feature allows attackers to gain initial access and establish VPN sessions without valid credentials, bypassing multi-factor authentication. Security researchers at Unit 42 have observed advanced post-exploitation TTPs where attackers pivot from the compromised VPN gateway to the vCenter management appliance. From there, they disable security settings on ESXi hypervisors and use custom tooling to perform offline credential dumping against a domain controller's virtual disk (VMDK), a technique that evades typical EDR and in-guest security controls. Organizations are strongly urged to apply patches immediately.

CVE-2026-0257PAN-OSGlobalProtectAuthentication BypassRansomware +6 more

4 min read

Ransomware Gangs Exploit PAN-OS Auth Bypass to Infiltrate Networks

Updated Articles (1)

ConnectWise Disables Cloud Services After Supply Chain Attack on M365

CRITICAL

ConnectWise Suspends Cloud Backup After M365 Tenant Compromise

Update:

ConnectWise has confirmed that its Cloud Backup, SaaS Security, and Cloud Management services remain suspended following the supply chain attack. The company has taken further action by resetting credentials for the compromised multitenant OAuth application. Microsoft Threat Intelligence has also confirmed it is tracking the activity, noting the threat actor likely abused previously granted permissions. Technical analysis now specifies the compromise involved a 'client assertion' within the OAuth 2.0 client credentials flow, allowing attackers to bypass user-level MFA. The incident continues to impact MSPs and their customers, with ongoing efforts to restore operations and mitigate risks.

October 19, 2026

Updated: October 20, 2026