Security news from the BlueTeamSec community for Wednesday the 21st of October 2026. A busy one today, with twelve stories to get through.
CISA have added three vulnerabilities to the Known Exploited catalogue. Two are in Plex Media Server â one allowing unauthenticated remote attackers to invoke arbitrary plugin functions, the other a server-side request forgery flaw. Together they're being chained in the wild for full remote code execution, deploying crypto miners and Linux backdoors. Patching to version 1.43.3.10861 is urgent, or block public access to port 32400 until you can.
The third is a command injection vulnerability in EG Secure Solutions' SiteGuard Server Edition, a web application firewall. Unauthenticated attackers can execute arbitrary commands with root or SYSTEM privileges on internet-facing instances. Patch to version 8.00 Update 5 or disable the statistics feature as a workaround. JPCERT flagged this one a few days ago â active exploitation is confirmed.
VULONE have documented a China-linked threat actor using AI agents powered by large language models to conduct cyber-espionage against governments across Asia. The campaign targeted defence ministries, intelligence agencies, and critical infrastructure in Vietnam, Taiwan, Indonesia, and India, and represents a significant evolution in how threat actors are scaling sophisticated attacks. We've seen a couple of related stories on Chinese state-linked activity over the last few days â this one adds automation to the mix.
Nextron Systems have written up an APT28 spearphishing campaign from July targeting Russian-speaking organisations. The attack used malicious Office documents to deploy Covenant Grunt backdoor with Dropbox as command and control infrastructure. Macro obfuscation was good enough to evade signature-based detection, which is worth noting if you're still relying heavily on static signatures.
The Citizen Lab have documented systematic targeting of Serbian pro-democracy activists, academics, and public officials using NSO Group's Pegasus spyware throughout 2026. Zero-click exploits were used to compromise devices without any user interaction, with attacks timed around the March local elections. Targets included the University of Belgrade Rector, a public prosecutor, student protesters, and opposition members. There's been a bit of movement on the NSO front recently â WhatsApp had a contempt motion denied a couple of days ago in their ongoing litigation.
Eric Priezkalns reports that criminals are impersonating the USTelecom Industry Traceback Group to compromise telecommunications companies. The attackers are sending fraudulent emails requesting urgent cooperation with traceback investigations to more than eleven thousand entities listed in the FCC's Robocall Mitigation Database. One for telco security teams to flag internally.
OVHcloud disclosed that an attacker compromised a GitHub account with write access to the ovhcloud-cli repository on the 19th of October, replacing binary release assets for versions 0.13.0 through 0.15.0 with secret-stealing malware. The attack exploited disabled release immutability settings to overwrite files without triggering CI/CD alerts, and was detected within thirty minutes via a user's checksum verification failure. Worth a look if you manage open-source releases on GitHub.
Booz Allen Hamilton conducted controlled experiments demonstrating that frontier super intelligence AI models can autonomously execute cyberattacks against operational technology and industrial control environments. The models successfully completed eight attack scenarios including perimeter compromise, network infiltration, and physical equipment manipulation, achieving initial breach to industrial control network access in approximately sixteen minutes. No prior access to proprietary documentation or specialised guidance was required.
NorForge have identified Cairn, an autonomous AI-powered cyberattack platform that automates the complete attack lifecycle from reconnaissance to exploitation. Operators define target origins and end goals, then the system orchestrates agents to autonomously conduct operations including vulnerability identification and exploit execution. Another data point in the ongoing conversation about where AI-driven offensive capabilities are heading.
Lennart Maschmeyer from Georgia Institute of Technology presents a theoretical framework arguing that AI automation increases efficiency but not strategic effectiveness of cyberattacks, particularly at interstate level. The analysis concludes defenders gain structural advantage from AI's pattern recognition capabilities, while offensive operations remain constrained by requirements for stealth, deception, and human control that resist automation. Useful background if you're thinking through where AI tilts the balance.
And finally, a brief mention of JP Incident Monitor, an automated incident aggregation project for Japanese cybersecurity incidents. The landing page was attempting to load incident data but contained no specific reports at the time of review â appears to be a work in progress or experiencing technical issues.
That's your briefing for today. The articles are the work of their original authors â the analysis here was automated. We'll be back tomorrow.