Pillar Security said on 19 October 2026 that it found a critical remote code execution flaw in opencode, Anomaly's open-source AI coding agent, affecting Windows and Windows Subsystem for Linux (WSL): an attacker-controlled remote Model Context Protocol (MCP) server can execute arbitrary code on a developer's machine during a remote MCP OAuth authentication process, without additional user interaction or consent. Pillar says the MCP server supplies the OAuth authorization_endpoint, which opencode passed to the open package (open@10.1.2); on Windows that package builds a PowerShell command without escaping the target, so a PowerShell subexpression carried inside an ordinary https:// URL runs. Pillar says the server did not need to be malicious when configured: a later compromise, hijacked registry entry, typosquat or expired domain could trigger the same path. Pillar lists opencode (opencode-ai on npm) versions 1.0.137 to 1.18.32 on Windows and WSL as affected and says macOS and Linux are not affected; it says the fix shipped in 1.18.33, which GitHub shows was released on 28 September 2026. Pillar says the fix (pull request #51414, merged 25 September) bumped open to 11.0.4 and added http/https scheme checks, but that scheme validation alone would not have stopped its payload and the dependency bump is what closed the hole. Pillar says Anomaly did not issue a security advisory or request a CVE, shipped the fix as a refactor, and told Pillar that malicious MCP servers are outside its threat model; opencode's GitHub security policy says external MCP servers a user configures are outside its trust boundary. Pillar rates the flaw critical with a proposed CVSS 3.1 score of 9.8, and notes that without a CVE, vulnerability scanners and dependency alerts will not flag affected installs. (sources: Pillar Security; opencode v1.18.33 release on GitHub) Updated 22 Oct 2026: The Hacker News reported the flaw, noting that the browser step runs only when a developer starts the sign-in, for example by running opencode mcp auth. (source: The Hacker News)
Pillar Security — Open and Shut: Remote Code Execution in opencode via MCP OAuth (19 Oct 2026)
Developer hosting and deployment platform Zeabur published a preliminary report on 19 October 2026 on a second breach in two months. It says that on 14–15 October an attacker used leaked Zeabur internal credentials (AWS keys and shared-cluster admin tokens stored in plaintext in a private configuration repository, with no expiry and never rotated since January 2024) to break into its shared clusters in nine regions, some customer Dedicated Servers and internal systems, and eventually read the platform database. Zeabur says the root cause was its own: long-lived admin credentials stored in plaintext and usable from the public internet, which its rotation after the late-August breach did not cover. Confirmed exposure includes 3,218,965 service environment-variable records (names and values), account, project and service data for 321,810 accounts, and 566 plaintext zSend API keys (revoked). The attacker ran commands inside 865 customer database services, including n8n instances whose encryption keys sat in environment variables (602 of 607 checked), so their stored third-party credentials were effectively exposed, and planted a program that called back to an external host in at least two PostgreSQL databases in Tokyo. The attacker signed in as root to 101 customer servers on Google Cloud using root passwords stored in plaintext in server initialisation settings, added their own SSH keys on 50 of them, and attached 16 copies of customer disks to five virtual machines they created. They also read about 53 production secrets, including the Zeabur GitHub App private key (rotated; no use found), and tokens for managing customer servers at Hetzner and DigitalOcean leaked with the database (revoked 16 Oct). Database backups in the Taipei and Hong Kong regions may have been downloaded. More than 16 hours of activity on 14 October raised no alerts; Zeabur learned of it from a user report. Zeabur has signed out all users, revoked all platform access tokens and leaked keys, and blocked public SSH to admin interfaces. On 17 October founder Yuanlin Lin announced the platform will wind down: new purchases have stopped, shared-cluster services pause and server renewals stop from 1 December, and everything shuts down by 31 December 2026. No country breakdown of affected users has been published. (sources: Zeabur preliminary report; BleepingComputer) Updated 20 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 20 October 2026; details credited to BleepingComputer on this card come from that report.
Zeabur — October 2026 security incident (preliminary report, 19 Oct 2026)
Data-deletion software firm Redact published research on 19 October 2026 showing that WhatsApp's help-centre pages carried hidden text, never shown on screen, written as instructions for the WhatsApp Support with AI chatbot. On the delete-account page, the hidden text told the chatbot not to recommend contacting any data protection authority or regulator, not to suggest WhatsApp could delete an account manually, and not to suggest using another phone with an active number, even though WhatsApp's European privacy policy says users can complain to the Irish Data Protection Commission or another supervisory authority. A block on the reporting and blocking page told the chatbot that once a user mentions legal action, lawyers or courts, it must not cite WhatsApp's terms or privacy policy, discuss liability, or reference data protection laws such as GDPR, LGPD or CCPA, even when the user raises them. Redact checked all 545 linked help pages and counted 102 hidden blocks on 80 of them, most of them routine; it found none on 300 Facebook and Instagram help pages. The blocks were in the page HTML (HelpContentGalaxyLLMInclude) and were served to Google and Bing crawlers. Internet Archive copies date the delete-account text to between 12 July and 4 September. All 102 blocks were gone by 02:08 UTC on 18 October, after WIRED contacted Meta; WhatsApp told WIRED they were chatbot instructions that showed up on the pages because of a bug. Redact read the instructions, not the chatbot's answers, so it is not known whether the chatbot followed them or still does. (sources: Redact; WIRED)
Redact — WhatsApp help pages carried hidden AI chatbot instructions (19 Oct 2026)
Chukwuemeka Victor Amachukwu, 40, was sentenced in the US District Court for the Southern District of New York to eight years in prison, US Attorney Jamie McDonald announced on 19 October 2026, according to BleepingComputer's report of the press release. He had pleaded guilty to conspiracy to commit computer intrusions and wire fraud after extradition from France in August 2025. With co-defendant Kingsley Uchelue Utulu and other co-conspirators, he sent spearphishing emails to tax-preparation businesses in New York, Texas and other states between 2019 and 2021, got into their computers and took tax and personal data on at least 800 of their clients. The group used it to file for about US$8.4 million in refunds with the IRS and state tax agencies, receiving about US$2.5 million, and obtained about US$819,000 through fraudulent Economic Injury Disaster Loan applications. He was also involved in a fake investment scheme that took more than US$7 million. The court ordered US$3.6 million in restitution and forfeiture of nearly US$11 million. (sources: BleepingComputer; US Attorney's Office SDNY)
US Attorney's Office SDNY — Nigerian man sentenced to eight years for hacking, fraud and identity theft schemes (19 Oct 2026)
OVHcloud founder Octave Klaba disclosed on 19 October 2026 that an attacker used a compromised contributor's GitHub account to tamper with the releases of the company's open-source command-line tool (ovhcloud-cli), which admins and developers use to manage OVHcloud services. The attacker replaced the macOS (x86_64 and arm64), Linux (x86_64 and arm64) and Windows x86_64 archives, plus checksums.txt so the hashes matched, on existing releases v0.11.0 through v0.15.0; v0.10.0 and the new v0.16.0 are clean. The swapped files were live from 12:47 to 14:21 UTC (14:47 to 16:21 Paris; 20:47 to 22:21 Perth) until a customer whose CI pins the archive hash noticed the mismatch and filed a public GitHub issue. Exposure is limited to people who, in that window, ran the official install script (which checks no hash), downloaded a release archive, ran an unpinned CI download, or ran the CLI's own upgrade command; Homebrew (pinned hashes), go install, source builds and the Docker image were not affected, and copies installed before the window are original. Klaba says the build was poor quality but built to pull secrets off the disk, the source code, tags and CI/CD pipelines were not touched, and the root cause was that GitHub release immutability was not enabled, so a privileged account could re-upload release files; OVHcloud has now enabled it and promised a postmortem. OpenSourceMalware links the contributor account, compromised since at least March, to the GlassWorm campaign through a Solana-memo loader, which it calls an inference; no copy of the swapped binary has been analysed publicly. The OVHcloud CLI stores API credentials in ~/.ovh.conf. (sources: Octave Klaba on X; BleepingComputer; The Hacker News) Updated 20 Oct 2026 (The Hacker News): The Hacker News's report is dated 20 October 2026; details credited to The Hacker News on this card come from that report. Updated 20 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 20 October 2026; details credited to BleepingComputer on this card come from that report.
Octave Klaba (OVHcloud founder) on X — OVHcloud CLI repository compromised; v0.11.0 to v0.15.0 affected (19 Oct 2026); follow-up: x.com/olesovhcom/status/2112280116017471626
Sophos X-Ops Incident Response published a case study on 19 October 2026 of an intrusion at an unnamed organisation. Several staff got calls from someone posing as the help desk; one user read out the SMS code for a self-service password reset (SSPR), letting the attacker reset the password, register a new Windows device in Entra ID and use a Primary Refresh Token for a durable session. From there the attacker ran Microsoft Graph reconnaissance (licences, organisation, tenant relationships, directory roles, service principals, domains, users), opened more than 100 mail items across the user's and shared mailboxes, searched SharePoint for terms such as password, cred, AWS, VPN, SSH, SSN and the organisation's own identity-verification vendor, downloaded about 100,000 SharePoint files, and launched Teams. Federated SAML sign-ins, with MFA shown as previously satisfied, took the attacker into Salesforce, where automated anomaly detection froze the account, and ServiceNow, where the sys_user table (about 2,500 records of names, emails, phones, roles and managers, depending on configuration) was exported as CSV and the CMDB computer list was browsed. The attacker created no inbox rules but deleted the organisation's own vishing warning email from the user's mailbox. Sophos compares the pattern to ShinyHunters-linked SaaS extortion activity reported by Mandiant. No ServiceNow or Microsoft vulnerability was involved. (source: Sophos)
Sophos X-Ops — Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion (19 Oct 2026)
Siemens ProductCERT said on 19 October 2026 that it has confirmed active exploitation of CVE-2026-110936, a DLL sideloading flaw in Siemens Software Center (the installer and update manager for Siemens software) that it fixed in version 4.0.9.8 and disclosed in advisory SSA-580366 on 15 October. The app loaded helper DLLs from its own folder without checking them, so attackers shipped a genuine, validly signed copy of version 3.5.8.7 alongside their own archive.dll inside an installer called AllMyBasic.msi; msiexec.exe installs it under AppData\Local\Programs and starts SiemensSoftwareCenter.exe, which loads the attacker DLL. Siemens says the Siemens program itself was not modified and no Siemens system, product or update channel was breached, and it is sharing indicators with EDR vendors and authorities. The victims are lured by ClickFix pages that get them to paste a PowerShell command; Huntress found the bug and The Hacker News ties the campaign to the ROMULUS ClickFix delivery platform (separate card on Cyberstack), with some lures reached through malicious ChatGPT Custom GPTs. The payload is a remote access trojan. Siemens rates the flaw CVSS 3.1 6.7 and CVSS 4.0 8.4 because it needs local access, but in this campaign the attackers bring the vulnerable signed copy with them, so PCs that never had Siemens software are also at risk. Canada's Cyber Centre issued AV26-1063. (source: Siemens ProductCERT) UPDATE (22 Oct 2026): CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog on 20 October 2026, with a 3 November due date for US federal agencies. (source: CISA KEV catalog)
Siemens ProductCERT — Active exploitation of CVE-2026-110936 in Siemens Software Center (19 Oct 2026)
Roundcube published security updates 1.6.20 (1.6 LTS) and 1.7.5 on 19 October 2026 and says it strongly recommends updating all production installations of 1.6.x and 1.7.x. The release notes list about 20 security fixes. The first to get a CVE record, CVE-2026-113386 (published 20 October, CVSS 3.1 score 7.1), lets a logged-in user inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions to run arbitrary IMAP commands; a similar IMAP injection through the _flag parameter of mail/mark is also fixed. Other fixes cover mail header injection in the bounce (resend), forward-as-attachment and reply paths, an XSS in password driver error responses, a CSRF check bypass in mark-as-junk, an SSRF filter bypass using NAT64 addresses, remote-content blocking bypasses via SVG and CSS, unsafe attachment content passed to ImageMagick during image resizing, an object injection primitive in session handling, deprecated action aliases that ignored the disabled_actions setting, and a Modoboa password driver bug that could change another account's password. Roundcube has not said any of these are being exploited, but earlier Roundcube flaws have been exploited in the wild, so patch promptly. (source: Roundcube) UPDATE (22 Oct 2026): MITRE published 19 further CVE records for the fixes in 1.6.20 and 1.7.5 on 22 October (CVE-2026-114714 to CVE-2026-114732), with CVSS 3.1 scores from 3.1 to 8.5; the highest is CVE-2026-114716, a mail header injection (8.5), followed by CVE-2026-114727, unsafe content passed to ImageMagick (8.3). (source: CVE records at cve.org, scored by MITRE)
Roundcube — Security updates 1.6.20 and 1.7.5 released (19 Oct 2026)
The US Department of Homeland Security published notice on 19 October 2026 (filed for public inspection at 8:45 am ET, 8:45 pm Perth; formally published in the Federal Register on 20 October, FR Doc. 2026-21447, docket DHS-2026-0628) of a Federal Acquisition Supply Chain Security Act (FASCSA) order against Chinese AI developer Hangzhou DeepSeek Artificial Intelligence. Exclusion and Removal Order #2026-01 was signed by Homeland Security Secretary Markwayne Mullin with an original release date of 24 July 2026. It applies to federal civilian executive branch agencies; national security systems and sensitive compartmented information systems, which fall to the Defense Department and the Director of National Intelligence, are excluded. Agencies must immediately exclude DeepSeek, its affiliates and their products from procurement, including approved-product lists and e-commerce marketplaces, and must immediately remove products from DeepSeek and its affiliates, and third-party products and services developed using DeepSeek implementations, from their IT systems, or seek an exception. Exception requests must be made in writing to CISA within 60 days with a compelling justification and alternative mitigations. Until removal is complete, agencies are encouraged to monitor traffic in and out, add logging and data-exfiltration controls for the affected systems, and flag unusual activity. The order's risk summary says DeepSeek's servers are in China and Chinese law gives the state wide powers to access company infrastructure; that DeepSeek-hosted services collect personal information and may track and fingerprint users; that prompts can send sensitive government or vendor data to China; that the models may contain malware or security weaknesses; and that independent research found multiple critical vulnerabilities in the DeepSeek iOS app. DHS will review the order within a year and every year after that. In Australia, PSPF Direction 001-2025 (4 February 2025) already requires Australian Government entities to prevent the use or installation of DeepSeek products, applications and web services and remove any existing instances from government systems and devices. (source: Bloomberg)
Federal Register (public inspection) — DHS notice of order: Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch IT Systems and Procurements (FR Doc. 2026-21447; filed 19 Oct 2026, published 20 Oct)
TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin (more than 4 million active installations on WordPress.org) and the UpdraftCentral, UpdraftVault and UpdraftClone services, said on 19 October 2026 that it found unauthorised access to the teamupdraft.com website over the weekend of 17–18 October. The company believes its customer database was accessed. That database holds names, email addresses, billing addresses and order history; account passwords stored as hashes; two-factor authentication settings; and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card details are not stored (payments go through Stripe and PayPal). TeamUpdraft says the UpdraftPlus plugin and its downloads were not affected, backups sent to customers' own remote storage (such as Google Drive, Dropbox or Amazon S3) were not affected, and self-hosted UpdraftCentral is not affected. The main risk is the cloud UpdraftCentral connection keys, which can send commands to connected WordPress sites. In response the company closed the access route and fixed the underlying weakness, signed out every teamupdraft.com account, disconnected every site from UpdraftVault and issued new credentials, replaced every UpdraftClone client key, rotated keys with payment providers and other connected services, added monitoring, and reported the incident to the UK Information Commissioner's Office and other authorities. It released UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium) to automatically disconnect old UpdraftCentral connections so the old keys stop working (this card earlier gave the cutoff as 22:00 BST on 18 October, from an earlier version of TeamUpdraft's page; the page now says 1.26.13 and 2.26.13 disconnect every UpdraftCentral connection made before 13:07 BST on 18 October, 8:07 pm Perth); 1.26.12 was published on WordPress.org on 19 October at 16:46 UTC (12:46 am Perth, 20 October) with the changelog entry 'Revokes UpdraftCentral Cloud keys created before the incident'. TeamUpdraft said on 21 October: 'We know the attacker used a compromised key to access our site', and that 'The attacker exploited the connection to users’ sites to create admin accounts, install malicious plugins etc – the extent of that is unknown'. It has not said how many accounts are affected. No Australian impact has been reported, but Australian agencies, hosts and businesses that manage WordPress sites through cloud UpdraftCentral are in scope. UPDATE (21 Oct; Patchstack, Nethemba, TeamUpdraft): the stolen keys were used. Patchstack (Critical, CVSS 9.8; no CVE, as this is a key compromise rather than a code flaw) says an attacker holding valid UpdraftCentral dashboard keys sent correctly signed plugin.upload_plugin commands to connected sites between 18 October 15:32 UTC and 19 October 09:23 UTC (11:32 pm 18 Oct to 5:23 pm 19 Oct Perth), installing at least 99 differently named backdoor plugins (the name 'Site Health Cache' recurs; every sample carries the description 'Small maintenance toolkit: keeps option storage tidy.'). The backdoor creates an Editor-looking account that also holds manage_options and install_plugins and logs the attacker in by cookie, bypassing the login form and 2FA; the account survives removal of the plugin. Early samples crashed sites with HTTP 500 errors; Nethemba documents a working newer variant and says two of its three targeted sites, running WordPress 7.1.3 and UpdraftPlus 2.26.11, were backdoored. Patchstack notes sites can hold a key without anyone choosing UpdraftCentral, because connecting a TeamUpdraft.com account ticks 'Add this website to UpdraftCentral' by default, and keys do not expire. Published indicators include source addresses 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9, accounts such as data-ops43 and media-staff96 with @example.org emails and display name 'Site Tools', and an option ending in _sync_token. Nethemba found that 1.26.12 / 2.26.12 did not actually remove the old keys because of a bug; UpdraftPlus 1.26.13 (WordPress.org changelog: 'Properly apply the revocation in 1.26.12') and 2.26.13 shipped on 19 October just after 22:00 BST (5:00 am 20 Oct Perth). TeamUpdraft's 20 October 16:25 BST update says the unauthorised access was resolved and 1.26.13 / 2.26.13 block that route, but still asks users to check their sites. With around 10% of UpdraftPlus sites estimated to hold an UpdraftCentral or Migrator key, roughly 400,000 sites may have been exposed (BleepingComputer). UPDATE (23 Oct 2026; TeamUpdraft incident page, last updated 23 Oct 05:26 BST): in its 21 October 10:23 BST update (5:23 pm Perth) TeamUpdraft said it had found that the attacker used a compromised key to access its site, that 'The speed of the exploits following the breach combined with the initially faulty backdoor plugins suggest that the hackers used AI to accelerate their attack', that it had brought in an external cyber security firm, and that it had 'contacted the relevant authorities (including the police)'. At 15:35 BST on 21 October (10:35 pm Perth) it asked UpdraftPlus Premium users to check their websites for signs of unusual activity 'even if you’ve never used UpdraftCentral', and took its support form offline because of the PHP vulnerabilities. At 14:42 BST on 22 October (9:42 pm Perth) it said the support form was back, that 'If a site is listed that you didn’t knowingly connect since the 19th Oct, please check it for signs of compromise', and that it is 'seeing a pattern of unexpected ‘editor’ roles'; it asks users to log in to UpdraftCentral through My Account and check the sites listed there for unexpected users, unrecognised plugins and unknown IP addresses in logs. Correction (24 Oct 2026): an earlier version quoted TeamUpdraft as saying 'Any site listed before this incident has potentially been exposed to the attacker'; that sentence is no longer on its incident page (last updated 23 Oct 05:26 BST), whose 22 Oct 14:42 BST update now asks users to check any listed site they did not knowingly connect since 19 October. (source: TeamUpdraft)
TeamUpdraft — TeamUpdraft security incident: What customers need to know (19 Oct 2026, last updated 23 Oct 05:26 BST)
NorForge researcher Snorre Fagerland published 'Inside Cairn' on 19 October 2026, after scanning Shodan and Censys for AI hacking harnesses whose web panels were left open (searches began after Gambit Security's September report of Strix, Cairn and Hermes being used against online retailers). Cairn is an open-source, state-based 'problem-solving engine': each project has a start point and an end goal, and AI agent workers post facts and intents to a shared blackboard until the goal is met. NorForge found more than 20 exposed Cairn panels it assesses as likely malicious and financially motivated, in three clusters. AIA0001, a Chinese-language actor (high confidence malicious), ran more than 1,100 attack projects across 14 panels, mostly hosted on AS56594 (Cgi Global Limited). Its automated pipeline feeds in real US, Canadian, Japanese and Australian online shops with 200,000 to 1.5 million visits, already checked with Playwright that orders can be placed, and tells the agents to find unauthenticated remote code execution (login SQL injection, unauthenticated endpoints, file uploads, deserialisation, authentication bypass, account takeover) and plant an 'uploader' webshell, aiming at persistent access to e-commerce and payment systems. NorForge's first case study is an Australian e-commerce site where the panel recorded the goal as met; NorForge confirmed a shell giving command execution on its web server, reached through a chain starting with unauthenticated account modification. AIA0002, an English-language crew on about 10 panels mostly on AS20473 (The Constant Company/Vultr), openly tasks agents to steal card data and cryptocurrency and used DeepSeek models through OpenRouter; AIA0003 is a smaller, lower-confidence English-language panel. Successful AIA0001 projects took a little under 23 hours on average, and NorForge estimates a success rate of about 10% across these harnesses. Running Trufflehog over the panel data found hundreds of exposed secrets, 11% verified as valid, and the panels appeared to expose full admin controls; NorForge also found legitimate red-team engagements exposed the same way. NorForge has redacted panel addresses and is working with Reuters to notify victims and with hosts to take panels down. Reuters (19 Oct), which reviewed the attacker's own records, reported (as relayed by The Hacker News and The Verge) that the hacker broke into websites of more than 100 companies, out of more than 1,200 attempted, including Deere, SharkNinja and Cummins: Deere said it took remediation actions and has no indication sensitive information was accessed; SharkNinja said a standalone product-support site was hit and contained; Cummins told The Verge it is investigating a potential attack on a website run by a third-party vendor. Cairn's creator says the platform was never a hacking tool and misuse is a human decision. No Australian victim has been named publicly.
NorForge — Inside Cairn: Open windows into massive AI-driven cyber operations (19 Oct 2026)
Security firm Claroc reported on 18 October 2026 that shared conversations from Meta's Muse personal AI agent (launched 8 September) could be found and opened by people who were never sent the link. Muse publishes a shared chat as a public page under cf.metaaiusercontent.com and builds the hostname from the conversation's title plus a random ID. The first time anyone opens a share, the full hostname is resolved through DNS, and commercial passive-DNS services record it, so the random ID offers no protection once looked up. One passive-DNS query returned more than 6,800 share hostnames, readable by title, and pages opened without an account or sign-in; urlscan.io also held more than 75 saved scans of Muse share pages. Opening a few hundred, Claroc found mostly harmless material but also dozens of personal records and internal business documents, including a job candidate's notes for a confidential executive-search call with a frontier AI lab (naming the internal contact and meeting time), a bank fraud alert with a partial account number, a real-estate investor's internal return and mortgage figures, and a staff leave calendar. Muse's robots.txt keeps search and AI crawlers off share pages, but that does not stop direct access. After Ars Technica contacted Meta, Meta told it on 20 October that it has paused the sharing feature while it reviews the report; Claroc says 40 shares it rechecked that day no longer opened, but the hostnames, titles included, remain in passive-DNS history. (sources: Claroc; Ars Technica) Updated 20 Oct 2026 (Ars Technica): Ars Technica's report is dated 20 October 2026; details credited to Ars Technica on this card come from that report.
Claroc — GhostShares: a shared Muse chat exposed prep for a confidential call with a frontier AI lab leader (18 Oct 2026; updated 20 Oct)
