Arch Linux community members raised the alarm on the aur-general mailing list on 13 October 2026, in a thread titled 'hundreds of aur packages were mass uploaded with malware'. A user named marchos1as had uploaded packages to the Arch User Repository (AUR) under typosquatted names of yay and paru, the two most popular AUR helper tools. The AUR is the community-run index of build scripts (PKGBUILDs) used on Arch Linux and Arch-based distributions. AUR maintainer Andreas Reichel's analysis of one package, 'yyay', found it reused the legitimate yay upstream URL and source tarball but shipped a malicious install scriptlet. Outside any function, so it ran unconditionally as root on every install and upgrade, the scriptlet piped a script fetched through an unpinned Wayback Machine URL into a shell. That URL pointed to a personal repository, hellscripter/install-scripts, on the Russian code host GitFlic. The post_install and post_upgrade functions were emptied to look harmless. Maintainer Emiliano Gandini Outeda flagged further packages with his open-source TrustSight scanner. The AUR team banned the account and removed the packages. The exact number of malicious uploads has not been published. BleepingComputer notes a possible link to the 'DirtyBlanket' npm campaign documented by SafeDep. OSV advisory MAL-2026-17242 says nine npm packages published on 29 September (including express-javascript) fetched a second stage from a hellscripter/install-scripts repository on Codeberg via the Wayback Machine. On Linux that stage runs linux.sh, a worm that installs a Go binary as a 'Font Rendering Service' systemd service (systemd-fontd) proxied over Tor, collects SSH private keys and known_hosts, and spreads to known hosts over SSH. BleepingComputer says the worm deployed the CHAOS RAT and injected a loader into AUR packages, but there is no confirmation the two operations are related. The AUR was also hit in June (about 400 packages carrying credential-stealing malware with rootkit features) and July, when Arch temporarily disabled package adoption. (sources: aur-general mailing list; BleepingComputer) Updated 15 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 15 October 2026; details credited to BleepingComputer on this card come from that report.
aur-general (Arch Linux) — Re: hundreds of aur packages were mass uploaded with malware (13–14 Oct 2026)
CISA published ICS advisory ICSA-26-286-01 on 13 October 2026 for Inductive Automation's Ignition, the SCADA/HMI and industrial application platform. CVE-2026-92817 (CWE-266, incorrect privilege assignment) is in the Perspective module, which does not properly validate session privileges when it decides whether a user has Designer-level access. An authenticated user with access to a Vision project can present their valid Vision session identifier and be granted Designer privileges, then use them to execute arbitrary code in the context of the Ignition Gateway process. Affected: Ignition 8.1.0 through 8.1.54 and 8.3.0 through 8.3.8. CISA scores it CVSS v3.1 8.8 and CVSS v4.0 8.7 and lists Critical Manufacturing, Energy and Information Technology as the sectors where Ignition is deployed. Per CISA, Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to fix the issue, and recommends updating to the newest version available. The flaw was reported to Inductive Automation by Tim Hemingway. CISA says no known public exploitation specifically targeting this vulnerability has been reported to it. Because the Gateway runs the plant-facing projects, code execution there can reach connected OT systems, so treat Vision project access as a privileged right until patched. (sources: CISA ICSA-26-286-01; Inductive Automation Trust Center bulletin; CVE record)
CISA — ICSA-26-286-01: Inductive Automation Ignition Software (13 Oct 2026)
Adobe published security bulletin APSB26-152 for Adobe Experience Manager (AEM), with CVE records released on 13 October 2026, its October Patch Tuesday. CVE-2026-48382 and CVE-2026-48383 are incorrect-authorisation flaws (CWE-863) that Adobe says could result in arbitrary code execution, potentially giving the attacker elevated access or control over a victim's account or session. Adobe scores both 10.0 (CVSS 3.1: network, low complexity, no privileges, no user interaction, scope changed). Affected releases are AEM as a Cloud Service up to 2026.9.28187, AEM 6.5 LTS up to SP3, and AEM 6.5 up to 6.5.25. Fixes are AEM as a Cloud Service 2026.9.28386 and a hotfix for GRANITE-72352 on 6.5 LTS SP1 to SP3 and on AEM 6.5.20 to 6.5.25. Details come from Adobe's own CVE records. No exploitation has been reported. This is separate from the September AEM Forms bulletin (APSB26-151) on Cyberstack. Adobe also released ColdFusion bulletin APSB26-144 the same day, with 31 CVEs including three CVSS 10.0 flaws that need no login; it has its own card: /n/adobe-coldfusion-apsb26-144-cvss10-105899-20261013.
Adobe — APSB26-152 Security update available for Adobe Experience Manager (Oct 2026)
The US Department of Justice and Meta announced on 13 October 2026 the results of a 'Joint Disruption Week' against scam networks operating from West Africa, the first coordinated operation focused on the region. The UK National Crime Agency hosted it in London from 6 October with the DOJ, FBI, US Secret Service, Treasury, Homeland Security Investigations, Nigerian and Ghanaian cybercrime units, INTERPOL, and law enforcement from Australia, Canada, New Zealand and India. Industry partners including Meta, Google, Microsoft, OpenAI, Coinbase, Binance, Adobe, Starlink, Chainalysis, Elliptic, TRM Labs, Flashpoint, Silent Push and Cyjax shared intelligence and acted on their own platforms. Meta removed more than 3.7 million Facebook and Instagram accounts, Pages and Groups based in West Africa, most posing as American and British users; Microsoft suspended linked accounts; partners shared leads on more than 30 suspected scam centres and identified over US$11 million in potentially freezable funds, and Coinbase says it stopped more than US$415,000 in losses to 65-plus active victims. Authorities made 28 arrests: in Sasaabi near Accra, Ghana, 19 people were arrested, 303 devices seized, 117 human-trafficking victims identified for repatriation to Nigeria and 89 scam victims with about US$8.3 million in losses found; Nigeria made nine arrests and seized 53 devices. The schemes included law-enforcement impersonation, 'digital arrest' extortion and cryptocurrency investment fraud (pig butchering). Neither announcement names Australian victims. Updated 14 Oct 2026 (Cybersecurity News): Cybersecurity News's report is dated 14 October 2026; details credited to Cybersecurity News on this card come from that report.
US Department of Justice — Results of law enforcement and private industry Joint Disruption Week targeting West African scam networks (13 Oct 2026)
Huntress reported on 13 October 2026 (14 Oct Perth) a credential-phishing campaign built on a lookalike download site for WatchGuard Mobile VPN with SSL. In an incident it investigated in early October, an administrator at a managed service provider searched Bing for a WatchGuard SSL VPN download and opened the fake site from a normal search result, which Huntress classes as SEO poisoning rather than malvertising. Choosing any download option opened a prompt asking for VPN server, login and password; about 150 lines of JavaScript sent the values as JSON to a separate collection server, always rejected the first attempt as 'Incorrect data' to collect a second set, then started a download of the genuine, validly signed WatchGuard Mobile VPN with SSL 12.11.5 installer from WatchGuard's own CDN, so there was no malicious file for endpoint security to flag. The same lookalike domain had been reported by WatchGuard in January with no working back end; it was registered again on 22 August and paired with a new collection domain. Huntress says the main domain was offline as of 13 October and that it notified WatchGuard before publishing. Earlier waves of the same VPN-impersonation activity (including Microsoft's Storm-2561 reporting) used fake signed installers and malicious DLLs instead. This is a phishing campaign against VPN users, not a flaw in WatchGuard products.
Huntress — Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client (13 Oct 2026)
Security researcher wunderwussi (Embrace The Red) published on 13 October 2026 that Microsoft patched CVE-2026-103572, an Important-severity remote code execution issue in the shared Microsoft.VisualStudio.Copilot.Core.dll used by GitHub Copilot in Visual Studio (including Visual Studio 2026 and older Visual Studio 2022 trains) and SQL Server Management Studio. A path-validation check that was meant to block writes to sensitive Copilot settings and MCP configuration files could be bypassed by appending a trailing ASCII period to the filename: Win32 APIs strip the final dot, so a write to settings.json. or .mcp.json. lands on the protected file. That lets the agent escape containment and run arbitrary commands; the report also shows a third party can drive the same outcome through indirect prompt injection. Microsoft classified the issue as Important RCE and shipped the fix with the 13 October updates. Operators who enable Copilot inside Visual Studio or SSMS should apply the October Visual Studio / SSMS Copilot updates promptly and treat untrusted repo content as able to steer agent file writes until patched.
Embrace The Red — Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572, 13 Oct 2026)
On 13 October 2026 security firm XBOW published how it chained three then-unknown Google Chrome bugs into one attack that runs code on a Windows machine when a user only loads a web page, crossing both of Chrome's nested sandboxes. Researcher Brendan Dolan-Gavitt built the awarded chain between 2 and 7 August 2026 by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model; XBOW puts the AI cost at about US$40,000 and says its first full chain earlier in the year took two months. The agents searched Chrome source, tested ideas, built working exploit pieces and drafted the exploit, while people chose targets, supplied context and decided which pieces to join. The stages were a V8 JavaScript-engine bug (CVE-2026-85045, fixed in 152.0.7977.82 on 3 Sep), an animated-WebP decoder bug used to escape the inner sandbox (no public identifier confirmed, fixed in the Chrome 152 cycle), and a Crashpad crash-handler bug (CVE-2026-78952, fixed in 152.0.7977.65 on 25 Aug). Google confirmed and fixed all three and paid US$250,000, its maximum full-chain reward under the 2026 Chrome VRP rules; XBOW says the bugs were never used against users. The point for defenders is speed: AI help cut the time to a browser full chain from months to days. Updated 14 Oct 2026 (The Hacker News): The Hacker News's report is dated 14 October 2026; details credited to The Hacker News on this card come from that report.
XBOW — XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days (13 Oct 2026)
Rockwell Automation published security advisory SD1801 on 13 October 2026 for the 1732E ArmorBlock I/O, an on-machine EtherNet/IP distributed I/O module with a built-in configuration web server. CVE-2026-12655 (CWE-294, authentication bypass by capture-replay) lets an unauthenticated attacker change the device's web server password without valid credentials, which can mean admin account takeover or unauthorised configuration changes. CVE-2026-12656 is a denial-of-service issue: network storm traffic can interrupt communication, fault the device and affect open TCP and UDP ports, and a power cycle is needed to recover. Rockwell lists both as corrected with no workaround and not on the CISA KEV list; the advisory's overall severity is High. No exploitation is reported.
Schneider Electric published security notification SEVD-2026-286-01 on 13 October 2026 for its Pro-face STW6000 and Harmony STW6 basic web HMI panels (Harmony ST6 / Pro-face ST6000 range). CVE-2026-96434 is CWE-1104 (use of unmaintained third-party components): Schneider says failure to apply the listed mitigations may allow various attack scenarios from third-party component obsolescence, including unauthorised control of the device and operational failures, when a user visits malicious web pages for browsing. CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); CVSS 4.0 base is 8.6. All versions of both products are listed as known affected. The advisory does not publish a fixed firmware build for this CVE; remediations are mitigations — run the HMI only in a protected environment, minimise network exposure and keep panels off the internet, plus Schneider's standard ICS hygiene guidance. A second same-day notice, SEVD-2026-286-02, covers SAGE RTU CVE-2026-102250 (CVSS 7.2, privileges required high) with a firmware fix in C3414-500-S02L0. No exploitation is stated. (source: Schneider Electric SEVD-2026-286-01 CSAF/JSON) The CVE record for CVE-2026-96434 is not yet published on cve.org; this card rests on Schneider Electric's advisory SEVD-2026-286-01.
Schneider Electric — Security notifications (SEVD-2026-286-01, 13 Oct 2026)
Microsoft opened a Windows release health known issue on 13 October 2026 (09:43 PT; 14 October Perth time): after the September 2026 non-security preview update KB5124010 or later updates, non-admin users might be unable to connect over Remote Desktop to devices that have Administrator protection enabled. Connections fail with error 0xC000000D and the message 'The token that was passed to the function is invalid.' It mainly hits enterprise-managed Remote Desktop hosts, however the feature was enabled. Administrator protection gives signed-in users standard rights and asks for Windows Hello to elevate; Microsoft notes it is enabled by default in the Windows 11 24H2, 25H2 and 26H2 security baselines from the Security Compliance Toolkit, and BleepingComputer reports it now lands by default in organisations using those baselines after the October 2026 security update. Affected: Windows 11 24H2, 25H2, 26H1 and 26H2 clients; no server versions. Microsoft lists the issue as mitigated by a workaround and is working on a fix. This is a reliability problem, not a vulnerability. (source: Microsoft Windows release health) Updated 14 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 14 October 2026; details credited to BleepingComputer on this card come from that report.
Microsoft Windows release health — Remote Desktop connections might fail for non-admin users with error 0xC000000D (opened 13 Oct 2026)
US authorities announced a new crackdown on North Korean remote IT worker schemes on 13 and 14 October 2026. A four-count indictment charges Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, who were arrested, with helping North Korean IT workers obtain remote jobs by housing and configuring laptops issued by US employers so the workers appeared to be in the US. Prosecutors say the scheme ran from 2019 to July 2025, generated more than US$3 million and placed workers at over 70 US companies in communications, cyber support, healthcare, manufacturing and retail; ten China-based people are also charged. Separately, in Operation Lonestar Roundup, the FBI searched over 40 residences in Texas between 21 and 25 September that were known or suspected laptop farms, and seized approximately 187 laptops and KVM devices, according to the Justice Department. CrowdStrike, which tracks the activity as Famous Chollima and assisted the operation, says victims of the disrupted clusters span aerospace, energy, financial services, healthcare, cybersecurity, defence engineering, government technology and consumer technology, and expects the disruption to be short-lived. The FBI's new public service announcement (PSA261013) warns the workers increasingly pay witting and unwitting US residents to appear on camera, sit interviews, verify identities, ship packages or keep company devices online from home, and recommends layered identity checks across the employment lifecycle. No Australian victims are named. (sources: FBI IC3 PSA; US Justice Department release)
FBI IC3 — North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment (PSA261013, 13 Oct 2026)
Doyensec published Playing It SFAPE on 13 October 2026 describing a local elevation-of-privilege chain against the Windows Virtualization-Based Security (VBS) enclave behind Microsoft Defender SmartScreen Enhanced Phishing Protection (SFAPE.dll). The enclave stores a hashed form of the Windows sign-in password so SmartScreen can warn when that password is typed or pasted into an unsafe place; it runs in Isolated User Mode (VTL1), which ordinary kernel code in VTL0 cannot read. Researchers showed that calling the enclave's Initialize function a second time writes a fixed four-byte error value to a caller-controlled address (skipping an address check used on the first call), then combined that with a timing bug to run attacker-chosen code inside the enclave. Microsoft rates CVE-2026-83498 Critical, CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), impact elevation of privilege / untrusted pointer dereference (CWE-822), and says successful exploitation could leak data from the enclave or execute code in its context. The attack is local (needs a process that already loads and calls the enclave, typically LSASS for SFAPE), was not publicly known or exploited before the fix, and Microsoft also found the issue internally. The fix shipped in the 8 September 2026 cumulative update (Doyensec cites KB5124008 for Windows 11 24H2/25H2; MSRC lists updates across Windows 11 23H2–26H1 and Windows Server 2025) and includes a policy that blocks loading the old vulnerable SFAPE.dll. Doyensec notes Windows still lacks a general vulnerable-enclave blocklist, and an older signed Edge enclave (CVE-2023-36880) remains loadable. (sources: The Hacker News; Doyensec research post; Microsoft MSRC advisory) Updated 14 Oct 2026 (The Hacker News): The Hacker News's report is dated 14 October 2026; details credited to The Hacker News on this card come from that report.
Doyensec — Playing It SFAPE: Code Execution in Isolated User Mode (13 Oct 2026)
