A backdoored Rank Math PRO release leaves WordPress sites needing a full clean-up, an unpatched Broadcom Wi-Fi flaw puts routers at risk from radio range, and F5 ships emergency NGINX patches.
🔴 CRITICAL (1)
Rank Math PRO downloads carried a self-restoring backdoor for 11 hours Confirmed
Rank Math says copies of its PRO plugin downloaded from rankmath.com, or delivered as automatic updates, between 20:02 UTC on 15 October and 07:12 UTC on 16 October contained malware. The backdoor contacts rank1cdn[.]com and recreates hidden admin access whenever an infected site is visited, and any server that activated version 3.0.123 may have exposed database credentials and API keys. A clean build, 3.0.124, is available: sites that installed the bad build should be treated as compromised, cleaned using the vendor advisory and have credentials rotated. The free plugin distributed through WordPress.org was not affected.
🟠 HIGH (3)
Unpatched Broadcom WPS flaw lets nearby attackers run code as root on routers Confirmed
Researcher Quentin Kaiser disclosed a 16-year-old flaw in Broadcom’s WPS implementation that lets an attacker within Wi-Fi range run code as root without the network password or a pairing step. He demonstrated the attack on home gateways from three Belgian ISPs and estimates about 1.5 million routers in Belgium alone are exposed, with Movistar, Cisco, TP-Link and Netgear hardware among affected models. No CVE has been assigned and no broad firmware fix is available, so owners should check with their provider, because disabling WPS may not remove the flaw.
Sources The Hacker News|Quentin Kaiser|Cybernews
F5 issues out-of-band patches for three critical NGINX flaws Confirmed
F5 released emergency fixes for CVE-2026-15176 and CVE-2026-97205 in the HTTP/3 module and CVE-2026-93479 in the map directive, which can crash worker processes or allow code execution when ASLR is disabled. NGINX Plus, Open Source, Ingress Controller, Gateway Fabric and Instance Manager are affected, and exploitation has not been reported. Administrators who cannot patch immediately can avoid the alias directive and the $request_filename variable, disable asynchronous file I/O, or switch to named regex captures.
Sources BleepingComputer
Microsoft says a high severity .NET and Visual Studio RCE is still unfixed Confirmed
Microsoft’s update guide for CVE-2026-70197 states that the remote code execution flaw has not been addressed and that a complete mitigation is still being prepared. The issue covers .NET 8.0, 9.0, 10.0 and 11.0 plus Visual Studio 2022 17.14 and Visual Studio 2026 18.10, and Microsoft rates it high severity. No exploitation has been reported, but teams running self-hosted .NET workloads should not assume the October updates closed it.
Sources MSRC|GitHub Advisory
🟡 MEDIUM (6)
Nikkei discloses a third breach in a month, with 1.83 million records in scope Confirmed
Nikkei Inc. said attackers used stolen credentials to reach a development system on 7 October and exposed 1.83 million records held in the cloud, the third breach it has disclosed in about a month. About 150,000 records included names, addresses, phone numbers or dates of birth, and 120,000 contained email addresses, while the rest held no identifiers and no card data was involved. The company revoked the credentials, notified the regulator on 11 October and says it has seen no misuse or leak of the data.
Sources BleepingComputer
Bullhorn takes its staffing platform offline to contain a cyberattack Under investigation
Bullhorn disabled access to its recruitment platform after a system-wide outage that began with job posting failures on Friday and was later confirmed as a cyber incident. The company, which serves more than 10,000 staffing firms, says it has isolated the activity and is restoring services with CrowdStrike’s help. A forensic review has not yet established whether customer data was stolen.
Sources BleepingComputer
Siemens Software Center DLL flaw exploited in ClickFix malware campaigns Confirmed
Siemens says attackers abused CVE-2026-110936, a DLL search path flaw rated 8.4, by shipping a genuine signed copy of Software Center 3.5.8.7 alongside malicious DLLs that load when the program starts. The lures used ClickFix style prompts to get users to run the package, and version 4.0.9.8 fixes the flaw and updates automatically on launch. Siemens says its own systems and distribution channels were not breached.
Sources SecurityWeek
GhostAction campaign moves to phishing developers with a stealer hidden in a font file Confirmed
The group behind the GhostAction supply chain attack has moved from injecting malicious GitHub Actions workflows to phishing open source developers and delivering a credential stealer disguised as a font file. OpenSourceMalware counted the activity across 94 repositories. Maintainers should review recent workflow changes and commits, and rotate tokens and secrets that were reachable from affected projects.
Sources The Hacker News
Fake Web3 accelerator pushes stealers through npm packages aimed at AI developers
Elastic reported a fake Web3 accelerator that lures developers with offers of free Claude and Gemini credits, coding tools and security audits, then delivers information stealers and backdoors for Windows and macOS through npm packages. The packages also intercept traffic from AI agents. Developers should treat unsolicited accelerator invitations and any package installed from them as hostile, and review npm install scripts.
Sources The Hacker News
ConnectWise suspends Cloud Backup as attacker access widens to about 173 organisations Under investigation
ConnectWise has disabled seven application identities and suspended Cloud Backup while it investigates attackers who used compromised application credentials to sign in to Microsoft 365 tenants. Check Point counted unauthorised access to at least 173 organisations, with email, files and Teams data potentially exposed before access was cut. ConnectWise says customer impact is still unconfirmed, and MSPs should review Microsoft 365 sign-in logs and enterprise application consents.
⚪ WATCH (4)
MITRE ATT&CK v20 adds AI abuse, MFA bypass and water utility techniques
Version 20 of MITRE ATT&CK adds techniques for abusing AI systems, bypassing multi-factor authentication and attacking water utilities, alongside 15 new detection strategies split between Enterprise and ICS. The release includes 38 analytics that defenders can map to their own telemetry. It is a planning resource rather than an incident report.
Sources SecurityWeek
OnlyFans copyright takedowns expose compromised university and government sites
UpGuard found that copyright removal requests tied to OnlyFans and other adult creators are surfacing university and government websites that have been compromised for search manipulation. Attackers inject links and content into vulnerable sites to borrow their reputation, and the takedown notices reveal the victims. Site owners should check for injected pages and unexpected outbound links.
Sources DarkReading
Blockaid: 287 million dollars in stolen crypto sits in wallets that cannot be frozen
Blockaid reviewed 60 on-chain exploits from January to August 2026 that took 1.18 billion dollars and found 287.1 million dollars still held in wallets that can be watched but not frozen. Only 9.8 million dollars, 0.8 percent, had been returned to victims by 2 September, and attackers moved funds a median 17 minutes after a hack. The firm says protocol level controls arranged before an incident produced most successful freezes.
Sources Unchained
Microsoft: October Windows Server updates break Exchange sign-in and mail flow
Microsoft confirmed that this month’s Windows Server security updates cause Outlook Web sign-in failures and mail delivery problems on some Exchange Server systems. Administrators should check the known issues list before rolling the updates out widely and apply the vendor workaround where mail flow is affected. No exploitation is involved; this is an update quality problem.
Sources BleepingComputer
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.