Daily Cybersecurity Briefing — October 13, 2026

Your daily digest of the most critical cybersecurity developments from the past 24-48 hours. Today's briefing covers actively exploited vulnerabilities, confirmed breaches, threat actor activity, ICS/OT incidents, mobile threats, AI security risks, and more.

ACTIVELY EXPLOITED VULNERABILITIES

• CVE-2026-102255 (CVSS 10.0) — SonicWall SMA 1000: Pre-authentication SSRF flaw. Patches released October 6; active exploitation confirmed October 8. Previdian logged 135 exploitation attempts originating from two U.S. IP addresses. Immediate patching required for FCEB agencies.

• CVE-2026-85097 (CVSS 10.0) — Bricksforge WordPress Plugin (≤3.1.8.9): Unauthenticated remote code execution via arbitrary PHP file upload. Fixed in v3.1.8.10. Exploitation first detected by Patchstack on October 7. All WordPress sites running Bricksforge should update immediately.

• CVE-2026-88779 — Citrix NetScaler: Out-of-bounds memory buffer operations. Added to CISA Known Exploited Vulnerabilities (KEV) catalog. CVSS score not yet published. Patching urgently recommended.

• CVE-2026-102489 — Zammad (Zammad GmbH): Session fixation vulnerability. Added to CISA KEV catalog this week.

• CVE-2026-102490 — Zammad (Zammad GmbH): Improper privilege management. Added to CISA KEV catalog this week alongside CVE-2026-102489.

• CVE-2026-48558 — SimpleHelp RMM (≤5.5.15): Authentication bypass when OIDC is enabled allows unauthenticated forging of identity tokens to obtain fully authenticated technician sessions, bypassing MFA in some configurations. Actively exploited to deploy credential stealers targeting cloud and AI API keys.

BR3ACHES

• iRhythm (medical device company): Hackers stole patient data including names, contact details, and birth dates. At least 360,000 individuals affected. (Source: SecurityWeek)

• H&M Group: ShinyHunters claims access to H&M databases containing inventory, logistics, sales, and store infrastructure data. H&M states no confirmed compromise yet and is actively investigating. (Source: Cybernews)

• Karaoke company (unnamed, described as a 'giant'): Approximately 8.7 million customers exposed via a supplier data breach. Nature of exposed data not yet disclosed. (Source: Cybernews)

• KFC (United States): Gentlemen Ransomware Group listed KFC as a victim on October 10, 2026. Claim is currently unverified; no data posted and KFC has not confirmed any breach. (Source: CybersecurityNews)

• Ledger / CryptoBilis hardware supply chain: Ledger paused sales through reseller CryptoBilis after reports of over $86 million in losses. One affected device was found to contain an unauthorized hardware implant. Buyers from the past 90 days advised to avoid device setup and move assets to a new signer. (Source: The Hacker News)

• CyberXero campaign steals 628,000+ Ukrainian records: Russian-speaking initial access broker CyberXero (active since at least July 2026) combined Cobalt Strike with an AI orchestration layer built on Claude Code. Campaign targets WordPress and e-commerce sites globally and specifically targets Ukrainian energy and critical infrastructure. (Source: The Hacker News / SOCRadar)

• Albert Heijn (Netherlands / European supermarket giant): Company limited operations amid an ongoing cyberattack. Incident scope not yet fully disclosed. (Source: Cybernews)

THREATS & POLICY

• ShinyHunters arrest: Edward Dubrovsky, believed to be a Canadian cybersecurity executive, was arrested while visiting the United States in connection with an FBI investigation into the ShinyHunters threat group. (Source: SecurityWeek / The Hacker News)

• YMCO money-mule network guilty plea: Oleg Korniev, mastermind of an international money-laundering operation that recruited approximately 15,000 money mules to launder cybercriminals' proceeds, pleaded guilty in the United States. (Source: SecurityWeek)

• Canonical/Ubuntu DDoS attack: Ubuntu and Canonical websites — including the Ubuntu blog and developer portal — were disrupted by a DDoS attack, the second such incident this year. (Source: SecurityWeek)

• Supermarket refrigeration cyberattack: Attackers compromised refrigeration controllers across hundreds of European supermarkets, pushing units to 50°C and spoiling millions of dollars of food. This represents a significant ICS/physical-impact incident. (Source: SecurityWeek / Cybernews)

• Let's Encrypt certificate validity reduction: Let's Encrypt announced it will reduce default TLS certificate validity to 64 days starting February 2027, ahead of the broader industry-wide move to 45-day maximums. Organizations should begin automating certificate lifecycle management. (Source: SecurityWeek)

CLOUD & SAAS SECURITY

• Azure ROPC OAuth flow MFA bypass: Huntress documented 81+ million password spray attempts (June 12–26) against the Azure Resource Owner Password Credentials (ROPC) OAuth flow, which bypasses interactive MFA prompts. At least 78 accounts across approximately 64 organizations were compromised. The attack exploited gaps in Conditional Access policy scoping that did not cover 'All cloud apps' and 'All client app types.' Organizations should block ROPC flows via Conditional Access. (Source: Cloud Security Newsletter / Huntress)

• Bring Your Own Agent (BYOA) risk: Employees are increasingly connecting personal AI agents to enterprise work systems without organizational approval. Amazon blocked Meta's Muse assistant after it failed to identify itself as a bot. Security teams are urged to establish AI agent access policies and monitor for unsanctioned connections to corporate SaaS environments. (Source: The Hacker News)

IDENTITY & AUTHENTICATION

• Azure ROPC credential stuffing bypasses MFA: The ROPC grant type in Azure AD (Entra ID) allows direct token issuance without triggering MFA prompts. 81M+ attempts compromised 78 accounts across 64 orgs. Recommended mitigations: block ROPC via Conditional Access, enforce broad policy scope, and monitor for IPv6 authentication anomalies. (Source: Cloud Security Newsletter)

• CVE-2026-48558 — SimpleHelp RMM OIDC authentication bypass: When OIDC is enabled, SimpleHelp versions 5.5.15 and earlier (plus 6.0 pre-release) did not verify cryptographic signatures on identity tokens. Attackers forged tokens to obtain authenticated technician sessions, then deployed the TaskWeaver loader and Djinn credential stealer, specifically harvesting cloud and AI API keys. (Source: Cloud Security Newsletter / Blackpoint Cyber)

MOBILE SECURITY

• Operation Midnight Mimosa — Preinstalled Android malware campaign (Bitdefender): Low-cost MediaTek-based Android smartphones from several brands are shipping with factory-preinstalled malware disguised as 'com.android.system.lite'. The malware runs at system privilege level, can silently install or remove apps, self-grant sensitive permissions, and load remote code dynamically. It is used for ad fraud and as proxyware. Users cannot remove the malware without rooting the device. (Source: The Hacker News / Cybernews)

ICS/OT/IoT SECURITY

• Supermarket refrigeration controllers compromised across Europe: Attackers hacked refrigeration control systems at hundreds of supermarkets, pushing units to dangerous temperatures (50°C), causing widespread food spoilage and threatening millions in losses. Albert Heijn was among affected operators and limited operations as a result. This is among the most tangible ICS/physical-consequence cyberattacks reported in 2026. (Source: SecurityWeek / Cybernews)

• NSA releases OT zero-trust guidance: The NSA published guidance outlining 26 zero-trust activities for Department of War (formerly DoD) operational technology environments, with special guidance for legacy systems that lack native modern security features. (Source: Industrial Cyber / NSA media.defense.gov)

• ENISA energy sector warning: ENISA, E.DSO, EE-ISAC, and ENCS jointly warned that AI adoption and increased connected device proliferation are widening the cyber risk gap for Europe's energy infrastructure. The agencies are calling for faster incident response capabilities across the sector. (Source: Industrial Cyber)

• OT Cyber Coalition → CISA binding directive request: The OT Cyber Coalition formally petitioned CISA to issue a binding operational directive establishing mandatory federal OT cybersecurity requirements. (Source: Industrial Cyber)

• Industrial Cyber Days 2026 begins October 13: The annual Industrial Cyber Days event for ICS/OT security professionals kicks off today, October 13, 2026. (Source: Industrial Cyber)

RESEARCH & TOOLS

• AI-fooling malware techniques: The Hacker News weekly recap highlighted new malware techniques specifically designed to evade AI-based detection systems, demonstrating an emerging adversarial arms race between defenders and attackers in the endpoint detection space. (Source: The Hacker News)

• Rogue/misissued TLS certificates: The Hacker News weekly recap flagged an active issue involving fake or misissued TLS certificates being used by attackers. Security teams should monitor certificate transparency logs for unauthorized certificates covering their domains. (Source: The Hacker News)

• Google GTIG: AI accelerates vulnerability discovery across enterprise and critical infrastructure attack surfaces — Google's Threat Intelligence Group reports that AI tooling is shortening the time from vulnerability disclosure to active exploitation. (Source: Industrial Cyber)

AI SECURITY

• CyberXero: AI-orchestrated attack campaign — Russian-speaking IAB CyberXero built an AI orchestration layer on Claude Code (Anthropic's agentic coding tool) combined with Cobalt Strike to run large-scale automated attack campaigns. The operation has stolen 628,000+ records from Ukrainian targets, including energy and critical infrastructure organizations. Active since at least July 2026. This represents a significant real-world use of agentic AI as a cyberattack force multiplier. (Source: The Hacker News / SOCRadar)

• Bring Your Own Agent (BYOA) enterprise risk: Personal AI agents are connecting to enterprise systems whether or not organizations approve. Amazon was reported to have blocked Meta's Muse assistant for failing to identify itself as a bot. Security leaders are urged to establish BYOA governance policies, audit agent OAuth authorizations, and monitor for data exfiltration through personal assistant pipelines. (Source: The Hacker News)

• AI API key theft via SimpleHelp CVE-2026-48558: After forging OIDC authentication tokens, attackers deployed the Djinn credential stealer, which specifically targeted cloud provider and AI platform API keys. As AI API keys provide access to sensitive inference capabilities and billing accounts, organizations should treat them with the same security rigor as privileged credentials. (Source: Cloud Security Newsletter / Blackpoint Cyber)

• Agentic AI security threats in late 2026: Stellar Cyber published a report identifying the top agentic AI security threats, including sandbox escapes, containment failures, over-privileged agents with access to sensitive systems, and autonomous agent misbehavior in production environments. (Source: Stellar Cyber)

Sources

The Hacker News: https://thehackernews.com/

Cybernews: https://cybernews.com/

SecurityWeek: https://www.securityweek.com/

CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

CISA KEV Weekly Additions (Senserva): https://senserva.com/exploited-this-week.html

H&M breach (Cybernews): https://cybernews.com/security/h-m-investigates-data-breach-shinyhunters

KFC breach claim (CybersecurityNews): https://cybersecuritynews.com/gentlemen-ransomware-kfc-breach

MFA bypass / Cloud Security Newsletter: https://www.cloudsecuritynewsletter.com/p/mfa-agent-control-plane

Industrial Cyber (ICS/OT news): https://industrialcyber.co/

Stellar Cyber — Agentic AI Security Threats: https://stellarcyber.ai/learn/agentic-ai-securiry-threats/

TechJack Solutions Weekly Intelligence Briefing: https://techjacksolutions.com/security/briefing/weekly-security-intelligence-briefing-week-of-2026-10-12/

NSA OT Zero-Trust Guidance: https://media.defense.gov/2026/Oct/08/2004013274/-1/-1/0/CSI_HARDENING_OT_WITH_ZT.PDF