Weekly digest 2026-W42 (12-18 Oct 2026): 10 incidents

Mon, 19 Oct 2026 07:00:00 GMT

10 incidents · 10 confirmed · 3 with CVSS 9+ · 1 supply chain

5 breach, 4 actively-exploited vuln, 1 critical vuln

Actively exploited

BeyondTrust Remote Support authentication bypass exploited (CVE-2026-102764): BeyondTrust Remote Support is software that IT help desks use to control computers remotely. A flaw lets an attacker on the internet, without logging in, tamper with files on the server that runs it. BeyondTrust has released a fix, and the US cybersecurity agency CISA confirms the flaw is being exploited.
Cisco Secure Email Gateway arbitrary file write via email attachment exploited (CVE-2026-76519): Cisco Secure Email Gateway is a device companies use to filter incoming email for spam and malware. A flaw lets an outsider take full control of the device just by sending an email with a specially crafted attachment, if a malware-checking feature called file reputation is turned on. Cisco has released a fix, and the US cybersecurity agency CISA confirms it is being exploited.
Ivanti Connect Secure authentication bypass to RCE exploited (CVE-2026-104935): Ivanti Connect Secure is a VPN gateway, the device employees use to connect to their company network from outside. A flaw in versions before 25.1.3.0 lets an attacker on the internet run commands on the device without a password. The US cybersecurity agency CISA confirms it is being exploited.
Palo Alto Networks PAN-OS management interface RCE exploited (CVE-2026-0322): Palo Alto Networks makes widely used firewalls, the devices that guard company networks. A flaw in the firewall's admin web page lets an attacker who can reach that page and log in to it take complete control of the firewall. Palo Alto has released fixes and CISA confirms it is being exploited, though Palo Alto says it has seen only very limited attacks.

Highest CVSS (9.0+)

Rank Math SEO PRO 3.0.123 downloads shipped malware (CVE-2026-111862): Rank Math is a popular plugin that helps WordPress websites rank in search engines. For about 11 hours on 15-16 October, some downloads of its paid PRO version 3.0.123 contained malware that can take over a website once the plugin is turned on. The company confirms this; the free version from WordPress.org is not affected.

Confirmed breaches & ransomware

OpenCode Console security breach affects 1.4% of users with external AI providers: OpenCode, which makes an AI coding assistant, says its hosted Console service was breached on the night of 16 October. It says 1.4% of Console users were affected, all of them people who had connected outside AI providers. OpenCode confirmed the breach on its official X account and emailed those affected.
ETS breach copied California public-school student testing data, state confirms: A testing company that runs California's statewide school exams, ETS, says someone used a stolen login to copy student records from a file-sharing server between May and September 2026. It covers students in California public schools over the past three school years, including names, birth dates, addresses and disability status. California's Department of Education has confirmed the breach and is sending notices to families.
ConnectWise Cloud Backup (formerly SkyKick) app credentials abused to access Microsoft 365 tenants; services suspended: ConnectWise, a company whose tools IT providers use to back up their clients' Microsoft 365 email and files, says attackers got hold of the login credentials its backup app uses to connect to those Microsoft 365 accounts. ConnectWise has confirmed the unauthorized access and switched off its Cloud Backup, SaaS Security and Cloud Management services while it fixes things. It says stored backups show no sign of being touched.
Zeabur confirms attacker read 3.2M environment-variable records and 321,810 accounts: Zeabur is a service developers use to host their apps online. The company confirmed that an attacker got into its systems on 14-15 October and read customers' stored app settings, including passwords and access keys, plus details of 321,810 accounts. It was Zeabur's second incident since August, and the company has announced it is shutting down by 31 December.
Burger King Japan: unauthorized access exposes about 11.18 million official app member records: Burger King's operator in Japan says hackers got into the system holding its app members' details in early October and took information from about 11.18 million member records, including names, email addresses, phone numbers and birth dates. The company says credit card numbers weren't stored there and it hasn't found that passwords were taken. The breach is confirmed by the company.

Every incident

Rank Math SEO PRO 3.0.123 downloads shipped malware (CVE-2026-111862) (critical vuln)
Ivanti Connect Secure authentication bypass to RCE exploited (CVE-2026-104935) (actively-exploited vuln)
Palo Alto Networks PAN-OS management interface RCE exploited (CVE-2026-0322) (actively-exploited vuln)
BeyondTrust Remote Support authentication bypass exploited (CVE-2026-102764) (actively-exploited vuln)
Cisco Secure Email Gateway arbitrary file write via email attachment exploited (CVE-2026-76519) (actively-exploited vuln)
OpenCode Console security breach affects 1.4% of users with external AI providers (breach)
ETS breach copied California public-school student testing data, state confirms (breach)
ConnectWise Cloud Backup (formerly SkyKick) app credentials abused to access Microsoft 365 tenants; services suspended (breach)
Zeabur confirms attacker read 3.2M environment-variable records and 321,810 accounts (breach)
Burger King Japan: unauthorized access exposes about 11.18 million official app member records (breach)

What Got Pwned: weekly digest

Weekly digest 2026-W42 (12-18 Oct 2026): 10 incidents

Actively exploited

Highest CVSS (9.0+)

Confirmed breaches & ransomware

Every incident