AI Security Digest
Aggregated ecosystem risk analysis
Vendor Watchlist
Tracking 0 critical integrations
Threat Stream Feed
Real-time security logs and system alerts
Amplitude - Export API returns 500 errors across multiple organizations
Oct 20, 13:21 PDT Resolved - This incident has been resolved. Oct 20, 13:13 PDT Investigating - We are investigating errors affecting some customers using the Data Export API. Affected Export API requests may return 500 errors.
Elastic Cloud - Elastic Cloud scaling issues in Azure
Oct 20, 20:07 UTC Investigating - We are investigating an issue affecting the ability to scale existing Elastic Cloud Hosted deployments and Serverless projects in Azure. New project and deployment creation in Azure may be delayed.
Sentry - Sentry.io not loading
Oct 20, 18:58 UTC Update - We have mitigated the immediate problem, but are continuing to investigate the cause. You may continue to experience interruptions using our UI and API. We will update as we know more. Oct 20, 18:20 UTC Investigating - Users are experiencing issues loading the Sentry dashboard. We are investigating the problem.
CircleCI - Increased wait times for macOS jobs using Xcode 27.0 on m4pro.large
Oct 20, 15:58 UTC Investigating - We're seeing increased wait times for some macOS jobs using Xcode 27.0 on the m4pro.large resource class. We're investigating and will provide another update soon. Thank you for your patience.
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was
GCP - RESOLVED: Multiple services are experiencing issues in the europe-west2 region.
Incident began at 2026-10-19 23:08 and ended at 2026-10-20 07:00 (all times are US/Pacific).Summary Multiple services were experiencing issues in the europe-west2 region. Description The issue with impacted GCP products has been mitigated for most of the customers and it is believed to be affecting currently a very small number of customers and our Engineering Team is working on it. If you have questions or are impacted, please open a case with the Support Team and we will work with you until t...
GCP - UPDATE: Multiple services are experiencing issues in the europe-west2 region.
Incident began at 2026-10-19 23:08 (all times are US/Pacific).Summary Multiple services are experiencing issues in the europe-west2 region. Description We are seeing the recovery of services for most workloads in europe-west2 as of Tuesday, 2026-10-20 05:10 PDT. We will provide an update by Tuesday, 2026-10-20 07:00 PDT with current details. We apologize to all who are affected by the disruption. Symptoms Google Cloud services are unavailable in europe-west2-b zone; some services in europe-west...
CVE-2026-106173 Deep-Dive: Fortinet FortiSIEM gRPC Path Traversal File Write to RCE
submitted by /u/scopedsecurity [link] [comments]
#StopRansomware: SafePay Ransomware
Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain acce...
GCP - UPDATE: Multiple services are experiencing issues in the europe-west2 region.
Incident began at 2026-10-19 23:08 (all times are US/Pacific).Summary Multiple services are experiencing issues in the europe-west2 region. Description We are experiencing an issue with multiple services in europe-west2 beginning on Monday, 2026-10-19 23:08 PDT. A power event caused an outage within europe-west2-b zone. The power event is mitigated. We are seeing the recovery of services and are prioritizing the recovery of existing workloads.Customers may not be able to yet create new workload...
GCP - UPDATE: Multiple services are experiencing issues in the europe-west2 region.
Incident began at 2026-10-19 23:08 (all times are US/Pacific).Summary Multiple services are experiencing issues in the europe-west2 region. Description We are experiencing an issue with multiple services in europe-west2 beginning on Monday, 2026-10-19 23:08 PDT. Due to a power event we had suffered an outage within europe-west2-b zone. The power event is mitigated. Partial mitigation to infrastructure services will be observed within the next 30 minutes and the remaining services will be mitig...
GCP - UPDATE: Multiple services are experiencing issues in the europe-west2 region.
Incident began at 2026-10-19 23:08 (all times are US/Pacific).Summary Multiple services are experiencing issues in the europe-west2 region. Description We are experiencing an issue with multiple services in europe-west2 beginning on Monday, 2026-10-19 23:08 PDT. Our engineering team continues to investigate the issue. We will provide an update by Tuesday, 2026-10-20 05:00 PDT with current details. We apologize to all who are affected by the disruption. Symptoms Multiple Google Cloud services a...
GCP - UPDATE: Multiple services are experiencing issues in the europe-west2 region.
Incident began at 2026-10-19 23:08 (all times are US/Pacific).Summary Multiple services are experiencing issues in the europe-west2 region. Description We are experiencing an issue with multiple services in europe-west2 beginning on Monday, 2026-10-19 23:08 PDT. Our engineering team continues to investigate the issue. We will provide an update by Tuesday, 2026-10-20 04:00 PDT with current details. We apologize to all who are affected by the disruption. Symptoms Multiple Google Cloud services a...
GCP - UPDATE: Multiple services are experiencing issues in the europe-west2 region.
Incident began at 2026-10-19 23:08 (all times are US/Pacific).Summary Multiple services are experiencing issues in the europe-west2 region. Description We are experiencing an issue with multiple services in europe-west2 beginning on Monday, 2026-10-19 23:08 PDT. Our engineering team continues to investigate the issue. We will provide an update by Tuesday, 2026-10-20 02:30 PDT with current details. We apologize to all who are affected by the disruption. Symptoms Multiple Google Cloud services a...
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC,
Netlify - Agent Runner failures
Oct 20, 07:47 UTC Investigating - We are investigating increased Agent Runner failures. We will share updates as we learn more.
MongoDB Atlas - GCP Availability Zone europe-west2-b connectivity issues
Oct 20, 07:32 UTC Identified - Since 0600 UTC we have observed cluster node connectivity issues isolated to a single availability zone, GCP europe-west2-b.Atlas clusters are distributed across multiple AZs and 3-node clusters can continue to serve reads and writes from nodes in the other 2 Availability Zones in this region.We are working with our partners to resolve the cause of the issue and restore service to the affected nodes.
Elastic Cloud - Degraded availability for some Elastic Cloud Hosted and Serverless deployments in GCP europe-west2 (London)
Oct 20, 06:51 UTC Investigating - We are investigating an issue affecting one availability zone in the GCP europe-west2 (London) region. Starting at approximately 06:15 UTC, some Elastic Cloud Hosted and Serverless deployments with capacity in this zone may experience degraded availability or connectivity. Monitoring and logging for deployments in the region may also be delayed. Deployments in other zones and regions are not affected. Our engineers are actively working on the issue, and we are...
Snowflake - INC20000294
Oct 20, 06:34 UTC Investigating - Current status: We're investigating an issue with Snowflake Data Cloud. We'll provide an update within 30 minutes.Customer experience: Customers hosted in the specified region may be unable to access or use multiple Snowflake services and features, including Snowflake Postgres. Affected users may experience errors or failures when connecting to Snowflake Postgres instances, managing data, loading data, or using applications.Incident start time: 06:01 UTC Octobe...
Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge
A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, a 35-year-old Saudi national, was "in frequent communications via WhatsApp
Sentry - US: Span ingestion temporarily delayed and alerting offline for database maintenance
THIS IS A SCHEDULED EVENT Oct 20, 03:00 - 05:00 UTC Oct 8, 17:06 UTC Scheduled - We will be performing a database migration in the US region that will pause span ingestion and disable span alerting for up to 2 hours. The Sentry UI and API should be available for the duration, but there will be a period of catch-up where ingestion will be behind and alerts will not fire (until ingestion has reached fresh data).
Box - [Medium] Issue with multiple Box Services
Oct 19, 19:33 PDT Update - Our team is continuing to investigate an issue with the Public API, Box Sign, and Downloads. We will provide additional information as it becomes available. Oct 19, 19:19 PDT Investigating - Our team is investigating an issue with the Public API and Box Sign. Users may see errors or timeouts when attempting to use the Public API or Box Sign. We will provide additional information as it becomes available.
Zoom - Service Degradation Affecting Meeting Summaries Via Email.
Oct 19, 16:30 PDT Update - We are continuing to work on a fix for this issue. Oct 19, 16:27 PDT Identified - We have successfully identified the root cause affecting a subset of users with meeting summary email delivery when they have selected via email only.Our team is actively working on a resolution, and we will keep you informed with timely updates as progress is made. Thank you for your patience.
Amplitude - Planned Data Processing Maintenance - EU Data Center
Oct 19, 16:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 15, 17:13 PDT Scheduled - From 23:00 Oct 19 to 01:00 Oct 20 UTC, we will be performing maintenance on components of the core ingestion infrastructure in our EU data center.During this time, customers may see data processing delays. No data loss is expected during the maintenance.The US data center won't be affected.
ConnectWise Cloud Backup Compromise in Microsoft 365: What Happened and What to Do Now
Key Takeaways What happened to ConnectWise Cloud Backup, and who is affected? This is a supply-chain attack on a Microsoft 365 backup app. Attackers obtained a credential for ConnectWise Cloud Backup app (formerly SkyKick) and used it, as the app’s service principal (the identity an app uses inside a tenant), to sign in to customer […] The post ConnectWise Cloud Backup Compromise in Microsoft 365:...
Sentry - Sentry is down
Oct 19, 20:53 UTC Monitoring - We have identified and addressed the cause of the outage. Things are moving again and we are burning through ingestion backlogs. We will update the statuspage again as things progress. Oct 19, 20:43 UTC Update - Impact is isolated to our US region customers. Alerting is also impact by this incident. Oct 19, 20:39 UTC Investigating - Sentry.io is taking a long time to load and ingestion may be impacted. We will update as we know more.
Supabase - Support Form Errors
Status: MonitoringThe fix has been deployed and ticket creation has returned to normal. We will continue to monitor.Affected components Dashboard (Operational)
GitHub - Degraded availability for GitHub Actions, GitHub Pages and Webhooks
Oct 19, 16:56 UTC Resolved - This incident has been resolved. Thank you for your patience and understanding as we addressed this issue. A detailed root cause analysis will be shared as soon as it is available. Oct 19, 16:56 UTC Monitoring - Actions, Pages and Webhooks are operating normally. Oct 19, 16:30 UTC Update - We’re seeing recovery following mitigation and are continuing to monitor. Customers may still experience delays in GitHub Actions workflow status updates, GitHub Pages deploym...
Zoom - Zoom Phone Maintenance - AMS3 Data Center: October 19, 2026
Oct 19, 09:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Sep 23, 17:02 PDT Scheduled - Zoom will perform service maintenance at our AMS3 Data Center starting at 9:00 AM Pacific on October 19, 2026. Zoom Phone users registered to the those sip zones will be automatically registered in the FRA3 sip zone sequentially. During the maintenance window, a brief disconnection may be experienced and notifications may be missed. If you get dis...
LastPass - LastPass CLI: Update required before October 22
[Scheduled] On October 22, 2026, at 8:00 AM UTC, we’re updating the certificate that LastPass uses. All versions of the LastPass CLI before v1.6.2 will stop connecting to LastPass after the change. No other LastPass apps or services are affected. To keep using the CLI, update to v1.6.2 or later before 8:00 AM UTC. Download it from the LastPass CLI releases page on GitHub: https://github.com/lastpass/lastpass-cli/releases Some package managers take a while to publish new versions. If v1.6.2 isn...
Zoom - Service Degradation Affecting Zoom Website in UK region
Oct 19, 06:44 PDT Monitoring - The service degradation affecting Zoom Website in UK region has been successfully resolved.Our team will continue to monitor the situation closely and will keep you informed of any further updates. Oct 19, 06:32 PDT Investigating - We are currently investigating a service degradation affecting Zoom Website in UK region.Our team is actively working to identify the impact and root cause. We will provide an update as soon as more information becomes available.We ap...
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features. Chained together,
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
SendGrid - Voice Call Failures from a Subset of Network Subscribers to Twilio Denmark Phone Numbers
Oct 19, 02:44 PDT Update - Twilio customers may be experiencing voice call failures from network subscribers to a subset of Twilio Denmark Phone Numbers. Our team is actively investigating this issue. We will provide another update in 1 hour or as soon as more information becomes available. Oct 19, 02:11 PDT Investigating - Twilio customers may be experiencing voice call failures from network subscribers to Twilio Denmark Phone Numbers. Our team is actively investigating this issue. We will p...
Twilio - Voice Call Failures from a Subset of Network Subscribers to Twilio Denmark Phone Numbers
Oct 19, 02:44 PDT Update - Twilio customers may be experiencing voice call failures from network subscribers to a subset of Twilio Denmark Phone Numbers. Our team is actively investigating this issue. We will provide another update in 1 hour or as soon as more information becomes available. Oct 19, 02:11 PDT Investigating - Twilio customers may be experiencing voice call failures from network subscribers to Twilio Denmark Phone Numbers. Our team is actively investigating this issue. We will p...
Monday.com - Slow automations in EU
Oct 19, 08:56 UTC Investigating - We are experiencing delays in automations for the EU region. The delays are caused by congestion in the automation queue. We are currently investigating.
Monday.com - Investigating issues with slow loading of the monday platform
Oct 19, 07:35 UTC Monitoring - A fix has been implemented and we are monitoring the results. Oct 19, 07:17 UTC Identified - We are currently experiencing issues related to platform performance. Our dedicated team is working to resolve this as quickly as possible
SendGrid - United States SMS and MMS Carrier Maintenance - T-Mobile
Oct 19, 00:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 16, 15:53 PDT Update - The T-Mobile network in the United States is conducting a planned maintenance from 18 October 2026 at 21:00 PDT until 19 October 2026 at 05:00 PDT. During the maintenance window, there could be intermittent delays delivering SMS and MMS to and from T-Mobile United States handsets when sending via long codes and short codes. Oct 15, 14:19 PDT Schedu...
Twilio - United States SMS and MMS Carrier Maintenance - T-Mobile
THIS IS A SCHEDULED EVENT Oct 19, 00:00 - 05:00 PDT Oct 16, 15:53 PDT Update - The T-Mobile network in the United States is conducting a planned maintenance from 18 October 2026 at 21:00 PDT until 19 October 2026 at 05:00 PDT. During the maintenance window, there could be intermittent delays delivering SMS and MMS to and from T-Mobile United States handsets when sending via long codes and short codes. Oct 15, 14:19 PDT Scheduled - The T-Mobile network in the United States is conducting a plan...
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without
Zoom - Network Maintenance in SJC Data Center : October 18, 2026
Oct 18, 21:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Sep 20, 01:42 PDT Scheduled - Zoom will perform network maintenance at our San Jose data center. Users may experience a brief interruption of service during the maintenance window.
Zoom - Service Degradation Affecting ZP SMS Australia Mobile Numbers
Oct 18, 17:31 PDT Resolved - This incident has been resolved and the affected services have been restored. Oct 18, 17:14 PDT Monitoring - Between 22:24 UTC - 23:34 UTC on October 18, 2026, a subset of Zoom Phone SMS users experienced inbound delays and outbound failures. The issue has resolved.
Snowflake - INC20000290
Oct 19, 00:26 UTC Monitoring - Current status: We identified an issue with our third-party cloud platform that affected private connectivity in the specified region. The issue has been resolved, and we're working with the provider to confirm the underlying cause. We'll continue to monitor the environment until we're confident all services are functioning properly.Customer experience: Customers hosted in the specified regions who connect to Snowflake using private connectivity may have experienc...
Elastic Cloud - Scheduled maintenance: Cloud console
Oct 18, 21:00 UTC In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 15, 17:40 UTC Scheduled - We will be performing scheduled maintenance on the Cloud console. For a brief window during this maintenance, customers may experience failures when logging in or signing up, switching organizations, managing members and roles, or creating and revoking API keys. Customers who are already logged in may be logged out. Existing API keys, Elasticsearc...
Zoom - Zoom Phone Update - Japan SIP Zones: October 18, 2026 (No Operational Impact)
Oct 18, 08:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 12, 17:45 PDT Scheduled - We will be providing an update to Zoom Phone - Japan SIP zones in Tokyo and Osaka. Please refer to https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0062333 for more details. This update includes spam warning integration for Movius identified spam calls.There is no operational impact. All services will be available during this sche...
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise
Open-source CVE triage in one place: KEV, EPSS, NVD and OSV combined into a single risk score
A open-source tool called CVE Intel. In simple terms, it pulls a bunch of security information sources into one place, and it doubles as an MCP server, so you can plug it into any of your AI agents.It's MIT licensed and written in Rust. Paste in a CVE and it pulls from NVD, CISA KEV, EPSS, OSV, public exploit sources and others in parallel. You get a 0–100 risk score and a short "act now or later"...
Zoom - Zoom Phone Update: October 18, 2026 (No Operational Impact)
THIS IS A SCHEDULED EVENT Oct 17, 17:00 PDT - Oct 18, 02:00 PDT Oct 12, 17:38 PDT Scheduled - We will be providing an update to Zoom Phone. Please refer to https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0062333 for more details. This update includes spam warning integration for Movius identified spam calls.There is no operational impact. All services will be available during this scheduled update.
Career Transition: From Warehouse Work to the Blue Team.
From Warehouse to Blue Team – My Journey Towards SOC L1 and Eventually DFIR Hey everyone! Back in 2010, I was doing some amateur web design, which I continued until around 2014. After that, my PC was pretty much just for gaming. I've always been a gamer, and I've always wanted a job that involved computers, but you know how life goes. I never had the experience, and probably not enough motivation ...
Xero - Xero Scheduled Maintenance - Xero Reports
Oct 17, 17:30 UTC In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 11, 23:09 UTC Scheduled - We're carrying out scheduled maintenance on Saturday 17 October 2026 from 5.30pm to 7.00pm UTC. During this window, the following features may be unavailable:- access to Xero Reports or related reporting fields, including NZ GST return- access to Client report templates, including editing practice report fields in Xero Partner HubWe appreciate you...
(QubesOS) how to safely install in dom0
i want to install liteqube from github it needs to go in dom0 i read its not a good idea to move files from untrusted vms (browser) to trusted vms (dom0) how do i lower my chances for being hacked submitted by /u/adrianchristianherna [link] [comments]
Amplitude - We are actively investigating an issue with our ingestion systems lagging
Oct 17, 07:45 PDT Monitoring - A fix has been implemented and we are monitoring the recovery. No data is lost.
Xero - Inland Revenue (NZ) Scheduled Maintenance October 17 and 18, 2026
Oct 17, 08:00 UTC In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 15, 23:25 UTC Scheduled - The New Zealand Inland Revenue Department (IRD) is completing planned maintenance from 9.00pm on Saturday 17 October 2026 to 5.00am on Sunday 18 October 2026, NZDT.During this time, customers may experience interruptions when filing GST returns, income tax returns or payday filings to the IRD from Xero. Please note, customers can continue to run a...
Zoom - Service Degradation Affecting Zoom Chat Compose and SMS Summarisation with AI Companion
Oct 16, 23:56 PDT Resolved - This incident has been resolved and the affected services have been restored. Oct 16, 23:16 PDT Monitoring - A service degradation affecting Zoom Chat Compose and SMS Summarisation with AI Companion has been successfully resolved.Our team will continue to monitor the situation closely and keep you informed of any further developments. Oct 16, 23:13 PDT Identified - We have successfully identified the root cause of a service degradation affecting Zoom Chat Compos...
Supabase - Project creation errors ap-ne1
Status: IdentifiedDue to an ongoing upstream provider outage, we are remediating project creation errors in apne-1. Customers may see errors in creating or unpausing a project from this region. We are working to re-direct traffic to non-impacted regions and awaiting updates from our dependant provider.Affected components ap-northeast-1 (Degraded performance) ap-northeast-1 (Degraded performance)
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs
Netlify - Elevated Build Errors
Oct 17, 05:55 UTC Resolved - This incident has been resolved. Oct 17, 05:30 UTC Monitoring - We've released a fix to resolve the errors for builds using the CSP extension, and we are monitoring the results. Oct 17, 05:03 UTC Identified - We have identified an issue with a third-party service used by our build system. Builds started on or after 21:10 UTC that use the CSP extension may experience increased errors.
1Password - High error rate on 1Password.com
Oct 16, 20:34 EDT Update - We are seeing some improvements to affected services but are continuing to investigate the issue. Oct 16, 19:45 EDT Investigating - We are currently investigating this issue.
Zoom - Zoom Virtual Agent Update: October 17, 2026 (No Operational Impact)
Oct 16, 17:01 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 13, 06:52 PDT Scheduled - We will be providing an update to Zoom Virtual Agent. Please refer to https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0067812 for more details. This update includes the ability to export Zoom Virtual Agent usage data.There is no operational impact. All services will be available during this scheduled update.
Zoom - Zoom Contact Center Update: October 17, 2026 (No Operational Impact)
Oct 16, 17:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 13, 06:48 PDT Scheduled - We will be providing an update to Zoom Contact Center. Please refer to https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0067626 for more details. This update includes warm transfer to flow for voice engagements.There is no operational impact. All services will be available during this scheduled update.
1Password - Some users are unable to view vault profiles using the web interface
Oct 16, 13:42 EDT Resolved - A fix has been deployed and this issue is now resolved. Oct 16, 13:31 EDT Identified - When choosing to view a vault profile using the web interface, a blank page is displayed instead. Our engineering team has found the root cause and are working towards deploying a fix.
Zoom - Zoom Chat Backend Update: October, 2026 (No Operational Impact)
Oct 16, 09:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 15, 04:41 PDT Scheduled - We will be providing an update to Zoom Chat Backend Service. There will be no operational impact. All services will be available during this scheduled update (ZR status might be displayed as offline in the service logs but no operational impact).
OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract
OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without authorization to complete a coding task. The incident, the AI company said, involved an internal research model part
HashiCorp - Maintenance: HCP Terraform Scheduled Maintenance
Status: ScheduledHCP Terraform and HCP Waypoint will undergo scheduled maintenance on Saturday November 14th 2026, beginning at 17:00 UTC. This maintenance is necessary to improve performance and increase capacity. We expect this maintenance to complete in under 5 hours. These services will be unavailable until maintenance completes. Customers will not be able to manually or automatically trigger Terraform operations during maintenance. Updates will be posted as necessary throughout the maint...
Sumo Logic - Problem with Billing and Account Management in North America 1 (US1), North America 2 (US2), Europe 1 (EU), Europe 2 (DE)
Oct 16, 12:44 UTC Investigating - We are currently investigating reports of problems with Billing and Account Management. We will provide more information soon.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose sign...
AI Decision Models and Their Impact on AI SOC Platforms
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are
Backdooring Open-Weight AI Models
This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it’s the most popular reason people download modified weights without verifying what’s inside. Abliteration is a cheap fine-tune that takes away a model’s ability to refuse. You find ...
Github repos compromised
Around 30000 repos were compromised with a supply chain attack https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html?m=1 submitted by /u/sbify [link] [comments]
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a
Snowflake - INC20000287
Oct 16, 01:43 UTC Resolved - Current status: We've monitored the environment and confirmed that service was restored. If you experience additional issues or have questions, please open a support case via Snowflake Community or the Support page in Snowsight.Customer experience: Customers hosted in the specified regions may have experienced intermittent delays when loading Snowsight or running queries, and some queries may have failed.Workaround: There were no available workarounds for this issue...
[CISA KEV] CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability
Product: Multiple Products by Fortinet Description: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared
HashiCorp - HCP Terraform Scheduled Maintenance (2026-11-14)
Status: InvestigatingHCP Terraform and HCP Waypoint will undergo scheduled maintenance on Saturday November 14th 2026, beginning at 17:00 UTC. This maintenance is necessary to improve performance and increase capacity. We expect this maintenance to complete in under 5 hours. These services will be unavailable until maintenance completes. Customers will not be able to manually or automatically trigger Terraform operations during maintenance. Updates will be posted as necessary throughout the m...
Rippling - Products partially degraded
Oct 15, 19:07 UTC Investigating - We are experiencing higher than usual error rates across our products. We've identified the impacted subsystem and mitigation is in progress.
GitHub - CCA Automations are delayed when starting an Automation
Oct 15, 18:56 UTC Resolved - We suspected that CCA Automations were experiencing delays when users start an Automation, but further investigation found that there was no delay or impact to CCA Automations. Oct 15, 18:53 UTC Monitoring - The degradation has been mitigated. We are monitoring to ensure stability. Oct 15, 18:34 UTC Update - CCA Automations are experiencing delays when users start an Automation Oct 15, 18:31 UTC Investigating - We are investigating reports of impacted performa...
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and
[Threat Intel] Dissecting a 6-Stage Lazarus ("Contagious Interview") Kill Chain: From Weaponized Git Hooks to Dual-Blockchain EtherHiding (TRON/BSC) & macOS CDP Stealers
TL;DR: I intercepted a trojanized Golang technical assessment distributed via LinkedIn social engineering (Contagious Interview / Lazarus Group) and detonated the full 6-stage execution chain in an isolated sinkhole environment. To bypass GitHub's native .git/hooks stripping and static scanners, the threat actors kept all 38 .go source files completely clean, delivered the repo as a Google Drive Z...
Where do I go next?
Hey all, I'm currently a systems engineer with about a year and a half of experience. My company gave us free access to Pluralsight but I'm unsure where to focus my time. Any recommendations? For context, my hands-on experience is primarily in vulnerability management (very familiar in Rapid7), endpoint detection and response (CS Falcon), email security (Proofpoint), and a little incident respons...
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives
Zoom - Zoom Push Notification Service Release: October, 2026 (No Operational Impact)
Oct 15, 09:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 13, 06:11 PDT Scheduled - We will be performing maintenance for Zoom Push Notification Service. No operational impact is expected.This maintenance includes the following enhancements and improvements:- Activity center enhancement- Presence enhancement- Bug fixAll services are expected to operate normally during the maintenance window.
LaunchDarkly - Elevated 5xx Errors (15:11–15:32 UTC)
Oct 15, 08:47 PDT Resolved - Between 15:11 and 15:32 UTC today, we observed elevated 5xx errors affecting requests across our services. Approximately 0.7% of requests failed during this period (99.3% succeeded). This incident has been resolved.
Plaid - Link performance degradation
Status: ResolvedThis incident has been resolved.
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting
CISA Malcolm
View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334) Malcolm <=v26.08.0 (CVE-2026-107333, CVE-2026-107362) CVSS Vendor Equipment v3 8.1 CISA Malcolm 6 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (S...
Eclipse Foundation Eclipse Milo
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The following versions of Eclipse Foundation Eclipse Milo are affected: Eclipse Milo >=0.6.0|<=1.1.4 (CVE-2026-63252, CVE-2026-63248, CVE-2026-60007) Eclipse Milo >=1.0...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operationa...
Optimizely - Degraded Snippet Publishing Performance
Oct 15, 10:35 UTC Investigating - We are investigating an issue causing delays when publishing experiments and other changes. Customers may see deployments remain in an "Uploading to CDN" state longer than expected before becoming available. Existing experiences continue to serve normally. Our engineering team is actively investigating the cause and working to restore normal publishing times.
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan
Box - [Major] Issue with Box Drive
Oct 15, 01:30 PDT Investigating - We are investigating latency with syncing from the Box Web Application to Box Applications: Box DriveSome Users may see delayed updates synchronizing items from the Box Web App to Box Drive desktop clients.
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an
Xero - Global: Subscriptions - some customers are unable to purchase and management subscriptions
Oct 15, 05:43 UTC Investigating - We are aware that some customers trying to purchase and management subscriptions in Xero are experiencing an error. Our team is investigating this with urgency.
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
submitted by /u/Doug24 [link] [comments]
Zoom - Zoom Workforce Management Update: October 15, 2026 (No Operational Impact)
Oct 14, 17:00 PDT In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Oct 13, 06:40 PDT Scheduled - We will be providing an update to Zoom Workforce Management. Please refer to https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0068337 for more details. This update includes bulk CSV import and export capabilities for user management.There is no operational impact. All services will be available during this scheduled update.
[CISA KEV] CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Product: Multiple Products by Atlassian Description: Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Plaid - Elevated API errors
Status: MonitoringThis issue has been mitigated. We are closely monitoring our systems as we recover.
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
Zoom - Service degradation affected Zoom AI Companion in US region
Oct 14, 10:19 PDT Resolved - This incident has been resolved and the affected services have been restored. Oct 14, 10:03 PDT Monitoring - On 10/14/2026, Between 12:10 UTC to 12:34 UTC, users may have experienced issues with Zoom AI Companion in US region.This incident has been resolved and the affected services have been restored.