ISC Stormcast For Tuesday, October 20th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Search Intelligence
PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites
TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database con
Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic
At risk, the Oregon Democrat warned, are online crime tipsters, whistleblowers and others. The post Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensiti
DHS to ban DeepSeek from federal civilian agencies
The order cites national security concerns, including sending data to servers in China, the potential malware and the overall risk to federal IT systems. The post DHS to ban DeepSeek from federal civi
19th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES CenterPoint Energy, a US utility company serving T
AOMEI Backupper update servers hijacked to push malware: Check your PC
Attackers tampered with AOMEI Backupper’s update system to deliver malware that could give them remote access to users’ PCs.
Agents are your newest insiders. Security must move at their speed.
New capabilities in Microsoft 365 E7 and Project Perception help organizations contain agent risk and adapt protection continuously. The post Agents are your newest insiders. Security must move at the
Cybersecurity Underpins Saudi Arabia’s Digital Future
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 19, 2026 – Read the Full Story in Arab News Cybersecurity Ventures projected that global cybercrime damages
Millions of California students’ sensitive data stolen in breach
The California Department of Education notified students about a data breach at contractor Educational Testing Service.
A week in security (October 12 – October 18)
A list of topics we covered in the week of October 12 to October 18 of 2026
Orphaned VBA Projects Inside DWG Files: YARA Rule
Here is the YARA rule I used to detect " Orphaned VBA Projects Inside DWG Files ". 
PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
Rank Math has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. According to Rank Math, the affected version was downloaded or installed through an update between Octo
Federal agencies recommend cyber controls, independent testing for frontier AI systems
While voluntary, the document marks the federal government’s most detailed cybersecurity guidance for securing sandbox environments during AI model tests. The post Federal agencies recommend cyber con
Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact
New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in th
Prolific Chinese espionage group exploits BeyondTrust zero-day
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers. The post Prolific
Managing open-weight model risk in enterprise deployments
New whitepaper from Microsoft and NVIDIA helps enterprises manage open-weight AI model risks with a shared taxonomy, evaluations, and controls. The post Managing open-weight model risk in enterprise d
Cybersecurity incident at BAE Systems disrupts US bankruptcy court system
The outage has stopped official bankruptcy notices nationwide since Oct. 9, with no cause or restoration date announced. The post Cybersecurity incident at BAE Systems disrupts US bankruptcy court sys
Eiliko robot companion exposes private chats and can be hijacked
A researcher found serious flaws in Eiliko’s security, exposing private conversations and allowing remote changes to what the robot says.
Fighting Cybercrime in Sri Lanka: A Resilience-Driven Approach To Cybersecurity
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 16, 2026 – Read the Full Story in The Morning Global cybercrime expenses are expected to increase from $11 t
Backdooring Open-Weight AI Models
This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated model