Today’s common failure mode is simple: you did not get exploited through your code, you got exploited through your trust. Keys, automation, and “helpful defaults” keep becoming attacker APIs.

Today's Top 5

1. 26,739 servers, malware installed: Japan’s Onamae Desktop Cloud says attackers planted malicious programs across customer VPS environments, then the provider began shutting systems down to contain it. What was dropped, and how long it lived, is the real question. Source
2. 3,897 SBI customer records leaked: India’s biggest bank disclosed a data leak tied to records posted online, with KYC and loan details in the mix. The bank says core systems were not disrupted, but the downstream fraud risk is the point. Source
3. WordPress sites backdoored via stolen keys: Attackers used legitimate UpdraftCentral connection keys to push malicious plugins during an ~18 hour window. No exploit needed, just the right key. Now ask yourself where else you have “remote admin by secret string.” Source
4. AI coding agents fooled by Downloads file: Researchers found a malicious AGENTS.md dropped into ~/Downloads that could steer an agent to install a rogue npm package or leak tokens once the agent runs in that directory. The scary part is how normal the workflow looks. Source
5. GitLab CVE-2026-110264 patch sprint: GitLab shipped fixes for a maximum severity issue that could enable unauthenticated code execution under certain conditions. Self managed fleets that treat GitLab as “internal only” should re-check exposure paths. Source

Why today matters: We are watching the attack surface move from “find a bug” to “borrow a capability.” Stolen keys turn management channels into botnets, and agent automation turns a text file into execution. If you run anything that can take action on your behalf, you are now defending a permission model, not a product.

XERJ Corpus Hub: Working the GitLab CVE-2026-110264 scramble? An AI agent loading cisa could quickly cross-reference what else is trending in exploited enterprise software, then draft a tight, executive-ready “patch first, hunt second” plan for your dev platform. Grab more at hub.xerj.org.

Ok, now the messy details.

Data Breaches

1. Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected: Onamae Desktop Cloud says an unauthorized third party installed malicious programs in some customer environments, with up to 26,739 servers potentially affected. The provider began progressively shutting down customer servers starting October 21, 2026, and warned customers to rotate secrets stored on those hosts. Source: BleepingComputer
2. State Bank of India Suffers a Customer PII Data Leak: SBI disclosed that 3,897 customer records appeared online, with reporting describing contact info, addresses, birth dates, bank profile IDs, and loan related metadata among exposed fields. The incident may have originated in a peripheral system, but the data is tailored for vishing and identity fraud. Source: Dark Reading
3. TeamUpdraft security incident, customer database likely accessed: TeamUpdraft says unauthorized access to its site over Oct 17 to 18, 2026 likely led to customer database access, including UpdraftCentral connection keys and other service keys. They pushed UpdraftPlus updates intended to revoke older UpdraftCentral connections and urged customers to review sites for suspicious activity. Source: TeamUpdraft
4. Monmouth University Data Breach listed by Rhode Island AG: Rhode Island’s AG breach notification list shows a Monmouth University data breach notice dated October 23, 2026. State list entries are often the earliest public breadcrumb for higher-ed incidents that take weeks to fully scope. Source: Rhode Island Attorney General

Security Research

1. Attackers abuse UpdraftCentral keys to plant backdoors on WordPress sites: Reporting describes an ~18 hour campaign (Oct 18 to 19) where attackers used valid UpdraftCentral dashboard keys to send signed plugin installation commands, dropping backdoor plugins across connected sites. The key lesson is governance of remote management channels, not WordPress patch cadence. Source: The Hacker News
2. AI coding agents fall for malicious instructions planted in Downloads: Forever Security found that an AGENTS.md file placed in ~/Downloads can manipulate coding agents into unsafe actions like installing malicious packages or leaking tokens when the agent operates in that directory. This is a new flavor of “drive-by” that targets agent behavior rather than human clicks. Source: Help Net Security
3. AI coding agents hijacked using AGENTS.md file in Downloads folder: A deeper write-up shows how the same concept was reproduced against OpenAI Codex and a related technique against Claude Code to leak OAuth tokens, with the working directory choice doing half the attacker’s job. If your devs run agents on laptops, “Downloads” just became a policy boundary. Source: BleepingComputer
4. Unit 42, AI-assisted cybercrime workflow analysis: Unit 42 analyzed a criminal operation using multiple AI assistants to plan and execute different malicious activities, including generating scripts and recon outputs. The operational lesson is not that AI makes attackers magical, it makes them faster at being consistent. Source: Palo Alto Networks Unit 42
5. Oracle October 2026 Critical Patch Update: Oracle’s October 2026 CPU includes a very large set of fixes across product families. If your inventory for Oracle middleware and app stacks is fuzzy, your patching is mostly vibes. Source: Oracle

Top CVEs

1. CVE-2026-110264: GitLab CE/EE integer overflow tied to compiling crafted regular expressions, which could under certain conditions allow unauthenticated arbitrary code execution. Fixed in GitLab 18.11.13 and multiple 19.x patch releases, so long-lived self-managed instances need urgent upgrades. Source
2. CVE-2026-114625: Arista VeloCloud Orchestrator on-prem issue where any authenticated user can gain operator privileges and impersonate a local superuser operator, exposing privileged internal functionality and risking full orchestrator compromise. Treat this as “identity meets infrastructure control-plane.” Source
3. CVE-2026-102764: BeyondTrust Remote Support origin validation weakness enabling unauthenticated file operations on affected appliances, with multiple advisories noting exploitation in the wild. If you patched, you still need to answer the post-exploitation question. Source
4. CVE-2026-76519: Cisco Secure Email Gateway AMP feature arbitrary file write that can allow unauthenticated attackers to write files on the underlying OS when the reputation service is enabled. Appliance bugs like this rarely stay “someone else’s problem.” Source
5. CVE-2026-96951: Windows Shell Mark of the Web security feature bypass exploited in the wild as a zero-day prior to Microsoft’s October 2026 fixes, enabling malicious files to evade warning prompts. This is pure delivery pipeline enablement for everything else. Source

Podcasts & Talks

1. SANS Stormcast Friday, October 23rd, 2026: This episode is a tight briefing on the PHP2Shell situation plus related high-signal items, useful for CISOs who need a daily cadence without doomscrolling. Listen: Apple Podcasts
2. Smashing Security, Episode 489 (Oct 22, 2026): A practical CISO-friendly discussion about compromised crypto hardware supply chain risk and targeted attack techniques, with a side of “how humans actually get tricked.” Listen: Smashing Security
3. Risky Business #856 (Oct 21, 2026): The show’s take on the week’s big vulnerability wave, with the kind of context that helps you explain urgency without sounding like you are selling fear. Listen: Risky Business

Final Words

The uncomfortable pattern today is that security controls keep assuming a human is the decision-maker. Attackers are aiming at the things that decide and act automatically: orchestration consoles, remote management keys, CI agents, and “helpful” developer tooling. When those are compromised, your blast radius is not one endpoint. It is your workflow.

This week, do three things:

• Inventory and rotate remote management secrets for WordPress admin tooling, starting with UpdraftCentral connection keys if you run UpdraftPlus.
• Put guardrails on AI coding agents: block running agents in ~/Downloads, restrict filesystem scope to a repo directory, and require human approval for package installs.
• Patch and then hunt around the control-plane: upgrade self-managed GitLab for CVE-2026-110264 and review unauthenticated request paths, access logs, and runner activity for anomalies.

Your turn: If malware landed on up to 26,739 VPS servers at a major provider, would your org even notice the difference between “our app is slow” and “our host is hostile”? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone running an AI coding agent on their laptop with default permissions, in their home directory? Forward them the AGENTS.md story, it is a 2-minute read and the alternative is a very long incident report. If you got this from a friend, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!