Bearer CLI: Free, source-available code security scanning tool (SAST)
Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they…
Year: 2026
A week in security (October 12 – October 18)
Last week on Malwarebytes Labs: Eiliko robot companion exposes private chats and can be hijacked “Spray and pray” job applications could make it harder for…
Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
A flaw in Broadcom’s Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or…
Security Affairs newsletter Round 600 by Pierluigi Paganini – INTERNATIONAL EDITION
Security Affairs newsletter Round 600 by Pierluigi Paganini – INTERNATIONAL EDITION Pierluigi Paganini October 18, 2026 A new round of the weekly Security Affairs newsletter…
Queensland students put cyber skills to the test at ANZ Hackathon
More than 100 students, academics and industry experts are gathering in Brisbane on 19 and 20 October for the second ANZ Cybercrime Hackathon, an event…
How to monitor, detect, and respond to cloud data risks faster with built-in security controls for cloud events
Editor’s note: Wiz recently announced the general availability of Wiz for DSPM. Our second blog post talked about why data security should be integrated with…
You can’t secure what you can’t see.
An OT cyber coalition urges CISA to establish baseline security requirements. Another OpenAI safety worker resigns. Maryland lawmakers seek funding for Cyber Command’s mental health…
Microsoft Confirms October Windows Updates Can Break Exchange Server Email Services
Microsoft has confirmed that Windows Server security updates released on October 13, 2026, can disrupt Exchange Server email services, blocking webmail access and leaving messages…
Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data
An Android remote-access Trojan, YuanKong, whose weakly protected dropper reveals more than its hidden payload: it exposes the operator account identifiers embedded in each build.…
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI…
Stolen ConnectWise ‘SkyKick’ credential exposed Microsoft 365 tenants
Key points ConnectWise has switched off its Cloud Backup service after a stolen credential let attackers sign into customers’ Microsoft 365 environments. Huntress confirmed unauthorised…
16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password
16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password Pierluigi Paganini October 19, 2026 A Broadcom Wi-Fi flaw dating back to 2010…