Here are today’s top cybersecurity stories for Tuesday, October 20, 2026.
Eight eMudhra Intermediate CA Keys Compromised, Prompting Emergency Browser and Software Blocks
Mozilla and the Chrome Root Program confirmed the private keys of eight eMudhra intermediate certificate authorities were compromised. A researcher reported the issue on October 17, and Chrome and Firefox blocked the six TLS intermediates within hours. Go 1.27.3 and 1.26.10 now reject chains through the affected keys under CVE-2026-111943. The Hacker News
Critical FortiSIEM Flaw Gets a Public Exploit for Unauthenticated Code Execution
Horizon3.ai published a proof-of-concept for CVE-2026-106173, a CVSS 9.4 path traversal in the FortiSIEM gRPC service on TCP port 27918. The flaw affects FortiSIEM 7.5.0 and is fixed in 7.5.1 or later. FortiSIEM 7.6 is not affected, and no exploitation in the wild has been reported. The Hacker News
Attackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
A hijacked contributor GitHub account replaced archives on OVHcloud CLI releases v0.11.0 through v0.15.0 on October 19. The malicious files stayed live for up to 94 minutes before OVHcloud deleted them and published a clean, immutable v0.16.0. OVHcloud has promised a postmortem. The Hacker News
Autonomous AI Agents Built on the Cairn Platform Hit Over 1,200 Websites
NorForge researcher Snorre Fagerland found exposed Cairn control panels used by a Chinese-speaking attacker. The agents reached the websites of more than 100 companies, including Deere, SharkNinja, and Cummins. Successful break-ins took under 23 hours on average, and NorForge asked hosting providers to take the panels offline. The Hacker News | SecurityWeek
Russian APT28 Breaches a NATO Naval Shipbuilder With a New Reflective Loader
Symantec tracks the activity as Swallowtail and links it to APT28. Victims in two NATO states include a law enforcement agency, a naval shipbuilder, and a military aircraft engine maker. The operators used the HOOKEDGE backdoor and a previously undocumented loader, and returned to the shipbuilder host repeatedly over about a week in late July. The Hacker News
ClickFix Attackers Exploit a Siemens Software Center Flaw to Deploy a Remote Access Trojan
CVE-2026-110936, rated 8.4 under CVSS v4, is a DLL sideloading flaw in Siemens Software Center. Attackers pair the signed Siemens executable with a malicious DLL, and Siemens attributes the activity to the Romulus ClickFix platform. Version 4.0.9.8 fixes the flaw, which Huntress Labs reported. The Hacker News | SecurityWeek
Citizen Lab Confirms Pegasus Spyware on a Serbian University Rector’s iPhone
Citizen Lab found a 2026 zero-click Pegasus infection on the iPhone of Vladan Đokić, rector of the University of Belgrade. The finding came six days before Serbia’s October 25 snap election. Citizen Lab did not identify the operator, and its investigation continues. The Hacker News
WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators
Data-deletion firm Redact found 102 hidden blocks across 80 WhatsApp help pages. The text told the support chatbot to avoid recommending data protection authorities and to avoid citing privacy laws when users mentioned lawyers. WhatsApp removed the blocks by October 18 and blamed a bug. The Hacker News
Bullhorn Takes Staffing Platform Offline to Contain a Cyberattack
Bullhorn disabled access to its cloud platform after a cyberattack caused a system-wide outage. The company is restoring services with CrowdStrike and has not yet determined whether customer data was taken. Non-SSO users must reset passwords, and API passwords require rotation. BleepingComputer
Hackers Steal 1.8 Million Records From Nikkei
Nikkei disclosed attackers used previously compromised credentials to enter a cloud development service on October 7. About 150,000 of the 1.83 million records hold names, addresses, email addresses, phone numbers, and birth dates. No credit card data was taken. SecurityWeek
970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach
Paradigm Healthcare Services found unauthorized network access on October 13, 2025. Names, birth dates, gender, and Medi-Cal member ID numbers were exposed. Notification letters are dated September 14, 2026, about 11 months after discovery. SecurityWeek
Stay tuned for today’s in-depth analysis posts.
