Here are today’s top cybersecurity stories for Monday, October 26, 2026.
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Huntress tracked an adversary-in-the-middle campaign from July 14 to September 22. A relay captured credentials and MFA codes, and the attackers replayed the stolen sign-in tokens at scale. They logged 497 successful sign-ins from more than 200,000 attempts, registered 48 rogue Entra devices, and added their own authenticator apps and hidden inbox rules. The Hacker News
Gheist Campaign Uses Stolen GitHub Tokens to Steal Repository Secrets Through Actions Logs
Wiz has tracked the campaign since September 15. Attackers push branches named ci-sync- plus six random characters, each carrying a workflow to print repository secrets into Actions logs. They download the logs and delete the runs seconds later. Wiz recovered more than 13,500 planted branches from over 850 compromised accounts. The Hacker News
Genesys Confirms Attackers Accessed Internal Learning and CRM Systems
Genesys says attackers reached a learning management system and a CRM environment and likely downloaded business and account information. The data includes names, phone numbers, business emails, job titles, and customer interaction details. The company reports its Genesys Cloud and Genesys Engage platforms were not compromised, and it declared the incident contained on October 23. ScarlettGroup claimed the attack on its leak site. SecurityWeek
Critical Brotli Flaw Triggers Emergency Patches Across Node.js, Python, and .NET
CVE-2026-111497 is a buffer overflow in the Brotli decoder library. Exploitation crashes processes, exposes memory, and enables remote code execution. Fixes ship in Brotli 1.0.10, 1.1.1, and 1.2.1, Node.js 22.23.4, 24.22.1, and 26.12.1, and Python Brotli 1.2.1. Microsoft released emergency .NET updates, and public proof-of-concept code exists with no reports of exploitation in the wild. BleepingComputer
Two Critical Wasmtime Flaws Allow Malicious WebAssembly Modules to Escape Sandboxes
CVE-2026-115889 and CVE-2026-115893 both carry a CVSS score of 9.9 and sit in the Cranelift compiler. The first affects all architectures and the second affects ARM64 only. Fixes ship in Wasmtime 36.0.19, 48.0.7, 49.0.4, and 50.0.0. Maintainers report no attacks. The Hacker News
Researcher Publishes Unpatched Tailscale SSH Flaws Dubbed Tailworm
Erica Windisch of Cyberdione Labs reports lab tests on Tailscale 1.104.2 and headscale 0.29.5 in which one compromised permitted device with port forwarding enabled reaches root on other servers. No other researcher has reproduced the findings. Tailscale has issued no CVE or fix and says its engineers are working on the issues. The Hacker News
Capcom Confirms Breach of More Than 11.7 Million CAPCOM ID Accounts
Capcom confirmed unauthorized access on October 19 and reported the incident to police and Japan’s privacy regulator on October 21. Exposed data includes email addresses, account creation dates, login counts, and last-login IP addresses. Attackers changed passwords on 196 accounts, and Capcom reset them. The company has not shared details of the initial access. BleepingComputer
953 Online Stores Infected in Long-Running Malware Campaign
Sansec found a small JavaScript loader on 953 stores, most running Magento. The loader fingerprints visitors so payloads reach only real users. The attacker switched in October to a fifth domain hidden behind Cloudflare. The campaign has run since July 2025, and Sansec has not yet captured the payload. SecurityWeek
Two CVSS 9.0 Linux KSMBD Remote Code Execution Flaws Disclosed Before Kernel Fixes
Trend Micro’s Zero Day Initiative published the flaws, which its TrendAI scanner found. One needs no authentication and affects any KSMBD server on port 445. The other needs SMB Direct and an RDMA-capable interface. No CVEs exist yet, and the fix for the first flaw sits in the ksmbd-for-next branch without a released kernel. The Hacker News
Malicious AGENTS.md File in a Downloads Folder Hijacks AI Coding Agents
Forever Security found a booby-trapped AGENTS.md file in a customer’s Downloads folder. It tried to make an AI coding agent install a rogue npm package named function-color. The researchers reproduced the attack against OpenAI Codex and showed a related CLAUDE.md technique against Claude Code in about half of test runs. BleepingComputer
Dutch Police Arrest Two Over NFC Relay Attacks on Bank Customers
Police arrested two men, aged 23 and 25, on October 6. Victims received AI-generated audio claiming suspicious account activity, then a fake bank employee had them install an app and hold their card to the phone. The app copied the NFC chip data to an accomplice at an ATM. The group took about €380,000 from 170 victims. SecurityWeek
Stay tuned for today’s in-depth analysis posts.
