Cyber Security News

Hacking Editorial Brief — October 19, 2026

Unknown Actor Uses AI Penetration Testing Tool Against South Korean Banks

CrowdStrike Intelligence identified an active campaign against South Korean financial institutions using ARTEX, a Chinese-developed agentic penetration testing tool integrated with AI models for automated attack execution. The campaign follows a major breach that prompted the heads of South Korea's five largest banks to apologize before the National Assembly and pledge AI-based defense implementations. The use of ARTEX represents operational deployment of AI-driven offensive frameworks that autonomously conduct reconnaissance, exploitation, and lateral movement—distinct from the development-focused AI agents documented yesterday. The threat actor remains unattributed, though the targeting of South Korean finance aligns with regional threat activity patterns.

Critical Vulnerabilities Under Active Exploitation Across Enterprise Infrastructure

CISA added an Ivanti Connect Secure authentication bypass (CVE-2026-104935, CVSS 8.6) to its Known Exploited Vulnerabilities catalog after confirming active exploitation allowing remote unauthenticated attackers to execute arbitrary commands on VPN appliances. Separately, attackers are exploiting a CVSS 10.0 unauthenticated remote code execution flaw in the Bricksforge WordPress plugin, with Patchstack detecting exploitation attempts beginning October 7. An unpatched Broadcom Wi-Fi vulnerability allows attackers within wireless range to execute code with root privileges on affected routers, with no CVE assigned and no patch available as of October 19. ConnectWise suspended its cloud backup service after unknown threat actors compromised Microsoft 365 tenants using stolen credentials, disabling seven application identities during incident response. Microsoft's October Patch Tuesday addressed 1,413 vulnerabilities including one exploited zero-day (CVE-2026-96951), two publicly disclosed zero-days, and 75 critical flaws.

Hardware Supply Chain Compromise Confirmed in Ledger Reseller Channel

Ledger confirmed discovery of an unauthorized hardware implant in cryptocurrency wallets sold through reseller CryptoBilis and suspended all reseller sales, warning purchasers from the past 90 days of potentially compromised devices. The confirmation follows yesterday's reporting on embedded surveillance in cryptocurrency hardware and demonstrates active supply chain interdiction targeting hardware wallet distribution channels rather than manufacturing. A separate data breach affecting California's student testing vendor resulted in unauthorized access to files on millions of current and former public school students through stolen login credentials.

Sources: CrowdStrike · Seoul Economic Daily · The Hacker News · CISA · The Hacker News · The Hacker News · CrowdStrike · The Hacker News · SOFX