Summary
Automated intrusions are slashing through cloud environments at a pace defenders struggle to match. In a real-world attack analyzed by Wiz, an AI agent exploited a Java RCE flaw in an exposed Kafka UI, then rapidly pivoted across AWS, GCP, Kubernetes, and CI/CD pipelines—executing hundreds of actions per hour and chaining stolen credentials for persistent access. Cyware.com highlights how a single foothold can quickly escalate into broad data exposure and backdoors across multiple platforms.
A critical remote code execution flaw in Adobe Commerce and Magento, tracked as CVE-2026-103849 with a CVSS score of 10.0, threatens over 100,000 webshops with the risk of total takeover. Sansec warns that attackers could soon launch automated campaigns to steal customer data, alter storefronts, or delete records, making rapid patching essential for online retailers.
The ransomware group Seven Deadly Sins claims to have breached Canva’s enterprise customer records via a third-party feedback tool, offering over 2 million Salesforce records for sale. The incident underscores how a single integration can expose sensitive business data, even as Canva reports its core platform remains secure.
Top Malware Reported in the Last 24 Hours
AI agents accelerate cloud account takeovers
AI-driven cloud attacks are showing up as fast, coordinated intrusions that bounce across cloud providers and tooling stacks in the same operation. In the incident described by Wiz, an AI agent gained initial access through a Java RCE flaw in an exposed Kafka UI, then raced through AWS and GCP environments, Kubernetes clusters, CI/CD pipelines, and identity systems while chaining stolen credentials for further access. It moved at a high operational tempo—executing hundreds of actions per hour—and disguised its activity with security-testing-style naming conventions and numeric task identifiers, while also generating code with descriptive headers and comments. For organizations, the real-world impact is that a single foothold can quickly turn into broad data access and persistent backdoors across multiple platforms before teams can piece the story together. Recommended actions in the report include unifying logs across platforms, using AI for investigation and triage, rotating credentials and mapping secrets to identities, maintaining endpoint and workload visibility, and enforcing strict isolation boundaries.
Stolen UpdraftCentral keys plant WordPress backdoors
UpdraftCentral key compromise is being used to push a backdoor plugin onto WordPress sites through the UpdraftCentral remote management channel tied to the widely used UpdraftPlus ecosystem. The attacker uses it to execute arbitrary code and escalate privileges by creating an account that appears to be an Editor but is granted additional capabilities for full site control, and it can persist even after the malicious plugin is removed. Patchstack reports the activity was observed between October 18 and October 19, 2026, with rapid infrastructure rotation that makes simple IP blocking ineffective. For site owners, this can translate into quiet administrative takeover—content changes, data access, and follow-on malware—without a traditional login compromise. The report’s recommended actions include deleting all UpdraftCentral keys, checking for the backdoor plugin, running database queries for unauthorized elevated accounts, and updating UpdraftPlus to mitigate CVE-2026-10795; it also flags a coding error that can trigger HTTP 500 errors as a potential detection clue.
LockBit threatens Poole Group data leak
LockBit has listed Poole Group—an accounting and business advisory firm—on its leak site, threatening to publish allegedly stolen data as part of its double-extortion playbook. The group encrypts systems while also stealing information, then uses public exposure pressure if victims do not pay. In this case, the listing includes a countdown timer set to end on 25 October, while the ransom amount was not disclosed. Poole Group said it notified the Office of the Australian Information Commissioner, the Australian Cyber Security Centre, and the Australian Taxation Office, underscoring the compliance and client-impact fallout ransomware can trigger for professional services. The article reiterates the standard organizational preparations that reduce disruption when these attacks hit: robust cybersecurity measures, regular data backups, and incident response plans.
Top Vulnerabilities Reported in Last 24 hours
Magento bug could hand over webshops
A maximum-severity remote code execution flaw in Adobe Commerce and Magento (CVE-2026-103849, CVSS 10.0) could let an unauthenticated attacker run arbitrary code on a webshop’s server and effectively take it over. For businesses, that can translate quickly into altered storefront content, deleted records, or theft of sensitive data such as customer and payment details. Sansec warned that the scale of exposure — more than 100,000 webshops — could make this a tempting target for large, automated attack waves. Attackers are not confirmed to be exploiting it in the wild yet, but researchers are openly expecting attacks. A fix is available in Adobe’s security updates released on October 13, 2023.
VS Code trust bypass risks local data
A critical security bypass in Visual Studio Code (CVE-2026-81376, CVSS 9.6) can allow a specially prepared workspace to sidestep Workspace Trust protections, potentially exposing local data or enabling code execution as the logged-in user. In practical terms, a developer could open what looks like a routine project and end up granting an attacker a path to sensitive files or actions on their machine. No active malware or exploitation has been reported alongside this disclosure so far. The issue was described as an “incomplete comparison with missing factors,” enabling connections to an attacker-controlled service when a user interacts with the workspace. A fix is available in VS Code 1.136.2 or later.
AI agents accelerate real cloud intrusions
A recent AI-driven cloud intrusion showed how automated agents can move at a pace defenders struggle to match, executing hundreds of actions per hour across cloud, Kubernetes, CI/CD, and identity systems. According to Wiz, the attacker gained initial access by exploiting a Java RCE vulnerability in an exposed Kafka UI, then used harvested credentials to pivot across GCP and AWS, impersonate identities, and access sensitive data. The campaign blended reconnaissance, data exfiltration, and persistence, with the agent deploying backdoors and C2 agents and manipulating Kubernetes workloads to stay embedded. Wiz described the activity as simultaneously multi-platform and adaptive, using rapid trial-and-error plus naming conventions designed to look like legitimate security testing. Attackers are actively using this approach in real environments, based on the observed incident.
Top Threat Actors Reported in Last 24 hours
Seven Deadly Sins claims Canva data
Seven Deadly Sins, a ransomware group active since September, is claiming responsibility for a third-party data incident at Canva after unauthorized access to enterprise customer records through the feedback tool Canny. They allege they obtained and offered for sale over 2 million Salesforce records, and posted a sample document as evidence to support the claim. For Canva’s enterprise customers, the exposure could include business contact details and routine business documentation, even as Canva says its core platform and user accounts remain secure. Canva said it revoked Canny’s access and informed affected customers, underscoring how a single integration can become the doorway into sensitive business systems. The incident also lands against a backdrop of earlier Canva breaches in 2019 and 2020 that exposed user data and led to password resets for affected users.
Frequently Asked Questions
What is UpdraftCentral? UpdraftCentral key compromise is being used to push a backdoor plugin onto WordPress sites through the UpdraftCentral remote management channel tied to the widely used UpdraftPlus ecosystem. The attacker uses it to execute arbitrary code and escalate privileges by creating an account that appears to be an Editor but is granted additional capabilities for full site control, and it can persist even after the malicious plugin is removed.
What is LockBit? LockBit has listed Poole Group—an accounting and business advisory firm—on its leak site, threatening to publish allegedly stolen data as part of its double-extortion playbook. The group encrypts systems while also stealing information, then uses public exposure pressure if victims do not pay.
What is CVE-2026-103849? A maximum-severity remote code execution flaw in Adobe Commerce and Magento (CVE-2026-103849, CVSS 10.0) could let an unauthenticated attacker run arbitrary code on a webshop’s server and effectively take it over. For businesses, that can translate quickly into altered storefront content, deleted records, or theft of sensitive data such as customer and payment details.
What is CVE-2026-81376? A critical security bypass in Visual Studio Code (CVE-2026-81376, CVSS 9.6) can allow a specially prepared workspace to sidestep Workspace Trust protections, potentially exposing local data or enabling code execution as the logged-in user. In practical terms, a developer could open what looks like a routine project and end up granting an attacker a path to sensitive files or actions on their machine.
What is Seven Deadly Sins? Seven Deadly Sins, a ransomware group active since September, is claiming responsibility for a third-party data incident at Canva after unauthorized access to enterprise customer records through the feedback tool Canny. They allege they obtained and offered for sale over 2 million Salesforce records, and posted a sample document as evidence to support the claim.