Daily Cybersecurity News – October 18, 2026

What happened

Researchers identified the malicious npm package imgdecode as part of the long-running MALFEX supply-chain campaign. It was uploaded on September 30, 2026, by user malfexteste8, reached version 1.0.3, recorded 979 downloads, and remained available on the registry at the time of reporting.

Its short JavaScript entry point loads a compiled Windows native Node.js addon (DLL). When required from a Windows console, the DLL fetches encrypted shellcode from GitHub, decrypts it, and injects the payload into a new dllhost.exe process.

MALFEX has published malicious packages since August 2023 across multiple publisher accounts. Earlier packages loaded Overlord RAT or formed a Node.js stealer chain (cdn-img-fetch, img-to-native, native-runner); the actor quickly replaced removals with imgbundle, runhelper, and then imgdecode.

Who is affected

Node.js developers and CI systems on Windows that install or transitively depend on imgdecode or related MALFEX packages. The few hundred direct downloads so far understate risk if the package is pulled into larger dependency trees or internal mirrors.

Why it matters

Obscure npm packages with native addons give attackers a stealthy foothold on developer workstations. A successful load can deliver RATs or stealers that compromise source code, credentials, and downstream builds, turning one install into a broader software supply-chain incident.

How it could have been prevented

Uninstall imgdecode and any related packages (cdn-img-fetch, img-to-native, native-runner, imgbundle, runhelper) immediately. Audit package-lock.json and node_modules for unexpected native addons or recent obscure publishers.

Pin dependencies, run SCA tools before install, prefer well-known maintained packages, enable npm 2FA, and block or review postinstall and native compilation steps in CI. Monitor for outbound connections to unfamiliar GitHub raw content after package load.

What happened

Drupal released patches for two critical remote code execution flaws affecting the core Field UI module and the contributed Entity List module. All currently supported versions of Drupal core are impacted.

Exploitation can occur through contributed modules or custom code and includes at least one path that requires no authentication. The Drupal Security Team issued an advance warning that working exploits could appear within hours or days of disclosure and urged administrators to prepare for rapid updates.

Who is affected

Any site running a supported Drupal core release, plus sites that use the Entity List contributed module. Drupal powers more than one million websites, many belonging to governments, universities, and non-profits.

Why it matters

Remote code execution on a CMS yields full server control, enabling data theft, defacement, malware hosting, or lateral movement. High-value Drupal estates are routinely scanned after security windows, so unpatched instances face near-term automated exploitation risk.

How it could have been prevented

Update Drupal core at once to 10.6.19, 11.3.19, or 11.4.10 according to your release branch. Update the Entity List module to 3.0.10.

Apply the patches in a staging environment first if feasible, then deploy. Review custom code and other contributed modules that might expose the vulnerable Field UI functionality. Monitor logs for anomalous requests after patching.

What happened

Citizen Lab reported that Israeli advertising company Discover-Tech served as a delivery channel for Candiru zero-click spyware in an operation named AdFection. Targeted ads enabled device fingerprinting, de-anonymization, tracking of millions of devices, and selective infection.

Discover-Tech’s Controlium platform participates in real-time bidding auctions, collects identifiers, and injects JavaScript that contacts its infrastructure to decide whether to deliver spyware. Between 2024 and 2025 at least 45 devices inside Al Jazeera were hit this way. The firm appears to act as a bridge between ad vendors and mercenary spyware providers.

Who is affected

High-risk individuals and organizations targeted by Candiru customers, notably journalists and staff at Al Jazeera. Broader populations whose devices appear in ad-exchange bid streams can be fingerprinted and tracked at scale.

Why it matters

Commercial advertising infrastructure can be turned into a stealthy, zero-click infection vector that needs no user interaction. The combination of massive device profiling and mercenary spyware raises the bar for defenders protecting journalists, activists, and executives.

How it could have been prevented

High-risk users should run up-to-date hardened mobile and desktop configurations, limit ad exposure with strict content blockers or private browsing modes, and deploy mobile-threat-defense tooling that detects spyware indicators.

Organizations should restrict untrusted ad networks on managed devices, monitor for anomalous process or network behavior after ad loads, and treat zero-click risks as part of executive and journalist protection programs. Review third-party ad-tech relationships for unusual data flows.

What happened

ConnectWise disabled seven application identities after unknown attackers obtained unauthorized access to them and used the identities to compromise customer Microsoft 365 tenants. The company suspended Cloud Backup by revoking certificates, and temporarily took SaaS Security and Cloud Management offline while investigating.

The issue was identified on October 14, 2026; mitigations began October 17. Existing backup archives remain encrypted and show no evidence of attacker access, yet scheduled backups and restore functions are unavailable. Stolen application credentials let attackers request access tokens from Entra ID and reach customer tenants without stealing individual user passwords.

Who is affected

ConnectWise customers using Cloud Backup, Cloud Management, and related Microsoft 365 integrations, including many managed service providers and the organizations they support. Any tenant that granted the listed application identities is in scope for review.

Why it matters

A single set of compromised third-party application credentials becomes a skeleton key into many customer M365 environments. Operators face potential data access, persistence, mailbox or SharePoint abuse, and the operational outage of backup and management services until the vendor restores them safely.

How it could have been prevented

In each Microsoft Entra ID tenant, review and revoke the listed ConnectWise application permissions and any suspicious consents. Invalidate outstanding tokens and force re-authentication where needed.

Inspect M365 audit and sign-in logs for unusual application activity. Apply least-privilege consent policies going forward, enable continuous access evaluation, and follow ConnectWise’s remediation guidance before re-enabling integrations. Treat backup repositories as critical and verify their isolation.

What happened

SANS ISC handler Didier Stevens released a compact YARA rule that detects orphaned VBA projects embedded inside AutoCAD DWG files. The rule looks for the AC10 signature at offset zero, a zero DWORD at offset 0x24, the OLE compound-file magic bytes, and the ASCII string [Host Extender Info].

A VirusTotal retrohunt with the rule returned only two matching samples, indicating the technique is currently rare but detectable.

Who is affected

Malware analysts, SOC teams, and organizations that process AutoCAD DWG files and want to scan for this concealment method. Anyone who may receive DWG attachments containing hidden VBA.

Why it matters

Orphaned VBA projects can hide malicious macros inside CAD drawings that ordinary Office or macro scanners may miss. A free, precise YARA rule gives defenders an immediate way to hunt or block the pattern before it becomes more common.