> ## Content Index
> Fetch the complete content index at: https://secblog.reedcloudsec.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# SecBlog Weekly — Issue 008
- URL: https://secblog.reedcloudsec.com/secblog-weekly-issue-008/
- Published: 2026-10-21T16:29:57.000Z
- Updated: 2026-10-21T16:29:57.000Z
- Description: A BeyondTrust zero-day, a ConnectWise credential in 162 Microsoft 365 tenants, eight compromised CA keys, a backdoored OVHcloud CLI, and Rank Math, Docker, Ghostscript, Cairn and AdFection.
- Author: Marselis A. Reed
- Tags: News Roundup

*Week of Oct 20, 2026 · secblog.reedcloudsec.com*

The signal, not the noise, in security. 10 things from this week worth your five minutes.

---

[**China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers**](https://thehackernews.com/2026/10/china-linked-hackers-exploited.html?ref=secblog.reedcloudsec.com) (CVE-2026-102764, CVSS 9.3)  
BeyondTrust Remote Support, formerly Bomgar, has a flaw that lets a remote attacker perform file operations on an appliance without logging in. BeyondTrust's advisory, BT26-05, calls it improper origin validation in an internal messaging component and scores it 9.3 under CVSS 4.0\. By its timeline, the actor exploited a zero-day on August 29 against one BeyondTrust-hosted instance and one self-hosted appliance. Exploitation against another vendor's security devices became public on September 27, which started BeyondTrust's threat hunt, and the fix shipped October 8\. SaaS instances were patched automatically, confirmed as of October 9\. Self-hosted customers on versions 24.3.1 through 26.2.3 must apply the BT26-05-RS patch themselves, and older versions must upgrade first. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16 with an October 19 due date.  
BeyondTrust assesses with moderate to high confidence that the actor is Armory Castle, a China-nexus espionage group also tracked as UNC5221 and Warp Panda. It knows of two affected customers and has seen no activity since August, but it warns that this actor usually moves to broad exploitation once a flaw is public. Per Mandiant, the actor installed a web shell and a tunneler, gained root, harvested credentials from the appliance's secrets database, deleted logs, and used administrator credentials to open sessions on downstream systems. Shadowserver tracks more than 1,400 exposed instances.  
A remote-support appliance is a skeleton key by design: it holds credentials for the systems it manages. That puts it in the class of [last issue's Ivanti appliance](https://secblog.reedcloudsec.com/secblog-weekly-issue-007/#:~:text=Attacker%20Chains%20Three%20Ivanti) and [its SonicWall gateway](https://secblog.reedcloudsec.com/secblog-weekly-issue-007/#:~:text=Critical%20SonicWall%20SMA%201000%20Flaw), edge devices that store what attackers want. Mandiant advises treating any exposed appliance that ran a vulnerable version as potentially compromised. CISA's recovery steps match the rebuild-not-patch rule from [Issue 005's NetScaler item](https://secblog.reedcloudsec.com/secblog-weekly-issue-005/#:~:text=Two%20Citrix%20NetScaler%20Zero%2DDays): rebuild from a known-good state, rotate every credential the appliance stored, revoke active support sessions, and review new MFA registrations on privileged accounts. This actor deleted logs on the host, so forward syslog and session events off the appliance, as [Issue 002's F5 point](https://secblog.reedcloudsec.com/secblog-weekly-issue-002/#:~:text=Hackers%20breach%20F5%20BIG%2DIP%20APM) argued. And restrict the admin interface to trusted networks, the control from [Issue 004's Check Point item](https://secblog.reedcloudsec.com/secblog-weekly-issue-004/#:~:text=Check%20Point%20Warns%20of%20Hackers).  
*via BeyondTrust, The Hacker News, BleepingComputer, SecurityWeek, and CISA · Oct 16, 2026*

[**Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack**](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/?ref=secblog.reedcloudsec.com)  
Attackers used a credential belonging to ConnectWise Cloud Backup, formerly SkyKick, to sign in to customer Microsoft 365 tenants as the backup application, starting at least October 15\. The counts moved over time, and Huntress's own post tracks them. As of 19:00 UTC on October 16 it had confirmed unauthorized sign-ins in 162 tenants. On October 17 it saw sign-in activity from the same IP address in almost 1,000 tenants, over 300 of them successful. On October 19 it confirmed post-compromise activity in two of more than 10,000 reviewed tenants. The Hacker News reports 173 and credits Huntress, but that figure is not in Huntress's post. No attacker is named, and how the credential was obtained is unknown.  
Microsoft says the attacker likely abused permissions customers had already granted the app, including Directory.ReadWrite.All. In one tenant, a separate ConnectWise Cloud Management app added itself to Global Administrator and then added client secrets to an MSP management tool and to Huntress's own application, all within about five minutes. Huntress later found a second such tenant. ConnectWise suspended Cloud Backup on October 17, disabled seven application identities, and took Cloud Management and SaaS Security offline. It says it has no indication that backup data was accessed, but it can't see inside customer tenants and has given no restoration date. Disabling an app stops new tokens but not existing ones, BleepingComputer notes.  
The question this week is how many vendors hold standing credentials into your tenant. List the third-party applications in Entra with application permissions, especially directory-wide write access, and remove the ones you don't use. Huntress advises disabling, not deleting, the ConnectWise and SkyKick apps, checking service-principal sign-ins for the Cloud Backup application ID, `506e08f9-6e9a-4da4-942b-a099a03644ae`, and looking for any secret or certificate added to an app since October 13\. A vendor's app secret is the standing-credential problem the [GitHub Actions OIDC cheat sheet](https://secblog.reedcloudsec.com/github-actions-oidc-hardening-cheat-sheet/) addresses for CI/CD: it works from anywhere until someone rotates it. And a vendor's incident is your incident, the contractor lesson from [Issue 004's Astrana item](https://secblog.reedcloudsec.com/secblog-weekly-issue-004/#:~:text=Astrana%20Health%20Data%20Breach) and [Issue 006's FBI item](https://secblog.reedcloudsec.com/secblog-weekly-issue-006/#:~:text=FBI%20Blames%20Contractor).  
*via Huntress, BleepingComputer, The Hacker News, SecurityWeek, and The Record · Oct 17–20, 2026*

[**Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software**](https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html?ref=secblog.reedcloudsec.com) (Go: CVE-2026-111943)  
eMudhra, an Indian certificate authority that sells under the emSign brand, has had the private keys for eight of its intermediate CA certificates compromised. Intermediates sign the certificates that websites present, so whoever holds these keys can mint certificates for any site that trusts them. Six of the eight issue TLS certificates, and two sign code. A researcher identified only as Wayne proved they held all eight keys by signing the same message with each, and reported it to Chrome and Mozilla on October 17\. Chrome blocked the TLS intermediates that day through its CRLSet, Mozilla added them to OneCRL about three hours after the report, and Apple and Microsoft followed on October 19 and 20.  
The remaining risk is in clients that don't check revocation. Go 1.27.3 and 1.26.10, released October 20, reject chains through the eight keys, but a program keeps its old behavior until it is rebuilt, and Go 1.25 and older get no fix. Go's notes don't name eMudhra, and a maintainer wrote that the team was deliberately vague so attackers would not get a head start. Python's certifi and Rust's webpki-roots have dropped the emSign ECC root. Still unknown: how and when the keys left eMudhra, whether anyone else holds them, and whether any fraudulent certificate was issued. No TLS certificate chaining to the six TLS intermediates appeared in Certificate Transparency logs before Chrome's block, which Google says means Chrome would not have trusted one by default. A certificate that was never logged can't be found that way.  
Rebuild Go services and command-line tools on the patched toolchains, update trust bundles, and treat any client that embeds its own trust store as needing its own update. A container image built last month still carries the old list. Keep watching Certificate Transparency for your own domains, the tripwire from [Issue 007's ccTLD item](https://secblog.reedcloudsec.com/secblog-weekly-issue-007/#:~:text=Attackers%20Hijack%20.gh%2C%20.sl). The wider lesson: revocation protects only the clients that check it.  
*via The Hacker News and Dark Reading · Oct 20, 2026*

[**OVHcloud CLI releases backdoored on GitHub to steal developer secrets**](https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/?ref=secblog.reedcloudsec.com)  
On October 19, attackers used a compromised OVHcloud developer's GitHub account to replace the download archives on five existing releases of OVHcloud's open-source command-line tool, v0.11.0 through v0.15.0\. The replacements steal credentials. OVHcloud's advisory says the source code and build chain were untouched. The attacker built locally, uploaded the binaries, and also replaced `checksums.txt`, so the published hashes matched the malicious files. The repository had not been configured for release immutability. OVHcloud has now enabled it across its organization, and v0.16.0 is a clean, immutable release.  
The malicious window was 14:47 to 16:21 in UTC+2, which is 12:47 to 14:21 UTC, with about 250 downloads. The Hacker News gave UTC, and BleepingComputer's unlabeled times were local. A customer's CI job caught the swap because it pinned the SHA-256 of the Linux arm64 archive and began failing. The binaries collect AWS, Google Cloud, and Azure credentials, SSH keys, Docker, Kubernetes, npm, and Terraform configuration, and the local data of AI coding tools, including Claude, Cursor, and OpenCode. A folder named `envchecker-` followed by digits in the temp directory shows that the binary ran. OVHcloud traced the compromise to a GlassWorm-linked extension installed on the developer's personal Mac in October 2025; the attacker used stolen keys, not that machine. OVHcloud says it lets developers register personal GitHub accounts in the organization, which left the GitHub side less strict than its internal systems.  
If a swapped build ran, rotate every secret readable from that machine before reinstalling, preferably from a different machine, because updating doesn't revoke keys that were already copied. The consumer lesson is what the customer's CI job showed: pin hashes in your own repository, not in the release you are checking, since an attacker who can edit a release can edit its checksum file. For maintainers, OVHcloud's own list applies: immutable releases, signed commits, review of every account in the organization, and publishing rights tied to central identity management. We'd add keeping personal accounts off any release path. This is [PhantomSub in Issue 005](https://secblog.reedcloudsec.com/secblog-weekly-issue-005/#:~:text=PhantomSub%3A%20101%20Malicious%20npm) and [the Terraform providers in Issue 004](https://secblog.reedcloudsec.com/secblog-weekly-issue-004/#:~:text=Attackers%20Use%20Malicious%20Terraform%20Providers) from the maintainer's side of the same trust chain. Each long-lived key on a developer machine you replace with a short-lived credential, the direction of the [OIDC cheat sheet](https://secblog.reedcloudsec.com/github-actions-oidc-hardening-cheat-sheet/), is one less thing a trojanized tool can take.  
*via OVHcloud, BleepingComputer, and The Hacker News · Oct 20, 2026*

[**WordPress SEO plugin Rank Math compromised to backdoor websites**](https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/?ref=secblog.reedcloudsec.com) (CVE-2026-111862, CVSS 9.8 per Patchstack)  
Rank Math PRO, the paid edition of a WordPress SEO plugin, shipped a backdoored version, 3.0.123, to anyone who downloaded or updated it from the vendor's site between 20:02 UTC on October 15 and 07:12 UTC on October 16, about 11 hours. Rank Math says the free plugin on WordPress.org was not affected and that a limited number of users were, without giving a count. The malicious code runs when the plugin is activated, contacts `rank1cdn[.]com`, and recreates its hidden backdoor whenever someone visits the site. It exposes database credentials, API keys, and other secrets the web server can read. Rank Math pulled the files and released 3.0.124.  
Deactivating or updating doesn't remove the threat. The preferred fix is a backup from before 20:02 UTC on October 15, then a scan and rotation of all passwords, keys, and salts. Without one, first stop the malware rebuilding itself: delete the entire plugin folder and the three malicious `wp_options` entries (`_uf6qdn2hmm`, `t8krdk990phb`, and `_np5pvf754c`), and block outbound connections to `rank1cdn[.]com`. Then look for administrator accounts with a `wpsupport_` prefix or an `@wp-mail.net` address, a fake core file at `wp-includes/class-wp-cache-util.php`, `.htaccess` rules that run `.cache` files as PHP, and unfamiliar cron entries.  
How the files entered Rank Math's download system, and how many sites received them, is unknown. Rank Math hasn't published package hashes, and The Hacker News found no entry for the PRO plugin in WordPress.org's checksum service, so there is nothing independent to compare against. Paid plugins bypass the WordPress.org repository and its review. Where you can, hold automatic updates for paid plugins a day or two, which would have missed an 11-hour window; that suggestion is ours, not the vendor's. Also restrict the web server's outbound connections to what it needs. As [Issue 004's WordPress item](https://secblog.reedcloudsec.com/secblog-weekly-issue-004/#:~:text=Attackers%20Exploit%20WordPress%20CVE) argued, a WAF helps against exploited flaws, but this code came through the vendor's own channel, so file-integrity monitoring and restricted egress carry the load.  
*via Rank Math, BleepingComputer, The Hacker News, and SecurityWeek · Oct 19, 2026*

[**Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another**](https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html?ref=secblog.reedcloudsec.com) (CVE-2026-105445, CVSS 9.4 per the CVE record)  
Docker fixed a flaw in Docker Hub that let one user act as another at the registry. When an account was converted into an organization, Docker reassigned its personal access tokens (PATs) to the user named as owner, without rotating the secret or asking that user. An attacker could create an account and a token, convert the account into an organization naming a victim as owner, and then use the token as the victim, pulling, pushing, or deleting images within the token's scope. It gave no access to the web interface or to passwords, email addresses, or two-factor settings. Docker rates the flaw critical, and the 9.4 score comes from the CVE record.  
The flaw dates to August 26, 2024\. Docker says it received a report on September 30, 2026 and deployed a fix in under four hours. Its advisory credits Peter Molnar and Krisztian Hozak of mptrdev.com, who named the flaw GhostPat. Docker notified affected users on October 2 and deactivated the transferred tokens on October 8\. It found no evidence of exploitation after examining every conversion and about 304,000 pushes made with transferred tokens. One limit matters: registry logs show a token being used, not that it existed, so unused transferred tokens leave no trace. The researchers also say the named owner was never notified.  
Docker now requires consent before naming an organization owner and logs token ownership changes. Revoke any token you don't recognize, check the account switcher for organizations you don't remember joining, and use organization access tokens, which need a Team or Business plan, for automation. Beyond Docker's advice, pull production images by digest, not by tag, and verify signatures where your pipeline supports it; both are our suggestions. The case echoes [Issue 004's Terraform providers](https://secblog.reedcloudsec.com/secblog-weekly-issue-004/#:~:text=Attackers%20Use%20Malicious%20Terraform%20Providers) and [PhantomSub](https://secblog.reedcloudsec.com/secblog-weekly-issue-005/#:~:text=PhantomSub%3A%20101%20Malicious%20npm): the registry is part of your supply chain, and a personal access token is a standing credential that here changed hands unnoticed.  
*via Docker, The Hacker News, and BleepingComputer · Oct 12–13, 2026*

[**Ghostscript flaw lets hackers hijack servers via PDF uploads**](https://www.bleepingcomputer.com/news/security/ghostscript-flaw-lets-hackers-hijack-servers-via-pdf-uploads/?ref=secblog.reedcloudsec.com) (CVE-2026-39919, CVSS 9.8 per the CVE record)  
Wordfence researchers found a heap buffer overflow in Ghostscript, the PDF and PostScript interpreter that other software calls to render documents. A crafted PDF containing a JPEG 2000 image with mismatched component subsampling makes it write past a buffer, which can lead to remote code execution. Wordfence found the flaw on August 23 with its AI-assisted Argus system, Artifex fixed it in 10.08.0 on September 8, and Wordfence published its analysis on October 12\. The CVE record scores it 9.8 under CVSS 3.1 and 9.3 under 4.0\. BleepingComputer, relaying Wordfence, puts the affected range at 9.21 through 10.07.1; the CVE record sets no lower bound.  
The route to a WordPress site runs through an image library. WordPress can call ImageMagick through the Imagick extension to make a PDF thumbnail, and ImageMagick launches Ghostscript. Exploitation needs an attacker who can upload a PDF, anonymously or with a low-privilege account. Stock WordPress doesn't allow anonymous Media Library uploads, which narrows the exposure to sites that accept uploads some other way. Reliability is modest: Wordfence's two exploits ran 10,240 times against Linux distribution packages without achieving code execution, though they worked on a purpose-built test server. Wordfence has seen no exploitation. Treat the lull as time to patch.  
Find where untrusted files are rendered, including document converters, thumbnailers, print servers, and upload pipelines, and upgrade to 10.08.0 or later, or confirm that your distribution has backported the fix. Debian's tracker listed bookworm's 10.0.0 build as still vulnerable when we checked, so confirm your distribution's status, not only the upstream version. In containers, rebuild on a patched base image. If you can't upgrade, block PDF uploads or disable PDF rendering in ImageMagick. Beyond the advisory, render untrusted files in a sandbox with no network access and no secrets, which is our suggestion. The flaw belongs to the class of [last issue's LMCache flaw](https://secblog.reedcloudsec.com/secblog-weekly-issue-007/#:~:text=Unpatched%20Critical%20LMCache): untrusted input reaching a code-execution sink, here through a file format.  
*via BleepingComputer, the CVE record, and Debian's security tracker · Oct 13, 2026*

[**Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites**](https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html?ref=secblog.reedcloudsec.com)  
NorForge researcher Snorre Fagerland found more than 20 exposed control panels for Cairn, an open-source AI platform built for authorized penetration testing, that he assesses as likely malicious and groups into three clusters. The panels were left open with no login. The largest cluster links 14 dashboards to more than 1,100 attack projects, mostly against e-commerce and payment sites in the United States, Japan, and Australia. An operator gives an agent a goal, and the agents work toward it step by step, posting findings to a shared board where a human can add hints.  
The numbers vary by outlet, and NorForge's report shows where they come from. It counts attack projects, not breaches, names no victims, and verified only a few intrusions directly, including a web shell on a hardware-parts vendor's site. The figures of more than 1,200 sites tried and more than 100 companies reached are Reuters's, as The Hacker News relays them. The "hundreds of websites" wording in SecurityWeek and Dark Reading is not in NorForge's report. NorForge assumes a success rate near 10% and about $5 per task, and the largest cluster's successful projects averaged a little under 23 hours. Reuters named John Deere, SharkNinja, and Cummins. Deere saw no sign that sensitive information was accessed, SharkNinja says a standalone product-support site was affected and contained, and Cummins is investigating a possible attack on a vendor-run site. How much data was taken is unknown.  
The agents used familiar weaknesses: SQL injection, unsafe uploads, insecure deserialization, authentication bypasses, and template injection. Most tasks ran under a worker labeled `claudecode_deepseek-v4.1-flash`, which NorForge says could mean a Claude Code harness using DeepSeek 4.1 Flash. Neither NorForge nor Reuters confirmed the models.  
What changes is cost and persistence: an agent can chase a weakness for hours at a few dollars. Detectify's CEO gives the unglamorous answer: know every internet-facing asset, test continuously, fix the familiar classes, and treat leaked keys as urgent. The panels exposed hundreds of secrets, 11% of them still valid. The operators' mistake also warns anyone running agent tooling not to expose a control panel, since NorForge says some panels appeared to hold legitimate penetration tests. Agents that work for hours leave a long trail, the case [Issue 004's OpenAI-agent item](https://secblog.reedcloudsec.com/secblog-weekly-issue-004/#:~:text=OpenAI%20Agent%20Breached%20Australian) made for human log review on a short cadence. And [Issue 005's JadePuffer item](https://secblog.reedcloudsec.com/secblog-weekly-issue-005/#:~:text=JadePuffer%3A%20AI%20Agent%20Automates) still applies: audit every access control, because an agent will try each one.  
*via NorForge, The Hacker News, SecurityWeek, and Dark Reading · Oct 19–20, 2026*

[**One Compromised Login Exposed Millions of California Students' Records**](https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/?ref=secblog.reedcloudsec.com)  
Educational Testing Service (ETS), a nonprofit that runs California's statewide student assessments under contract with the California Department of Education (CDE), says an unauthorized party used a compromised login to copy student files from an ETS secure file transfer (SFTP) site between May 22 and September 18\. ETS spotted the activity on September 25, disabled the account, and took the site offline. CDE began notifying families on October 16\. The exposed fields include names, birth dates, home addresses, schools, student IDs, race or ethnicity, and English-learner status, and for some students disability status, testing accommodations, and test results. Social Security numbers, passwords, financial data, and parent information were not included.  
The headline numbers need care. SecurityWeek's headline says millions, and CDE cites more than 5.7 million students enrolled in 2025-2026 for context, but neither SecurityWeek nor The Record reports an affected count. CDE's notice describes all students enrolled in the three previous school years. SecurityWeek and The Record add former students back to 2006, a detail we couldn't confirm in the CDE pages we could read. Still unknown: how the credential was compromised, whether multi-factor authentication was in place, who is responsible, and whether the data has been published. CDE says monitoring has found no evidence of release.  
The shape is a single login and no tripwire for about four months. For a vendor moving sensitive files over SFTP, the checks are specific: keys or a second factor, not a reusable password; logins restricted to known addresses; alerts on unusual volume and off-hours transfers; and short-cadence log review. Those are our suggestions, since the sources don't say which were missing. The second lesson is retention: records you no longer need can't be stolen. For the agency, the vendor question from [Issue 004's Astrana item](https://secblog.reedcloudsec.com/secblog-weekly-issue-004/#:~:text=Astrana%20Health%20Data%20Breach) and [Issue 006's FBI contractor item](https://secblog.reedcloudsec.com/secblog-weekly-issue-006/#:~:text=FBI%20Blames%20Contractor) applies again: contractor training and access control, written into the contract and verified.  
*via SecurityWeek, The Record, and the California Department of Education · Oct 16–20, 2026*

[**Targeted ads installed Candiru spyware in zero-click attacks**](https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/?ref=secblog.reedcloudsec.com)  
Citizen Lab reports that Discover-Tech, an Israeli advertising firm, bought ad placements through mainstream exchanges and used them to deliver Candiru's spyware without a single click. Citizen Lab calls the campaign AdFection and says it is the first public technical confirmation of mercenary spyware delivered through targeted ads. Discover-Tech's Controlium platform put JavaScript in ads. When an ad rendered, the script contacted Discover-Tech's server, which checked the device's IP address and advertising identifiers to decide whether it was a target. Selected targets received more code, and other devices received nothing. Citizen Lab attributes a Windows DLL recovered from a compromised system to Candiru with high confidence.  
At least 45 Al Jazeera devices were targeted in 2024 and 2025\. Citizen Lab's report says targeted and gives no infection count, so The Record's "reportedly infected" goes further than the report. Between March and June 2026, Discover-Tech's ad-buying platform bid on about 3.77 billion impressions and won about 442 million, with attacker script tags shown in 75,373 apps and 120,768 websites. Citizen Lab estimates that hundreds of thousands to millions of users were directed to the relevant domains. Those are not infection counts. It also links another spyware vendor, Bindecy, to the platform. The Record adds that Confiant's targeting data suggests ads rendered on networks of government and international bodies, including the US Department of Defense; that shows rendering, not compromise. No report names a CVE or a browser exploit.  
Google ended Discover-Tech's access to its ad exchanges, IAB Europe removed it from its registries, Beeswax removed it, Eskimi blocked its accounts, and Vungle paused its access. Citizen Lab's recommendation for now, per SecurityWeek, is to block targeted ads at the gateway. For most organizations that is a policy for high-risk staff: journalists, executives, and anyone handling sensitive government or legal work. Enterprise or DNS-level ad blocking on managed devices fits, and endpoint detection on Windows is worth adding, since that is where Citizen Lab found the implant; the sources recommend only the ad blocking. AdFection resembles the social-engineering cases in [Issue 003's Revolut item](https://secblog.reedcloudsec.com/secblog-weekly-issue-003/#:~:text=Revolut%20Handed%20Customer%20Data), [Issue 004's Astrana item](https://secblog.reedcloudsec.com/secblog-weekly-issue-004/#:~:text=Astrana%20Health%20Data%20Breach), and [Issue 006's Arizona courts item](https://secblog.reedcloudsec.com/secblog-weekly-issue-006/#:~:text=Personal%20Information%20for%20Over%201%20Million) in one way: the attacker rode a channel the target already trusted. It differs in the way that matters for defense. In those cases a person was deceived, so training, call-backs, and access gates lowered the odds. Here nobody is deceived and nothing is clicked, so the control has to sit between the device and the ad network.  
*via Citizen Lab, BleepingComputer, SecurityWeek, and The Record · Oct 15–17, 2026*

---

*That's Issue 008\. Free weekly, no spam, unsubscribe anytime — secblog.reedcloudsec.com*