Item 1
- Exploited
- In KEV
Google links BeyondTrust Remote Support zero-day to suspected China-nexus group
Google dates the exploitation to late August, and patch covers self-hosted versions through .
- CISA due date
Daily Brief
Monday, October 19, 2026
- Covers
- Fri, Oct 16, morning – Sun, Oct 18, afternoon (ET)
- Read time
- About 1 minute
- Editor
- Austin Simas
- Editions
- All editions
Added to KEV
2 additionsItem 2
- Exploited
- In KEV
FortiOS flaw used to plant a memory-only implant in a 2024 intrusion
Attackers first got in through FortiManager’s , Unit 42 says, and FortiOS and fix the flaw.
- CISA due date
Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.16
Vulnerabilities and patches
Items 3–4Item 3
- Exploited
- In KEV
Atlassian Data Center flaw’s CVE ID is now rejected, but its advisory stands
CISA added to KEV on Oct 15, a day before the rejection, and Atlassian’s advisory still recommends patching to a fixed version.
Item 4
- Public exploit
5 Linux kernel flaws now have public root exploits
The researcher’s write-up says the “Infinity Core” flaws also enable container escape, and no exploitation has been reported.
Breaches and campaigns
Items 5–7Item 5
- Attacks confirmed
Attacker used the ConnectWise Cloud Backup app to access Microsoft 365 tenants
A compromised credential let the attacker sign in as the app, and by Oct 17 Huntress had seen successful sign-ins in over 300 tenants.
Item 6
France says attacks on supermarket refrigeration controllers probably continue
CERT-FR says to take Copeland, Danfoss and Dixell controllers off the internet, and France’s finance minister put the toll at about 700 supermarkets.
Item 7
New York and Connecticut settled with XTIUM and a pediatric group over a breach
Boston Children’s Health Physicians and XTIUM will pay $2.1 million to New York and $540,000 to Connecticut over XTIUM’s August 2024 breach.