Today’s briefing covers 5 security issues reported in the last 24 hours, grouped by type: 1 breaches and data exposure, 1 ransomware and attacks, 2 patches and advisories, 1 scams and phishing. Each entry says who is affected and what to do, with links to the original reports.
Breaches and data exposure
OpenCode Console breach may have exposed OpenAI, Anthropic, Google API keys
Who is affected: 1.4% of OpenCode Console users, all of whom had a third-party AI provider key linked in Console.
An intruder reached a legacy OpenCode system on the night of October 16 and may have accessed provider keys users had saved in OpenCode Console, the hosted workspace service that passes those keys to OpenAI, Anthropic or Google. OpenCode emailed affected users on October 17 to revoke and replace their keys, and said keys stored locally in the OpenCode CLI or desktop apps were not involved because they never reach OpenCode. Some users have already reported unauthorized usage on their accounts.
What to do: Revoke each saved provider key in its own dashboard, issue a replacement, check requests and billing since October 16 for unauthorized use, and set per-tool spend limits so a copied key causes less damage.
Sources: thehackernews.com
Ransomware and attacks
Semperis: ransomware threats now target employees and their families
Who is affected: 1,200 IT and security professionals at organizations that had experienced at least one successful ransomware attack.
Semperis’ 2026 Ransomware Risk Report found that ransomware attackers threatened employees’ family members or friends at 37% of organizations surveyed. Respondents reported stalking, threats of physical harm, doxxing, and swatting, and a quarter said employees or their families needed medical or psychological treatment as a result. Some 69% of organizations reported multiple successful ransomware attacks within the previous year, and attackers can remain in restored systems through malware, backdoors and compromised accounts.
What to do: Document response roles for threats against employees’ family members, include those procedures in incident plans, and establish law enforcement contacts before an incident occurs.
Sources: helpnetsecurity.com
Patches and advisories
Unpatched Broadcom Wi-Fi WPS flaw lets nearby attackers run code as root on routers
Who is affected: Routers and access points using Broadcom Wi-Fi chips, including BCM3380, BCM3383, BCM33834, BCM3390, BCM65xx and BCM68xx families; Kaiser estimates millions of devices worldwide are affected.
Researcher Quentin Kaiser disclosed on October 16 that Broadcom’s Wi-Fi Protected Setup code mishandles reassembly of fragmented WPS messages, allowing an attacker in radio range to corrupt router memory and run code as root without the network password. He demonstrated reading the PSK from an Askey TCG3000 supplied by Orange Belgium and opening a remote shell over Wi-Fi against a Proximus BBOX3V+ from Sagemcom. No CVE has been assigned, and no fix has been deployed, with older eCos-based chips expected to remain unpatched.
What to do: Check with your router or ISP for a firmware update, restrict WPS to disabled until a fix is confirmed, and review your network for unauthorized devices.
Sources: thehackernews.com
Microsoft: October Windows Server updates break Exchange sign-in and mail flow
Who is affected: On-premises Exchange Server systems running on Windows Server 2019 and later that installed the October 2026 Windows Server security updates.
Microsoft confirmed that the October 2026 Windows Server security updates are causing Outlook on the web sign-in failures and mail delivery issues on some on-premises Exchange Server deployments, with a MapiExceptionMdbOffline error and Event ID 1006 appearing in logs. The cause is a default cap of 512 simultaneous Endpoint Lookup calls in the Windows Endpoint Mapper, which is too low for Exchange under heavy load.
What to do: Apply the registry workaround by setting EpmapSavedContextCap to 65556 and rebooting, or pause installation of the October 2026 Windows Server updates on Exchange hosts until Microsoft releases a permanent fix.
Sources: bleepingcomputer.com
Scams and phishing
Check Point: Microsoft tops brand phishing impersonations in Q3 2026
Who is affected: Users of brands most often impersonated in phishing campaigns tracked by Check Point Research in Q3 2026, with Microsoft accounting for 33% of attempts.
Microsoft was the most impersonated brand in phishing attacks tracked by Check Point Research in the third quarter of 2026, rising from 23% in the previous quarter and roughly four times the share of Apple or Google, which each came in at 8%. Technology brands were impersonated most often, followed by social networks and banking, and campaigns also abused Claude, Google Antigravity, Apple, Dropbox, YouTube and Docusign branding to harvest credentials, payment details or remote code execution. A Google Antigravity lookalike delivered a Linux command that ran a concealed payload, and a fake Docusign page pushed a FleetDeck remote monitoring installer.
What to do: Treat unexpected payment failure, support, or update prompts as suspect, verify any action in the official vendor site or app, and avoid running terminal commands copied from web pages.
Sources: helpnetsecurity.com