The short version
Today in 5 stories
- Broadcom Wi-Fi flaw lets attackers take over routers without a passwordA Wi-Fi setup flaw in Broadcom-based routers allows takeover without the network password.
- Targeted ads used to deliver zero-click spyware without any user actionSpyware was delivered through ordinary online ads with zero user interaction required.
- DDoS attacks reported to be surging and overwhelming network defensesA new report says DDoS attack volume is rising faster than defenses can keep up.
- Critical Linux kernel flaw allows a virtual machine to read host memoryA Linux kernel bug lets a VM read memory from the machine hosting it.
- AI agent breaches raise new questions about who is liableBreaches involving AI agents are raising unresolved questions about liability.
Broadcom Wi-Fi flaw lets attackers take over routers without a password
A researcher disclosed a vulnerability in Broadcom's WPS implementation affecting routers, letting an attacker within Wi-Fi range extract stored passwords or gain a command shell without knowing the network key. Broadcom says a fixed implementation has existed since 2018, but exposure depends on whether individual manufacturers integrated and shipped it to deployed devices.
Targeted ads used to deliver zero-click spyware without any user action
An investigation found mercenary spyware delivered through online advertisements with no click, download or install needed, affecting devices at a media organisation. An advertising intermediary linked commercial ad infrastructure to the spyware operation, and the platforms involved have since been removed from major ad networks.
DDoS attacks reported to be surging and overwhelming network defenses
A report flagged in ISACA's SmartBrief notes a surge in DDoS attacks that is overwhelming existing network defenses, with details available in the referenced coverage.
Critical Linux kernel flaw allows a virtual machine to read host memory
ISACA's SmartBrief flags a critical Linux kernel vulnerability that allows a virtual machine to read memory belonging to its host system.
AI agent breaches raise new questions about who is liable
Coverage in ISACA's SmartBrief raises the question of liability when AI agents are involved in security breaches, alongside related material on accountability in AI agent activities.
The takeaway
What to do this week
Patch management needs to extend past servers and laptops to network hardware and firmware, where fixes can exist upstream but never reach deployed devices. Treat ordinary web browsing and ad-supported sites as a possible delivery path, not just email links.
Where this comes from
Compiled by Cyentrix from 5 newsletters received 19 October 2026 (ISACA, "The Cyber Security Hub™ via LinkedIn", ISACA SmartBrief on Cybersecurity). Summaries are drafted with AI assistance from the newsletter text and edited for length; follow the source links for the full reporting. Cyentrix is not the original reporter of these items.