Cybersecurity

United States – October 17, 2026 -- Coalition says policies it provided paid more than $315 million in cyber claims in 2025. The insurer is urging brokers to counter the belief that cyber insurance does not pay claims, an objection it says can stall coverage decisions.

Zero-indemnity closures reflect early intervention, Coalition argues

The National Association of Insurance Commissioners (NAIC) reported that 26% of cyber claims in 2025 closed with indemnity payments. Verizon reported a recorded pay-out on 55% of 2025 claims. Coalition says critics read claims closed without an indemnity payment as denials, when many reflect incidents contained early.

Global – October 17, 2026 -- Coalition Incident Response (CIR) has documented rival Business Email Compromise (BEC) attackers using the names of inbox rules as a chat channel inside the same compromised mailbox, and says the exchanges expose gaps in default email platform security.

Two intruders negotiate and fight through rule names

Abusing inbox rules to evade detection (MITRE ATT&CK T1564.008) is a widespread tactic. Attackers use it to hide, redirect or forward emails containing keywords such as "invoice" or "confidential." In one CIR investigation, an attacker aware of a second intruder appeared willing to cooperate so that neither ruined the payout. In another incident, two actors fought over an inbox in a prolonged argument recorded as a sequence of rule names.

Global – October 17, 2026 -- Coalition says its Wirespeed platform cuts alert noise by 99.99% before any alert reaches a customer queue, replacing analyst-driven managed detection and response (MDR) with automated verdicts and containment in milliseconds.

Coalition acquired Wirespeed to address a bottleneck it attributes to legacy MDR: human analyst capacity. Adding headcount widens the alert queue and raises prices for customers without speeding up response, the company argues. Forrester Research recognized Coalition in its report The Managed Detection And Response Services Landscape, Q3 2026.

Global – October 17, 2026 -- Citrix confirmed on September 27 that two critical NetScaler zero-day vulnerabilities, each scoring 9.5 in severity, were exploited in the wild. According to cyber insurer Coalition, the vendor's public communications lagged the first reports by at least 36 hours.

Two flaws allow remote code execution on unpatched NetScaler appliances

CVE-2026-88771 is a critical remote code execution (RCE) flaw that lets an unauthenticated attacker run arbitrary commands. CVE-2026-88772 is a memory overflow vulnerability that can lead to RCE or a denial-of-service condition. The Citrix patch also fixes six other flaws, bringing the total to eight.

NetScaler provides remote access to internal applications and desktops and is often exposed directly to the internet, which makes it a frequent target. Enterprises across all industries use it.

Global -- Coalition sent just 49 Zero-Day Alerts (ZDAs) between May 1 and August 1, 2026, even as Microsoft's July Patch Tuesday swelled to 569 vulnerabilities, and 94% of its policyholders did not receive a single one.

Microsoft's Patch Tuesday count nearly triples in one month

June's Patch Tuesday set a record with 206 vulnerabilities. July's release nearly tripled that to 569. Before Microsoft adopted multi-model AI for vulnerability discovery, it typically shipped around 100 fixes a month. Windows said in July that it would apply AI across security analysis to find flaws earlier and at greater scale, which Coalition says likely contributed to the jump.

Attackers are also moving faster. Anthropic disclosed earlier this year that Mythos could create working exploits for newly discovered vulnerabilities in hours rather than weeks.

Global – October 17, 2026 -- ConnectWise is investigating attempted unauthorized access to its Cloud Backup for Microsoft 365 service, formerly SkyKick Cloud Backup, after disclosing the incident on October 16. The company says containment measures are in place and it has no indication that partner backup data was accessed. The investigation is ongoing.

Community reports allege attacker used the backup app's Entra credentials

Separate reports in the MSP community describe an attacker using the backup service's Microsoft Entra application to enter customer tenants and exfiltrate email, SharePoint and Teams data. ConnectWise has not confirmed these reports.

ConnectWise published indicators tied to the suspicious authentication activity: source IP 144.172.64.128 and the user agents Python-urllib/3.12 and python-requests/2.31. The company notes that their presence alone does not confirm compromise.

Griffin -- Brightmoor Hospice, LLC began mailing breach notifications on October 16, 2026, after two employee email accounts were accessed without authorization and found to contain protected health information of certain patients.

Unauthorized access lasted two days in March 2026

Brightmoor discovered suspicious activity on or around March 25, 2026. Third-party specialists determined that the two accounts were accessed between March 24 and March 25, 2026. The company secured the accounts immediately and began reviewing their contents.

Review confirmed patient data on August 18, 2026

Brightmoor determined on August 18 that protected health information was present in the accounts. It then reviewed internal records to locate addresses for potentially affected individuals. Mailing began 59 days later. The company has not stated how many individuals are affected.

Little Ferry, N.J. – October 16, 2026 -- Eventide Communications has completed an independent SOC 2 Type 1 examination covering the security and availability of its cloud-based mission-critical recording and analytics solutions, giving public safety buyers third-party evidence of its controls.

A-LIGN audits cloud environment against Security and Availability criteria

The examination was performed by A-LIGN, a cybersecurity compliance and audit firm. It evaluated controls against the Security and Availability Trust Services Criteria and included an assessment of relevant HIPAA/HITECH safeguards.

The scope covers Eventide's broader cloud environment and the controls supporting its cloud-based solutions. These include Critical Insights AI™ and the cloud-hosted and virtualized NexLog® DX-Series recording solutions.

Chicago – October 16, 2026 -- Keeper Security has launched native integrations with Tenable that let cloud security teams remediate findings in seconds rather than the days or weeks manual workflows typically take, and that move static scan credentials out of Tenable policies into Keeper.

The integrations are available now to Keeper customers with active KeeperPAM licenses.

Tenable findings feed directly into Keeper's remediation engine

Cloud findings from Tenable now go straight into Keeper's remediation engine. Security teams can rotate credentials, enforce Just-In-Time (JIT) access and remove standing privileges without leaving the Keeper platform. Once remediation is complete, Keeper notifies Tenable and moves the finding to resolved status, with no manual follow-up or ticket management.

Vienna – October 16, 2026 -- Macao carrier CTM and Huawei have jointly developed a target IP architecture that integrates quantum key distribution (QKD) with communication networks, as CTM outlined a plan to make security a built-in network function rather than an edge-firewall add-on.

CTM presented the roadmap in a keynote at Network X 2026. The operator is moving its network from a traditional connectivity pipe to what it calls intelligent, deterministic and secure infrastructure, aimed at speeding up enterprise digital transformation in Macao.

CTM adds AGW and AI BNG capabilities to steer traffic and cut bandwidth costs

CTM is introducing AGW and AI broadband network gateway (BNG) capabilities to give the network service awareness and dynamic scheduling. The system steers traffic to optimal paths, with the stated goals of improving user experience and lowering international bandwidth costs.