24 October 2026 · Issue 24

Today's five AI headlines

What matters in AI today, explained for businesses. Every story with its original source.

01CISA: patch actively exploited Nextcloud and Arista VCO flaws now
02BlackX bootkit exploits missing Secure Boot revocations on Windows
03Quest Diagnostics says breach exposed patient records in Quanum LSM
04Meta delays AI-scraping business terms to 20 November after backlash

01Lead story1 min read

CISA: patch actively exploited Nextcloud and Arista VCO flaws now

CISA has added two critical, actively exploited bugs to its catalogue of vulnerabilities known to be used in attacks. The first, CVE-2026-110447 (CVSS 9.2), affects Collabora Online’s built-in CODE server in Nextcloud and can permit remote code execution through proxy.php; attackers have used it to plant web shells and hunt for credentials, password-manager data and crypto wallets. The second, CVE-2026-114625 (CVSS 9.9), is an SQL injection in on-premise Arista VeloCloud Orchestrator that needs network access and a valid session of at least Enterprise Read Only. Fixes are Collabora 26.4.303 and Arista 5.2.3.18, 6.1.3.10 or 6.4.2.12. U.S. federal civilian agencies are told to patch by 26 October 2026; any organisation running these products should treat the update as urgent.

thehackernews.com 24 October 2026

021 min read

BlackX bootkit exploits missing Secure Boot revocations on Windows

Kaspersky reports that a new Windows bootkit named BlackX was used against diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan in early 2026, and suspects the China-linked APT41 group. BlackX appears to be an updated BlackLotus variant: it abuses the Baton Drop Secure Boot bypass, CVE-2022-21894, to load code before Windows starts and to weaken built-in and third-party defences. The flaw itself is patched, but the researchers say many organisations have not performed the separate manual revocation step. Administrators must add the “Windows Production PCA 2011” certificate to the Secure Boot UEFI Forbidden List, or DBX; otherwise vulnerable binaries can still load even where the patch is present. The certificate expired on 19 October 2026, but that alone does not block those binaries. The bootkit is primarily a persistence and defence-evasion tool and requires prior administrator or physical access, so credential and endpoint controls still matter.

thehackernews.com 24 October 2026

031 min read

Quest Diagnostics says breach exposed patient records in Quanum LSM

Quest Diagnostics has confirmed that patient records were exposed after an unauthorised actor accessed its Quanum LSM system, which clinicians use to order tests and view results. The company says it learned of the access on 21 October 2026 and started incident-response work to contain it, investigate the scope and apply remedial measures. It has notified the SEC and law enforcement, and outside specialists are helping. Quest is still determining which data types were affected, though it believes some patient records were exposed. The company says customer-facing operations were not disrupted and that users of direct customer LIS interfaces or EMRs were not affected. With 7,700 sites, 65,000 employees and more than $11 billion in annual revenue, Quest is a large U.S. laboratory group serving roughly one in three adults each year. Healthcare providers and their vendors should review third-party portal access and breach-notification readiness.

bleepingcomputer.com 23 October 2026

041 min read

Meta delays AI-scraping business terms to 20 November after backlash

Meta has postponed enforcement of its new business terms until 20 November, after publishers objected that the wording could let the company scrape news sites for AI training. The terms had been due to take effect on 30 October. A Meta spokesperson said the delay gives more time to explain the changes to partners and stakeholders. Meta has removed language referring to training its products, but legal specialists quoted by The Verge argue that this does not exclude the possibility. The News/Media Alliance, representing publishers, sent a letter to Meta CEO Mark Zuckerberg demanding revisions and warning of severe harm to the news industry. For businesses that publish content or advertise on Meta’s platforms, the dispute matters because unclear contractual language can affect how their material is used and what leverage they have. The new date is not a final resolution; it is a window for further pressure and clarification.

theverge.com 23 October 2026

Newsletter

The five headlines, every weekday morning.

Free. Read in two minutes. Unsubscribe with one click in every issue.

Sign-up opens shortly — until then this page is new every morning.

Browse the archive Open the AI Wiki