ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

thehackernews.com Oct 20, 2026

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Curated by Shubham · TechCapsules · Oct 20, 2026

AI-summarised brief · reviewed before publication

Siemens disclosed a high‑severity DLL sideloading flaw in its Software Center (CVE‑2026‑110936, CVSS 8.4) that attackers have exploited in ClickFix campaigns. The vulnerability allowed an authenticated local user to place a malicious DLL in a directory searched by the application, resulting in code execution with the service’s privileges. Siemens patched the issue in version 4.0.9.8 and warned that threat actors used a signed copy of the program to drop a crafted “archive.dll” alongside it. The attackers leveraged msiexec.exe to run an MSI that launched SiemensSoftwareCenter.exe, delivering a remote‑access trojan via the Romulus ClickFix platform. Huntress Labs researcher Jose Oregon reported the flaw, and Siemens provided IOCs and remediation steps, including blocking related IPs and domains.

💡 Why It Matters

· By hijacking a trusted, signed installer, the attackers bypassed typical defenses, demonstrating how legitimate software can become a covert conduit for sophisticated remote‑access malware.

Capsules Cybersecurity

Read full article on thehackernews.com

Google says Chrome’s Safe Browsing Enhanced Protection mode makes users 10x safer

Google announced enhancements to Chrome’s Safe Browsing Enhanced Protection, claiming a tenfold increase in safety against phishing, social engineering, notification abuse, and other scams. The update adds address‑bar warnings for suspicious sites, a shield icon in the Omnibox, and full‑page interstitials for dangerous sites. It leverages Gemini cloud models to analyze page content, brand intent, and scam likelihood, while keeping data ephemerally processed. The new system also blocks ClickFix scripts that trick users into executing malicious commands, protecting users in real time.

💡 By integrating advanced AI analysis and stricter in‑browser safeguards, Chrome significantly reduces the risk of sophisticated phishing and malware attacks that exploit user trust and system utilities. This shift strengthens the browser’s role as a frontline defense in the evolving threat landscape.

thehackernews.com · Oct 21

Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

Go released versions 1.27.3 and 1.26.10 on Oct 20, adding an urgent‑track change that blocks certificate chains containing any of eight intermediate CA keys. The keys belong to an unnamed authority; Go cites “specific security concerns” but gives no details. The filter hashes public keys, so cross‑signed copies are also rejected, and it applies to Go’s own verifier as well as macOS and Windows verification paths. No bypass exists, and even private trust stores will fail if they include the keys. The move follows Mozilla’s Oct 17 addition of six eMudhra emSign intermediates to its OneCRL, though neither party disclosed the underlying issue. Projects such as Bluesky’s indigo were rebuilt on the new releases, and older Go versions remain vulnerable for users.

💡 By silently revoking a set of intermediates, Go forces every Go‑based service to drop connections to any site using those keys, instantly reshaping trust assumptions across the ecosystem.

thehackernews.com · Oct 20

ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident

ConnectWise announced that it has reset credentials, strengthened administrative‑access controls, and replaced application credentials following a security incident that exposed Cloud Backup identities. The company began mitigation on October 17, three days after the breach was first detected, and reports no successful threat activity in monitored environments. Only Cloud Backup, SaaS Security, and Cloud Management were temporarily suspended; other products remain unaffected. Huntress identified specific IP addresses linked to the activity and noted post‑compromise actions in two tenants, though no evidence of data theft was found.

💡 The incident underscores the vulnerability of cloud‑based backup services to credential‑based attacks, prompting urgent scrutiny of access controls across SaaS platforms. It also highlights the need for rapid incident response and tenant‑specific investigations to prevent potential lateral movement within customer environments.

thehackernews.com · Oct 20

Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software

The private keys for eight eMudhra intermediate certificate authority certificates were compromised, Mozilla and Google confirmed on Oct 20. A researcher reported the breach on Oct 17; within hours Chrome and Firefox blocked the six TLS intermediates after verification. Because none of the compromised intermediates had any certificates logged in Certificate Transparency, no website could have been trusted by default in browsers that require CT. Google’s Go language issued an urgent security update matching the eight compromised hashes. Apple revoked the keys on Oct 19 and Microsoft on Oct 20, while other trust stores were notified. eMudhra has revoked the certificates, and browsers pushed revocation lists without requiring user action. The incident did not affect code‑signing intermediates, and no other CA showed other failures.

💡 A compromised CA key can let attackers forge trusted TLS certificates, and the rapid, coordinated revocation across major browsers prevented any malicious site from being accepted by users.

thehackernews.com · Oct 20

What Security Teams Can Do To Tame Wild Code

A sales manager creates an AI‑assisted workflow that routes leads, integrates with customer records, and posts updates to a shared channel, saving time and becoming routine. Across the organization, employees rapidly build apps, agents, and automations, outpacing existing governance. Security teams face questions about credentials, data access, and traceability. The article argues that education, sandboxes, and steering committees alone cannot control “wild code.” Instead, it calls for embedding controls—least privilege, secrets management, monitoring—directly into the development environment to manage risk throughout the software lifecycle.

💡 Rapid, employee‑driven AI builds can become critical dependencies before security is aware, exposing sensitive data and privileged actions. Integrating safeguards into the creation environment ensures that protection is built in, not added afterward, preventing costly breaches and compliance gaps.

thequantuminsider.com · Oct 20

NowSecure Finds No Detectable PQC Code in 97% of Mobile Apps

A NowSecure study examined 136,711 iOS and Android apps, finding that 96.9% contained no detectable post‑quantum cryptography (PQC) code. The analysis also uncovered weak legacy encryption algorithms in more than 3,100 apps. The report urges organizations to inventory cryptographic assets in mobile apps, remediate vulnerabilities, and plan a two‑year PQC migration. It highlights that mobile apps are often overlooked in security inventories and that quantum‑safety is critical before 2030, per federal mandates.

💡 The findings expose a large blind spot in mobile security, where apps that handle sensitive data remain unprotected against future quantum attacks. This gap could enable “harvest‑now, decrypt‑later” tactics, threatening national‑security and commercial assets.