← Tuesday 20 Octobernote 10 of 13
CybersecurityTue 20 Oct 2026 · 10 of 13

Siemens Software Center Vulnerability Exploited in ClickFix Malware Campaign

Verified · 6/6 supported1 cited · 1 min read

securityweek.com reports that a vulnerability in Siemens Software Center (CVE-2026-110936) was exploited in ClickFix malware attacks . securityweek.com reports that attackers paired a legitimate, signed copy of the program with malicious DLLs to infect Windows PCs . securityweek.com reports that the flaw allows an authenticated local attacker to place a malicious DLL in searched folders, resulting in code execution with Software Center privileges . securityweek.com reports that Siemens disclosed the vulnerability on October 15, assigning it a CVSS v4 score of 8.4, and later released version 4.0.9.8 which resolves the issue . securityweek.com reports that the fix is delivered automatically on the next launch for installed users, and that the advisory initially omitted mention of active exploitation before a blog post was added .

Why it matters. securityweek.com reports that the automatic delivery of version 4.0.9.8 will protect users from the ongoing ClickFix attacks, but only after the software is relaunched .

Earlier on Cybersecurity

Sun 18 Oct 2026Israeli ad firm Discover-Tech used to deliver Candiru spyware in "AdFection" campaignsecurityweek.com reports that Israeli advertising company Discover-Tech was used to deliver Candiru zero‑click spyware through targeted advertisements. securityweek.com reports that the operation delivering the spyware was dubbed “AdFection”. securityweek.com reports that Candiru spyware infected devices at Al Jazeera via these zero‑click ad attacks, according to Citizen Lab. securityweek.com reports that Discover-Tech’s ads allowed threat actors to fingerprint, de‑anonymize, and track millions of devices, with its Controlium platform enabling large‑scale de‑anonymization. securityweek.com reports that the company is likely a front for a broader espionage campaign linking ad vendors with spyware providers.Sat 17 Oct 2026Cyber Incident Cripples Federal Bankruptcy Noticing Center for a Weeksecurityweek.com reports that a cybersecurity incident affecting BAE Systems infrastructure caused an outage of the Bankruptcy Noticing Center (BNC). securityweek.com reports that the BNC, which is operated by BAE Systems as a contractor for the federal judiciary, was unable to generate or send notices for about a week. securityweek.com reports that the Administrative Office of the US Courts said all access to BNC systems and websites was unavailable. securityweek.com reports that the National Creditor Registration Service was offline, preventing users of the courts’ electronic filing system from generating creditor mailing lists. securityweek.com reports that BAE first notified the Administrative Office about the problem late on October 9, and several bankruptcy courts posted notices on October 13 describing the issue as a service disruption.Sat 17 Oct 2026UBC researchers detail "ICS‑Sniper" attack on cloud‑hosted SCADA systemssecurityweek.com reports that University of British Columbia researchers detailed a proof‑of‑concept attack called "ICS‑Sniper" targeting industrial facilities that rely on cloud‑hosted SCADA systems. securityweek.com reports that the attack exploits a compromised router to analyze VPN‑encrypted packet size, direction and timing to predict when critical commands or data will be exchanged and then drop payload‑carrying packets. securityweek.com reports that the researchers tested the attack on an emulated version of the SWaT water‑treatment testbed.
Next · Climate techHybrid Vehicle Share Grows Slightly as BEV and PHEV Sales Slip in US Q3 2026 →