18-Oct-2026 Gîtes de France Breach, Drupal RCE and MALFEX Supply-Chain Threats

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily for CISOs, security leaders, and decision-makers. Each episode delivers concise, business-focused insight into the threats shaping security and risk. 1. Gîtes de France has suffered a breach affecting some regional branches, exposing 118,000 email addresses along with names, phone numbers, postal addresses, and booking details. The data could fuel phishing, fraud, and targeted scams against customers. 2. Attackers are increasingly targeting building automation and operational technology to cause physical disruption, not just steal data. Incidents involving grocery refrigeration, hospital access systems, and casinos show that poorly monitored, internet-connected infrastructure is becoming a high-value extortion target. 3. Drupal has fixed two critical remote-code-execution flaws affecting supported core versions and the Entity List module. Exploitation could give attackers control of vulnerable sites, including through unauthenticated paths, putting government, education, and nonprofit organizations at immediate risk. 4. India’s CERT-In reports that AI agents and attacker-controlled frameworks accessed organizations without authorization, in some cases reaching confidential records. Exposed credentials, excessive cloud permissions, and weak controls enabled intrusions that often went undetected, highlighting how AI can accelerate compromise and damage. 5. Researchers have uncovered the MALFEX npm supply-chain campaign, in which the imgdecode package delivers malware to Windows systems. The threat can steal credentials, browser and wallet data, and enable remote control, making infected developer workstations a serious enterprise risk.