Infostealer intelligence has become one of the important tool in cybersecurity as malware has become one of the most efficient tools in a cybercriminal's kit. A single infected laptop can leak saved passwords, browser cookies, autofill data, and enough machine details for an attacker to impersonate the user outright. Stolen session cookies are especially damaging because they let intruders skip multi-factor authentication entirely. That makes the choice of an intelligence vendor in this space an operational decision, not a box-checking exercise. 

Top 10 Infostealer Intelligence Vendors 

1. Cyble

Cyble is a preferred vendor for organizations that want infostealer data inside a broader threat intelligence workflow rather than as a standalone feed. Its Cyble Vision platform combines compromised credential monitoring with dark web surveillance, brand protection, and attack surface management, so a leaked employee login can be connected to related exposure elsewhere.   The company's research arm, Cyble Research and Intelligence Labs, publishes regular analysis of new stealer families and campaigns. For teams that need context across several threat categories in a single console, Cyble is a strong starting point. Buyers focused narrowly on deep machine-level forensics should test that capability directly during a trial.

2. Flare

Flare is a full CTI platform that treats stealer logs as a core dataset rather than an add-on. Its interface is one of the cleanest in the category, which lowers the learning curve for analysts. Coverage of stealer logs is broad, and the platform provides solid details about infected machines.

3. SpyCloud

SpyCloud focuses on identity threat protection and is particularly strong on session data. It tracks stolen cookies and helps organizations invalidate compromised sessions before attackers can use them. That focus makes it a natural fit for teams worried about MFA bypass. Its free public tooling is more limited than some competitors'.

4. Breachsense

Breachsense takes an API-first approach to dark web and stealer-log monitoring. Its backend is consistent and well-documented, which appeals to teams that plan to pipe alerts directly into a SIEM or SOAR rather than work in a vendor's dashboard.

5. Lunar (Webz.io)

Lunar is built on Webz.io's web data infrastructure and stands out for generous free access to compromised-credential monitoring. Smaller organizations can get meaningful visibility without a large contract. Its API is less mature than those of the leaders, so heavy integration work may take more effort.

6. SOCRadar

SOCRadar positions itself as an extended threat intelligence provider, and its infostealer data sits alongside external attack surface monitoring and digital risk protection. Machine context is a notable strength. Teams looking for a specialist tool may find the platform's breadth more than they need.

7. Constella Intelligence

Constella approaches infostealers through the lens of identity risk, drawing on a large repository of breach and exposure records. Session tracking and API capabilities are both well regarded, which makes it useful for fraud prevention and account takeover defense.

8. Recorded Future

Recorded Future is one of the best-known names in threat intelligence. Infostealer data is one module among many in its intelligence platform. Machine context and API quality are strong, though session-level detail trails the more focused vendors. Organizations already using Recorded Future for other intelligence may find it convenient to extend coverage here.

9. NordStellar

NordStellar comes from Nord Security, the company behind NordVPN. It has gained ground quickly, with strong session coverage and good machine context. It is a relatively new entrant, so buyers should weigh its fast development pace against a shorter track record.

10. KELA

KELA specializes in cybercrime intelligence gathered from underground forums and marketplaces. Its infostealer coverage benefits from that vantage point, and session tracking is solid. Machine context and API depth are moderate compared with the vendors ranked above it. 

What Buyers Should Take Away 

No single vendor wins on every measure. Teams that want infostealer intelligence connected to wider threat monitoring will find Cyble, Flare, and SOCRadar worth a close look. Those focused on stopping account takeover should prioritize session capabilities, where SpyCloud, Constella, and NordStellar perform well. Engineering-heavy teams should put API quality near the top of their criteria, which favors Breachsense and Recorded Future.  Whatever the shortlist, two capabilities deserve extra weight. The first is session coverage, because cookie theft is now a routine way to defeat MFA. The second is machine context, because knowing exactly which device was compromised determines how quickly a team can contain the damage. A trial run against a known set of exposed accounts remains the most reliable way to see how a vendor performs in practice.  (Disclaimer: This article is based on third-party research and publicly available information, credited where applicable. The Cyber Express does not endorse any product or service mentioned. Readers are advised to verify information independently and consult qualified professionals before acting on it.)

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution.

How GhostBat RAT Reaches Victims

The malware spreads mainly through smishing, or SMS phishing. Victims receive messages with malicious links that lead to pages impersonating the official Parivahan service or a Google Play-style download page. These pages push users to install a fraudulent mParivahan APK. Researchers also found GitHub repositories being repeatedly used to host the malicious files. Many of these apps are only first-stage loaders. The real payload stays hidden in encrypted files or is downloaded later, which makes the app look harmless during an initial scan. [caption id="attachment_114830" align="aligncenter" width="600"] GhostBat-RAT-Infection-Chain-1536x595[/caption]

GhostBat RAT's Ghost Overlay Trick

The most significant change in the latest variant is its abuse of Android's Accessibility Service, a technique commonly linked to modern Android banking trojan families. Earlier variants analyzed by Cyble did not have this capability. Its standout feature, called Ghost Overlay, targets Google Pay and MobiKwik. Instead of showing a fake login screen, the malware places an invisible 12-key grid over the real PIN keypad. When a user taps a digit, the overlay records it and then replays the same tap into the genuine app. The payment goes through normally, so the victim has no visible reason to suspect anything, while the PIN is quietly sent to the attackers' server.

GhostBat RAT Watches 60 Financial Apps

Beyond Google Pay and MobiKwik, a broader keylogging feature monitors 60 financial apps. Cyble's list includes PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay. The malware checks which app is open and the screen context before treating numeric input as a possible PIN. This builds on older capabilities that remain in play, including reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.

Inside the GhostX Network Behind GhostBat RAT

A key finding came from an exposed Firebase backend named "ghostx-panel." It contained administrator records, user roles, login logs with device fingerprints and bot-user mappings. Cyble says these separate roles point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model. While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign. Matching eChallan messages were also reported by users on social media.

Why GhostBat RAT Is Hard to Detect

Cyble identified at least six different loader designs. The newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears. Security tools that scan only the outer APK are unlikely to catch it consistently. The malware also uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.

Staying Safe From GhostBat RAT

Cyble advises users to install apps only from official stores such as Google Play and to avoid APK links received by SMS, social media or email. Users should be cautious about granting app permissions, especially Accessibility access, verify website addresses before entering sensitive details, enable multi-factor authentication on financial apps and keep their phones updated. Anyone who suspects infection should contact their bank and local authorities immediately.

A text alert about an undelivered package or an unpaid toll may look like a one-off scam. A new Microsoft cybercrime crackdown shows it is often the visible end of a much larger operation. Microsoft and Health-ISAC, a global non-profit that helps health sector organizations share cyber threat information and improve operational resilience, have moved to dismantle three services, YAM Store, CoGUI and Iron Man, that supplied criminals worldwide with accounts, hosting and tools to build fake websites and online identities. Since January 2026, the three services have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide. More than 750 million of those messages were aimed at Microsoft customers alone. Consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries were targeted, generating tens of millions of dollars for the operators.

How the Microsoft Cybercrime Crackdown Began

The investigation started in late 2025 after Japan's National Police Agency (NPA) alerted Microsoft to malicious messaging campaigns targeting people in Japan. The NPA continued providing intelligence and investigative support throughout the probe as partners traced those campaigns back to the businesses supplying criminals around the world. Investigators expected to find individual campaigns. Instead, they traced the activity to a sprawling Chinese-language marketplace that was difficult for non-native-speaking investigators to penetrate. The probe widened to include the Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Drawing on its network of more than 130 member organizations, JC3 linked what appeared to be separate incidents into a broader pattern of scams against Japanese companies and financial institutions. Health-ISAC provided insight into the impact on healthcare organizations.

What the Microsoft Cybercrime Crackdown Uncovered

YAM Store operated much like an online shop. Customers could browse products, compare prices and buy fraudulent Microsoft and Google accounts along with ready-made scam tools, including those used for credential theft. Controlled purchases by Microsoft helped confirm how it worked. In some cases, operators bought internet domains that legitimate organizations had allowed to expire, often in sectors such as non-profits and education, with specialized product offerings for those sectors. They rebuilt the websites to make those organizations appear active, then used them to fraudulently obtain Microsoft 365 accounts for resale. The infrastructure sold through YAM Store was frequently paired with CoGUI. This service supplied ready-made websites and messages impersonating companies, banks, government agencies and other trusted organizations. Rather than build fraudulent sites themselves, criminals could quickly deploy pages designed to steal passwords, payment details and personal data. CoGUI became one of the most widely used offerings in the ecosystem, particularly targeting victims in Japan and the United States. [caption id="attachment_114817" align="aligncenter" width="600"] Image Source: https://blogs.microsoft.com/[/caption] By mid-2026, CoGUI was increasingly being replaced by Iron Man, which offered thousands of phishing templates tailored to specific brands, industries and countries. Criminals could use them to quickly deploy email, text and web content. Through test purchases and work with Resecurity, investigators identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across more than 150 countries. Others mimicked airlines, telecommunications companies and parcel delivery services. Some were built for government impersonation scams, using the look of official authority to pressure victims into paying or sharing sensitive information. Microsoft noted that an organization appearing in these templates does not mean its systems were compromised.

Court Order Backs Microsoft Cybercrime Crackdown

Acting on an order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that formed part of the infrastructure behind the three services. Microsoft has disabled more than 20,000 accounts linked to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud, while removing infrastructure hosted on its services. Microsoft also shared intelligence with the U.S. Secret Service and international law enforcement partners. Investigators used AI tools to connect accounts, websites and infrastructure that initially appeared unrelated. The case reflects a trend highlighted in this year's Microsoft Digital Defense Report: modern fraud increasingly relies on businesses and services that help criminals reach more victims. No single organization saw the full picture of this transnational cybercrime network, and uncovering it required two-way information sharing across industries and borders. YAM Store, CoGUI and Iron Man are only part of a larger criminal ecosystem. Still, the Microsoft cybercrime crackdown makes it harder for criminals to obtain the accounts, tools and infrastructure that keep scam messages flowing. Microsoft Threat Intelligence has published a blog with further details on the network and steps customers can take to protect themselves.

X has suspended more than 13,000 accounts tied to three suspected foreign influence operations linked to Iran, Russia, and China. With the US midterms approaching, the platform said the fake X accounts were trying to shape political debate in the United States. The crackdown came one week after OpenAI announced it had disrupted two similar influence campaigns from Russia and Iran.  The company announced the suspensions on Wednesday while outlining its plans for the November 3 US midterm elections. According to X, its investigations found that the networks used fake accounts to publish and amplify political content aimed at candidates and public figures "across the political spectrum." 

Fake X Accounts Targeted Candidates Across Party Lines 

X said it detected the accounts through "proactive sweeps and investigations" carried out under its rules against spam and coordinated inauthentic behaviour.  In a statement on the suspensions, X Global Government Affairs said: "Free speech is the bedrock of a functioning democracy, and we are proud that X is the global town square where these debates happen. Our job is to keep that conversation authentic, open, and safe."  Along with removing the fake X accounts, the platform set out its rules for the US midterms. These rules ban misleading information about how, when, or where to vote. They also cover attempts to suppress voter turnout and acts of voter intimidation, including calls for violence near polling stations.  Users who come across questionable election-related posts can report them through the "civic integrity" option and request a community note that adds context. In urgent cases, X said it may also label posts that break its election rules. 

OpenAI's Recent Action and X's Earlier Crackdowns 

X's announcement followed a similar move by OpenAI a week earlier. OpenAI said it had shut down two alleged influence operations from Russia and Iran that used ChatGPT to create fake journalist personas. One of the operations also ran a "think-tank" that covertly spread anti-Ukraine propaganda.  This is not the first time the platform has acted against suspected foreign networks. In 2021, Twitter, as X was then known, said it had suspended 238 accounts purportedly operating from Iran.  The latest suspensions are much larger than that earlier action. The actions by X and OpenAI also show that foreign influence efforts are now spread across several technology platforms, from social media networks to AI tools, as the US midterms draw closer. 

The OLVX marketplace, an illicit online platform used to sell stolen personal data, login credentials and cybercrime tools, has been dismantled following a coordinated investigation by North Macedonia’s Ministry of Interior and the US Federal Bureau of Investigation (FBI). Authorities have filed criminal charges against a 20-year-old suspect from the Tetovo area, alleging involvement in computer fraud, misuse of personal data and the production and distribution of child sexual abuse material. According to North Macedonia’s Ministry of Interior, the Cybercrime and Digital Forensics Sector submitted the charges against E.A., from the village of Golema Rečica, to the Basic Public Prosecutor’s Office in Tetovo. The investigation focused on the suspect’s alleged administration of the OLVX marketplace, which operated between 2023 and 2025. The operation began after the FBI provided intelligence that prompted a joint investigation into the platform and its associated criminal activities.

OLVX Marketplace Offered More Than 1,500 Stolen Login Credentials

Evidence gathered during the investigation indicated that the suspect administered domains and websites associated with OLVX between 2023 and 2025. The platform functioned as a cybercrime marketplace, where users could buy and sell stolen digital information, software tools and services intended to facilitate criminal activity. The marketplace primarily served cybercriminals seeking personal information and stolen login credentials that could provide access to victims’ online accounts and computer networks. During its operation, more than 1,500 sets of stolen login credentials were offered for sale, according to the authorities. The platform also used a cryptocurrency-based payment arrangement. Rather than operating an escrow service, as many underground marketplaces do, OLVX allowed users to load funds onto the site and use those funds to pay one another. The arrangement provided an alternative payment mechanism for transactions conducted through the platform.

Telegram Group Allegedly Offered Cybercrime Tools

The investigation also examined the suspect’s alleged activities on Telegram. Authorities said that between 2025 and 2026, the suspect administered an illicit online group called ONEMILI, which offered software tools and services designed to facilitate cybercrime. These included fraudulent refund schemes, according to the Ministry of Interior. Investigators also obtained evidence indicating that the suspect had acquired and possessed child sexual abuse material (CSAM) for personal use through Telegram. The allegations form part of the criminal charges filed with the prosecutor’s office. The available information does not specify whether the suspect has been arrested or whether court proceedings have begun.

FBI Investigation Highlights Cross-Border Cybercrime Enforcement

The operation marks the first jointly coordinated cybercrime operation between North Macedonia’s Ministry of Interior and the FBI, according to the ministry. The case demonstrates how intelligence sharing between law enforcement agencies can support investigations into online platforms operating across jurisdictions. Authorities have increasingly targeted illicit online marketplaces that facilitate the exchange of stolen information, cybercrime tools and tactics. Over the past five years, law enforcement agencies have taken down dozens of such marketplaces, which have become focal points for cybercriminals trading data and services. In a separate development, Microsoft announced the takedown of three popular Chinese phishing sites used by cybercriminals to send hundreds of millions of malicious messages impersonating more than 75,000 organizations worldwide. Although the cases involve different platforms and activities, both illustrate law enforcement and technology companies’ efforts to disrupt online infrastructure used for cybercrime. The North Macedonia investigation highlights the role of international cooperation in identifying platform administrators and disrupting services linked to the trade in stolen data. The Ministry of Interior said its Cybercrime and Digital Forensics Sector would continue working to combat cybercrime, protect personal data and improve digital safety.

Overnight, while shoppers slept, hundreds of French supermarkets were quietly cooking their own stock. In a French supermarket cyberattack confirmed by retailers on Monday, hackers took remote control of internet-connected refrigeration systems and pushed fridge and freezer temperatures as high as 50 degrees Celsius (122F). By morning, tonnes of food had perished, some equipment had melted, and in some stores the heat had sparked fires. The cyberattack did not rely on a new exploit. It targeted ageing connected devices that were still online years after their manufacturer stopped supporting them, a weakness experts say is common across retail and industry.

What Happened in the French Supermarket Cyberattack

The attackers struck when shops were closed, raising temperatures remotely through the refrigeration control systems. French TV channel BFM reported that they appeared to trigger a forced defrost option, keeping units heating instead of cooling. Five of France's major retail groups were hit: E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected. Coopérative U reported more than 100 stores, Carrefour said 80, and Monoprix said about 5 percent of its roughly 490 stores were targeted. The full scale is still unclear. Some reports put the total above 500 shops. Bruce Hallas, CEO at Re-thinking the Human Factor, who lives in France, noted on LinkedIn that current estimates sit around 400 stores, with some individual branches reporting losses of about €250,000. Retailers say millions of euros worth of food was spoiled.

Danfoss Refrigeration Controllers at the Center

France's government cybersecurity agency, ANSSI, identified the targeted systems as Danfoss refrigeration controllers, including the AK-SM800 and AK-SC355 models. The Danish manufacturer told AFP that most affected units were legacy products running outdated firmware, and that it had previously advised supermarkets to update them. ANSSI has urged companies using the affected models to disconnect them from the internet or restrict access, and to install software updates immediately. Authorities have opened an investigation and are liaising with other European countries that may have been affected. It remains unclear who carried out the attack. The incident follows President Emmanuel Macron's order last month to protect France's critical infrastructure from Russian "hybrid attacks." Officials have not linked the supermarket attack to any group or country.

Exclusive: Why These Devices Were Left Exposed

In comments shared exclusively with The Cyber Express, Neil Carter, Managing Director of CRAReady.co.uk, explained why systems like these remain vulnerable for so long. "Most of these devices were never designed to be updated in the field. A supermarket refrigeration controller is installed by a contractor, commissioned once and then left alone for ten or fifteen years. Nobody owns it as an IT asset, so nobody is watching for firmware releases. There's also a mismatch in lifetimes. The hardware lasts far longer than the vendor's support for it. Danfoss ended support for the AK-SM 800 in 2021 and the AK-SC 355 in 2016, but those boxes were still running cold chains in 2026. The third problem is how they're connected. Remote access is added for the maintenance company's convenience and simply left open to the internet. Updating carries risk too: if a firmware update fails on a controller running a store's freezers overnight, the stock is lost. So the safest-looking choice is always to leave it alone."

A Night-Long Threat to the Cold Chain

The overnight timing turned a technical breach into a major cold chain failure. Mark Eccleston, Senior Software Engineer at OxBlue, pointed out on LinkedIn that a fridge can go about four hours without power before food is at risk. "Hackers got a whole night with hundreds of them," he wrote. Retailers were forced to discard fresh and frozen products to avoid health risks, and the incident has raised wider questions about how much of Europe's food supply depends on internet-connected equipment running legacy firmware.

What Businesses Should Learn From the French Supermarket Cyberattack

Carter outlined clear steps for businesses running connected equipment: "First, know what you have. Treat building and plant controllers as part of your attack surface and keep an inventory with support end dates. Second, nothing operational should be directly reachable from the internet. Remote maintenance should go through a VPN or be restricted to the contractor's addresses. Third, ask about end of life when you buy, not after. Under the EU Cyber Resilience Act, manufacturers will have to declare a support period that matches realistic product lifetimes. Buyers should already be asking for that in writing. This attack didn't need a zero-day. It needed old, forgotten kit on the open internet, and there's a lot of that out there."

SAP released its October 2026 security patch on Tuesday, October 13, delivering 22 new and updated security notes. Four of them address critical-severity vulnerabilities. The most severe is CVE-2026-89111, a maximum-rated flaw in the Cloud SDK for Python. Several of the bugs could allow attackers to invoke internal operations or execute code, which could lead to complete compromise of affected systems.  SAP's patch day summary breaks the release down into 16 new security notes, four GitHub security advisories, and two updates to previously released notes. The company recommends that customers visit its support portal and apply the patches as a priority. 

CVE-2026-89111 Puts Cloud SDK for Python Users at Risk 

CVE-2026-89111 has a CVSS score of 10.0. It is an OAuth2 server-side request forgery (SSRF) vulnerability affecting multi-tenant BTP applications that use Cloud SDK for Python versions earlier than 0.45.2. It is tracked under GitHub advisory GHSA-4mv3-jxxm-9cx2.  SAP describes the risk in its advisory: "An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated." 

Other Critical Fixes in the SAP Security Patch 

Note 3797111 resolves CVE-2026-89110 (CVSS 9.9). This is a broken access control issue in certain portal functionality of NetWeaver Visual Composer, version VC70RUNTIME 7.50.  Note 3805589 fixes CVE-2026-89107 (CVSS 9.9), a code injection bug in S/4HANA's Manage Substitution/Validation Rules. It affects S4CORE versions 105 through 109.  Note 3798788 covers CVE-2026-89108 (CVSS 9.1), a missing authorization check in the Configuration Service of SAP Manufacturing Integration and Intelligence (XMII 15.4 and 15.5). 

High-Severity Vulnerabilities 

Three notes are rated high. Note 3800517 patches CVE-2026-89113 (CVSS 8.8), an SQL injection flaw in Commerce Cloud's OOTB code (COM_CLOUD 2211-JDK21).  Note 3765424 addresses CVE-2026-58249 (CVSS 7.5), a memory corruption bug in the Internet Communication Manager of NetWeaver and Web Dispatcher. It affects a wide range of components, including HDB 2.00, KRNL64UC 7.53, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, and CONTSERV 7.53 and 7.54. It also covers WEBDISP 7.53, 7.54, 7.77, 7.93 and 9.16, and KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19 and 9.20.  Note 3626303 fixes CVE-2026-89120 (CVSS 7.1), a missing authorization check in the ABAP Platform (KERNEL 7.93 and 9.16). 

Medium and Low-Severity Notes 

Cross-site scripting (XSS) makes up a large share of the remaining fixes: 

• CVE-2026-76972 (6.5) affects Manufacturing Integration and Intelligence (note 3798823). 
• CVE-2026-89117 (6.1) affects the Enterprise Portal, EP-ADMIN 7.50 (note 3779985). 
• CVE-2026-76975 (6.1) affects the SAPUI5 Support Assistant Overlay (note 3794572). 
• CVE-2026-76976 (5.4) affects NetWeaver AS ABAP applications based on SAP GUI for HTML (note 3671819). 
• CVE-2026-89106 (4.4) affects SAPUI5 (note 3799054). 

Two updated notes also deal with older issues. Note 3689080, first released in March 2026, covers CVE-2026-24316 (6.4), an SSRF flaw in NetWeaver AS for ABAP that spans SAP_BASIS 740 through 918. Note 3629325, from September 2025, addresses CVE-2025-42938 (6.1), an XSS bug in the NetWeaver ABAP Platform.  The Enterprise Portal receives two more fixes. Note 3790401 resolves an open redirect, CVE-2026-89122 (6.1), and note 3789825 resolves an information disclosure flaw, CVE-2026-89118 (5.3). Both affect EP-RUNTIME 7.50.  The other GitHub advisories cover three open-source components: 

• CVE-2026-89112 (6.5) is a broken access control flaw in CLA-Assistant versions up to 2.13.1 that exposes signers' PII. 
• CVE-2026-89116 (5.9) is an OS command injection bug in Yeoman-UI version 1.25.1 and earlier. 
• CVE-2026-89105 (4.2) is an improper authentication issue in the HybridTokenAuthenticator of the cloud-security-services-integration-library, affecting versions 3.6.6 up to, but not including, 4.1.1. 

Missing authorization checks were also fixed in two more products. CVE-2026-89121 (4.7) affects S/4HANA Linear Asset Management (S4CORE 109), and CVE-2026-89124 (4.3) affects Global Trade Services, edition for SAP HANA (GTSCORE 200 and 300).  The only low-rated note, 3767634, addresses CVE-2026-58242 (CVSS 3.5), an improper authorization check in Cloud Connector 2.0. 

North Korean IT workers are paying Americans to help them get and keep remote jobs at U.S. companies, the FBI said in an updated FBI public service announcement. At the same time, the Justice Department announced charges, two arrests, and the seizure of about 187 computer devices linked to the scheme. The FBI said these workers use stolen identities, extort victims, and threaten physical violence to demand payments. North Korea's government receives an estimated 85 to 90 percent of the revenue they generate, money that helps fund its nuclear weapons and other military programs.

How North Korean IT Workers Use American Facilitators

According to the FBI, North Korean IT workers are hiring Americans for a growing list of tasks. These include appearing on camera, sitting for job interviews, verifying fake identities, lending social media or professional networking accounts, shipping packages, completing urinalysis tests or fingerprint submissions, and keeping work laptops online from their homes. [caption id="attachment_114769" align="aligncenter" width="600"] Image Source: FBI Cyber Division[/caption] The FBI said some workers deliberately target people under financial stress, looking for those more likely to follow instructions without questions if paid. Taking part in these activities is illegal. Home setups that host company laptops, known as laptop farms, have helped the workers hide their locations for years. The FBI said they now run more laptop farms with fewer laptops at each to avoid single points of failure. Some also land remote IT jobs and then subcontract the work to freelancers in Pakistan, India, Nigeria, or nearby countries for a fraction of the salary.

Extortion, Threats, and Identity Theft

Identity theft sits at the center of the scheme. Most names and addresses given to employers come from stolen identities, and workers often buy accounts from identity verification providers to check that stolen details will pass background checks. The FBI said that after being fired, some workers made death threats against former managers and their families to collect more money. Others threatened to leak sensitive corporate data unless paid large lump sums. Some hired U.S.-based facilitators to show up in person at victim companies to intimidate staff. The workers also target jobs requiring U.S. government security clearances, positions with cleared defense contractors, and active-duty U.S. military members to host laptops.

Justice Department Charges Linked to North Korean IT Workers

In Ohio, a four-count indictment charges a scheme that ran from 2019 to around July 2025. U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested. Ten China-based individuals were also charged, and two more defendants remain under seal. Prosecutors say the scheme affected more than 70 U.S. employers and generated about $3 million, believed to have gone to sanctioned DPRK-controlled entities. Victims included health care, communications, cyber support, retail, and manufacturing firms across Ohio, 16 other states, and the District of Columbia. Under Operation Lonestar Roundup, the FBI carried out searches and other actions at more than 40 Texas residences between Sept. 21 and Sept. 25. Agents seized about 187 laptops and KVM devices. Cybersecurity firm CrowdStrike tracks the group as "Famous Chollima. FBI Cyber Division Assistant Director Brett Leatherman said 14 individuals have been charged and called close coordination with the private sector central to the operation.

What Companies Should Know About North Korean IT Workers

The FBI said no single red flag reliably identifies North Korean IT workers. It recommends an "identity in depth" approach, using layered checks throughout employment. Warning signs include remote desktop tools such as AnyDesk and TeamViewer, KVM over IP devices like TinyPilot and PiKVM, unrelated software on work devices, and frequent changes in bank accounts or addresses. Using E-Verify, requiring a U.S. passport, and live identity checks can add friction, the FBI said, while relying only on name ban lists may block real applicants. Individuals who receive threats should call 911. Victims or anyone approached can contact a local FBI field office and file a complaint at www.ic3.gov. The State Department has offered rewards of up to $5 million for information that disrupts North Korea's illicit financial activities.

Microsoft's October 2026 Patch Tuesday fixes 1,413 Microsoft CVEs. That is a new record, set only one month after September's previous high of 974, and it represents a jump of roughly 45%.   The release covers Windows, Microsoft 365 and Office, SharePoint Server, SQL Server, Exchange Server, Azure, Defender and developer tools. It also republishes one non-Microsoft CVE. Two of the fixes are zero-days: one is under active exploitation and the other has been publicly disclosed. 

Severity Breakdown for October 2026 Patch Tuesday 

Of the 1,408 CVEs with severity ratings, 78 are Critical, 1,329 are Important and one is Moderate. All 1,408 require customers to install an update. Sixty-five of the Critical flaws allow remote code execution (RCE). The other 13 involve elevation of privilege or spoofing.  Elevation of privilege leads with 673 CVEs. It is followed by remote code execution (315), information disclosure (252), denial of service (72), security feature bypass (40), tampering (29) and spoofing (27). The first two types make up about 70% of the release. That combination is dangerous because RCE gives an attacker initial access and privilege escalation turns that access into full control.  Windows accounts for 1,102 vulnerabilities across 39 updates. The rest break down as follows: Office (134 vulnerabilities, 11 updates), developer tools (61, 60), SharePoint Server (36, 1), other products (32, 25), SQL Server (22, 8), Azure (15, 20), Exchange Server (7, 8), Defender (4, 3) and Edge (0, 1). Together that comes to 1,414 vulnerabilities and 176 updates. Microsoft's own figures don't fully match. The release notes cite 1,413, the product breakdown totals 1,414 and the published CVE list contains 1,411. This article uses the release-notes figure. 

Two Zero-Days, Both Rated Important 

CVE-2026-96951 is a security feature bypass in Windows Shell, and attackers are actively exploiting it. It defeats Mark of the Web, which means malicious files arriving by email or chat can open without the usual warnings. Users still have to open the file, so the flaw works well alongside phishing. It should be patched on every Windows endpoint first. CVE-2026-108398 affects the .NET Framework. It has been publicly disclosed but has not been exploited. It could let an authenticated attacker bypass Windows Defender Application Control and run code inside a protected process. That makes it a concern for organizations that rely on allowlisting to contain intruders. Both flaws are rated only Important, which shows that exploit status should matter more than severity labels. Neither appeared in CISA's Known Exploited Vulnerabilities catalog at publication, although additions often follow within days.

Critical Flaws in Network, Identity and SharePoint Server 

Windows DHCP Server has five Critical RCE flaws: CVE-2026-96934, CVE-2026-88117, CVE-2026-88120, CVE-2026-88119 and CVE-2026-88171. The DHCP Client has one more (CVE-2026-70250). Several other network services also carry Critical RCEs: Microsoft QUIC (CVE-2026-105016, CVE-2026-100219), Remote Desktop Gateway (CVE-2026-70187), Message Queuing (CVE-2026-108460, CVE-2026-100202) and RMCAST (CVE-2026-69789). Systems reachable from outside the network should be patched early.  Identity services are affected too. Active Directory Domain Services (CVE-2026-70229) and NDES (CVE-2026-69802) have RCE flaws, and AD FS has two spoofing bugs (CVE-2026-108131, CVE-2026-96222). Exchange Server (CVE-2026-70571) and Windows Deployment Services (CVE-2026-88174) each have a Critical RCE. SharePoint Server has a Critical elevation-of-privilege flaw (CVE-2026-102866).  Hyper-V receives fixes for host-level RCE (CVE-2026-102214, CVE-2026-105733), which could put every guest VM at risk, and for privilege escalation (CVE-2026-108399). VBS Enclave has five Critical elevation-of-privilege flaws: CVE-2026-108471, CVE-2026-108130, CVE-2026-102211, CVE-2026-96914 and CVE-2026-88074. Four more affect the Windows Kernel, Graphics Kernel, ALPC and the WSL Linux kernel (CVE-2026-96913, CVE-2026-88073, CVE-2026-83917, CVE-2026-62840), and these could give an attacker SYSTEM or root access.  Office apps account for 34 Critical RCEs: 19 in Excel, 5 in Outlook, 4 in PowerPoint, 3 in Word and 3 in Visio. The Mark of the Web bypass makes these more dangerous. Another ten affect media and rendering components, including Media Foundation, GDI+, Codecs, Windows PDF, Text Shaping and Raw Image Extension (CVE-2026-96202, CVE-2026-96943). They can be triggered just by opening a crafted file, with no macros involved. The PostScript Printer Driver, which is often overlooked, has three more (CVE-2026-70153, CVE-2026-70147, CVE-2026-108467). 

Singapore opened SICW 2026 with a blunt message: no government, company or country can see the full picture of today's cyber threats, and artificial intelligence is now raising the stakes for defenders and attackers alike. Speaking at the opening ceremony of the 11th Singapore International Cyber Week on 13 October 2026, Gwenda Fong, Commissioner of Cybersecurity and Chief Executive of the Cyber Security Agency of Singapore (CSA), called for stronger international cooperation as threats grow more complex. Her address came a day after Josephine Teo, Minister for Digital Development and Information and Minister-in-charge of Cybersecurity and Smart Nation, warned that trust in digital systems is becoming harder to sustain. This year's theme is "Cyber at a Crossroads: Shaping the New Cyber Order.

SICW 2026 Opens With a Warning

Fong, attending her first SICW as CSA chief, said Singapore's success has been built on being open and connected. That leaves its economy and society dependent on digital infrastructure, platforms and supply chains that extend well beyond its shores. Governments, infrastructure operators, cloud providers and cybersecurity firms each see part of the threat landscape, she said, but none sees all of it. "What appears to be an isolated incident to one organisation may in fact be part of a much larger campaign," Fong said. Assembling the picture is only half the challenge, she added. It must be done quickly enough to act before the adversary does.

AI Cuts Both Ways at SICW 2026

Fong said Singapore cannot simply keep adding analysts as threats grow in volume and sophistication. Instead, it wants AI to help defenders "see more, understand faster and to act more effectively." But adversaries can harness AI too, operating at greater speed and scale. The real test of AI cybersecurity, she said, is making sure the technology strengthens defences rather than tilting the advantage towards attackers. She also flagged a newer risk. As agentic AI systems gain access to data, applications and tools, they create new dependencies and vulnerabilities. "For years, cybersecurity has required us to understand what is connected to what. In an increasingly agentic world, we must also understand what can act on what," Fong said, pointing to questions of permissions and consequences.

SICW 2026 Puts AI Risks Into Practice

Rather than only discussing what AI could mean for security, CSA is testing it in practice this year. CSA is partnering with Google on an agentic AI cyber scenario exercise for international partners. It is working with the Singapore AI Safety Hub on a frontier AI governance workshop for officials from ASEAN and the wider Asia-Pacific. With Cloudflare, it is running hands-on training in AI-enabled cyber defence for critical infrastructure operators. Fong pointed to the ASEAN CERT Incident Drill, held since 2006, as proof that practising together builds the habits that matter in a real crisis.

The Trust Deficit Behind SICW 2026

On 12 October, Teo described what she called a paradox. At precisely the time when more trust is needed, trust is becoming harder to sustain. AI systems can make mistakes, be manipulated or behave in unintended ways, she said, and their capabilities are advancing faster than our understanding of the risks. Teo cited UNC3886's campaign against Singapore's telecommunications sector as a recent example of sophisticated actors targeting critical infrastructure. Ransomware and cybercrime remain pervasive, while strategic competition is forcing harder choices on technologies, suppliers, standards and interoperability. "We are willing to interact more, but find ourselves willing to trust less," she said. Without trust, Teo warned, businesses will hesitate to digitalise, citizens will be wary of new technologies, and countries will be less willing to stay open and connected.

"Accountability Cannot Be Outsourced"

Teo said industry must be a partner in securing the digital ecosystem, since it builds and operates much of the infrastructure economies depend on. That means shared standards, threat intelligence sharing, incident reporting and testing new technologies before deployment. On increasingly autonomous AI, she said human judgement, oversight or control must be retained where necessary. "Ultimately, accountability cannot be outsourced. Least of all, to machines," she said. She outlined steps already under way. CSA released its Securing Agentic AI Addendum earlier this year to guide organisations on securing autonomous AI systems. The agency is also working with industry to prepare critical infrastructure for the transition to quantum-safe systems. In addition, leading operational technology manufacturers and technology providers have committed to attain Singapore's Cyber Trust Mark.

What Comes Next

Teo said Senior Minister K Shanmugam would launch the Singapore Cybersecurity Strategy 2026, the country's updated national strategy, the following day, with partnerships remaining central to it. That approach will also carry into 2027, when Singapore assumes the ASEAN Chairmanship. Teo said Singapore will work with the bloc's 11 member states to strengthen collective cyber resilience, deepen practical cooperation and capacity building, and work more closely with industry. Estonia's Minister of Justice and Digital Affairs, Liisa-Ly Pakosta, also joined the week's proceedings for a fireside chat with Fong. Both leaders acknowledged that geopolitical competition is making cooperation harder. "Disagreement need not prevent dialogue, and competition need not preclude practical cooperation," Fong said. Teo put it simply: trust is not built through declarations, but through candid exchanges, competence and consistent action. Fong closed with a challenge to every delegate in the room: look beyond your own vantage point and find the people who can help you see the rest.

Morocco’s cybersecurity strategy is placing greater emphasis on proactive threat detection, critical infrastructure protection and artificial intelligence as the country strengthens its defenses against evolving cyber threats. Abdellatif Loudiyi, Minister Delegate to the Head of Government in charge of National Defense Administration, said securing information systems has become a necessity as digital transformation accelerates. Speaking at the opening of National Cybersecurity Week in Rabat on Monday, Loudiyi stressed that cybersecurity must be integrated into institutional governance rather than treated as an additional expense. He called for stronger preparedness, early threat detection and coordinated responses to cyber incidents. The event, organized by the General Directorate of Information Systems Security under the National Defense Administration, runs from October 12 to 14 under the theme “Cybersecurity in the service of digital transformation and development.”

Morocco Cybersecurity Strategy Emphasizes Proactive Defense

Loudiyi said cyberattacks have become a tangible reality affecting countries worldwide, including developed nations. Their consequences have raised awareness among public and private institutions about the importance of cybersecurity in managing risks and protecting operations. He argued that organizations can no longer rely on responding to incidents after they occur. Instead, they need an approach centered on preparedness, vigilance, early detection, and response. According to the minister, these responsibilities must begin at the highest levels of institutional decision-making and extend across organizations, with each component accountable for its role. He also emphasized that cybersecurity resilience requires continuous work. As attackers develop new methods, institutions must regularly review protection measures, assess system readiness, and adapt their defenses to emerging threats.

Five Pillars to Strengthen National Cybersecurity

The minister outlined five interconnected areas supporting Morocco’s efforts to establish a coordinated national cybersecurity framework. These include a clear legal and regulatory framework, the development of human, technical and financial capabilities, greater public awareness and a stronger cybersecurity culture, enhanced monitoring and response capabilities, and regional and international cooperation. Loudiyi stressed that these elements must function together to strengthen national resilience. He also highlighted the shared responsibilities of government authorities and organizations operating information systems. While the General Directorate of Information Systems Security exercises its legally defined powers, individual system owners must protect their systems and allocate the resources required to do so. The minister said this integration of responsibilities is essential to building a cohesive national cybersecurity system.

AI Threats and Critical Infrastructure Protection Take Priority

Looking ahead, Loudiyi identified four priorities for the next phase of Morocco’s cybersecurity efforts: training specialized cybersecurity professionals, supporting national cybersecurity companies, strengthening critical infrastructure protection, and addressing the challenges associated with artificial intelligence. He described artificial intelligence in cybersecurity as a dual-use capability that can benefit both attackers and defenders. While attackers can use AI to support malicious activities, defenders can apply the technology to detect threats earlier and accelerate incident response. The emphasis on specialized training also reflects the need to develop the expertise required to address increasingly complex cybersecurity challenges. Supporting national companies is another priority identified by the minister as part of the broader effort to strengthen the country's capabilities. Loudiyi said these priorities should help Morocco prepare not only for existing threats but also for risks that may emerge as technologies and attack methods evolve.

Morocco Calls for Stronger International Cybersecurity Cooperation

Loudiyi also highlighted the role of cybersecurity cooperation in strengthening national defenses. He said Morocco remains committed to initiatives and mechanisms that promote collaboration between countries, with particular attention to its African and Arab partners. He presented cybersecurity as a shared responsibility requiring coordination, investment in skills and a sustained culture of awareness and vigilance. The minister concluded that a secure digital environment depends on collective efforts to protect information systems and maintain trust as digital transformation advances. National Cybersecurity Week provides a platform for these discussions through roundtables and workshops involving decision-makers, cybersecurity experts and industry professionals. The October 12 to 14 program is intended to encourage dialogue and the exchange of views on key cybersecurity challenges and approaches to addressing them.

The XRP Ledger (XRPL) has deployed an emergency patch for one of the most serious XRP vulnerabilities in its history, a flaw that could have allowed unlimited XRP to be created. By skipping the standard two-week validator vote, the fix has reignited debate over how decentralized the network really is, though developers and validators maintain the step was necessary and did not amount to centralized control.  According to Woofun AI, the bug could have pushed XRP's supply beyond its predefined cap. The episode unsettled community expectations around transparent protocol governance, exposing a clear tension between fast security responses and decentralization.   XRPL officials said the goal was to stop attackers from exploiting the flaw, but sidestepping established procedure has cast doubt on the network's claim of "full decentralization," a narrative that underpins XRP's non-security status. The incident is effectively a stress test of governance under extreme risk, and its outcome is likely to shape how the market judges trust in XRPL's underlying architecture. 

The XRP Vulnerabilities Patch Update

The patch went live on September 25, just three days after the related bug bounty report was filed, and took effect as soon as servers installed it. That speed was unprecedented in the system's decade-plus history and marked the first deliberate bypass of the standard amendment process.   In a Sunday statement on X, XRPL developers explained that the customary two-week validator vote would have made the patch's code public weeks before activation, creating serious cybersecurity risks.  The update was initially released only in binary form, with its source code temporarily withheld. Data compiled by Woofun AI shows such rapid deployment is extremely rare in blockchain history, usually seen only in networks facing existential crises. Developers said withholding the code was meant to stop attackers from reverse-engineering the flaw, not to hide technical weaknesses.   Still, this "fix first, disclose later" approach clashes with the open-source principle of public auditing, and some community members worry such emergency measures could become institutionalized and erode the network's decentralized foundation. 

Critics and Validators Clash Over the XRP Vulnerabilities Response 

On Thursday, Cyber Capital founder Justin Bons called the promotion of Ripple's decentralization to retail investors "pure fraud." He argued that the September 25 patch forced operators to upgrade and, by arriving only as a binary, undermined the community's ability to exercise oversight.  The XRPL Foundation countered that the decision followed a joint assessment of the bug's severity by the foundation, RippleX, core developers and validators, with no single party acting unilaterally. It added that version 3.4.1 was ultimately enforced through a regular two-week amendment vote backed by more than 80% of validators.   XRP Kuwait, an independent validator operator, also rejected claims that coordinated upgrades equal centralized control, saying independent operators can reach consensus through communication while keeping their autonomy.  The divide reflects two readings of decentralization: one prioritizing procedural fairness and transparency, the other outcome-driven decisions and collective security. XRPL's model proved flexible in a crisis, but it also showed how extreme pressure could pull it away from its decentralized ideals. 

The Technical Root of the XRP Vulnerabilities 

The flaw was an integer overflow bug that had existed in the XRPL payment engine since 2015. Balances are stored as 64-bit integers with a fixed maximum, and when an amount exceeds that limit, the system wraps it to a smaller value instead of returning an error.   An attacker could craft hundreds of specially priced payment requests, each seeking an enormous amount of XRP, then submit a single payment that drained them all. The requesters would be fully refunded while the payer was charged only a tiny converted sum, with the difference becoming newly minted, spendable XRP.  Exploiting these XRP vulnerabilities required carefully crafted requests and could not be triggered by ordinary transactions. Developers say no public network has shown signs of exploitation so far. This marks the first time since 2015 that XRPL has faced such a severe supply-inflation threat. Although the remediation drew criticism, it effectively reduced systemic risk.  

Seoul National University (SNU) has been struck by 28 hacking incidents since 2021, and more than 1,100 pieces of personal information belonging to students, faculty and staff were exposed along the way. The SNU cyberattack figures come from data the university submitted on Sunday to Rep. Baek Seung-ah of the Democratic Party.  The breakdown shows eight attacks in 2021 and 10 in 2022, the highest annual total in the period. Activity then dropped sharply to a single incident in 2024 before rising again to five in 2025. Four more have been confirmed so far this year. Together, these yearly figures account for all 28 incidents, which means none were recorded in 2023.  Departmental systems were the most frequent target, hit in 19 of the 28 incidents. Laboratory systems came next with six, followed by research systems with two. One attack affected an institutionwide system. 

2021 SNU Cyberattack Behind Nearly All Leaked Data 

Across the six-year span, a total of 1,132 pieces of personal information were leaked. Almost all of them, 1,130 records, trace back to a single cyberattack in 2021. In that breach, hackers planted malicious software on SNU servers, which let them run commands remotely and steal personal details of university members, including their portal IDs.  The remaining two pieces of personal information were exposed in 2024, when attackers went after a university research institute. Their focus was on files containing researchers' biographies and résumés.  According to the data, no personal information leaks were confirmed in any of the other hacking incidents. 

Seoul National University Faces Hundreds of Attempts Every Year 

Beyond the confirmed breaches, the university has dealt with a steady stream of attempted intrusions, numbering more than 500 annually in recent years. SNU logged 561 hacking attempts in 2024 and 575 in 2025. Another 588 have been detected so far this year, already exceeding the totals of both previous years.  Explaining the numbers, the university said, "These figures represent hacking attempts detected and blocked through our security monitoring." It added, "We prevented the incidents from spreading through real-time responses and immediately completed the necessary security measures." 

How SNU Handled Reporting After Hacking Incidents 

On the question of reporting, SNU said it notified either the Ministry of Education or the Personal Information Protection Commission whenever a personal information leak was confirmed. However, the university has never requested an investigation by law enforcement authorities into any of the attacks.  The disclosure offers a clearer picture of the digital threats confronting a major South Korean university. While the number of successful breaches has fallen since its 2022 peak, the yearly count of attempted attacks has continued to climb.   That trend suggests the pressure on Seoul National University's networks remains significant, and the SNU cyberattack record is likely to keep questions about how the institution safeguards its community's data in focus. 

Lembaga Tabung Haji (TH) has resumed its key systems and services after a Tabung Haji cyberattack on Oct 8 led to a temporary suspension, and the agency says depositors’ savings are safe. In a statement issued today, TH said the reactivation followed comprehensive security checks, the strengthening of controls and system recovery measures.

The agency also said it worked with national cybersecurity authorities to address the threat and reinforce system security, so that the reactivated services can operate safely. TH has lodged a police report and continues to monitor its systems closely.

Tabung Haji Cyberattack Led to Suspension Across All Channels

On Oct 8, TH temporarily suspended system and service operations across all channels. The agency said the suspension was meant to protect depositors’ savings and personal information after the attack caused service disruptions.

TH described the Tabung Haji cyberattack as a criminal act against TH and the nation, intended to disrupt its services. After the incident, its internal team worked with external experts and national cybersecurity authorities to investigate the event, address the threat and restore the systems.

Branches Reopen After Cyberattack

According to the statement, TH branches in Kedah, Terengganu and Kelantan resumed operations yesterday. Branches in other states opened as usual today. Services provided through strategic banking partners have also been reactivated.

The statement said the reactivation followed those checks and recovery measures. It added: “TH assures that depositors’ savings are safe. Close monitoring and security enhancements will continue to ensure that the reactivated systems and services operate safely and smoothly.”

THiJARI Platform Functions Still Pending Restoration

TH also announced that all functions of the THiJARI platform have resumed operations, with three exceptions. Password resets, new user registration and online account opening remain unavailable.

The agency said these three functions still require further restoration work before they can be reactivated. Updates will be communicated through TH’s official channels from time to time.

TH lodged a police report over the incident and notified the mNational Cyber Security Agency (NACSA) and the Department of Personal Data Protection (JPDP). It has collaborated with cybersecurity authorities to address the threat and reinforce system security, which it said ensures the safety of the reactivated services.

Guidance for Depositors After the Tabung Haji Cyberattack

TH urged depositors who detect unusual transactions, or who need assistance or have inquiries, to contact the TH Contact Centre (THCC) immediately at 03-6207 1919. The agency said it continues to monitor its systems closely and will keep strengthening security.

TH also thanked depositors for their patience, cooperation and support during the restoration period. “We once again apologise and deeply regret the incident; however, these measures were necessary to safeguard depositors’ savings,” the statement said.

Timeline at a Glance

• Oct 8: TH suspends system and service operations across all channels after the cyberattack.
• After the incident: TH’s internal team, external experts and national cybersecurity authorities investigate and restore the systems, a police report is lodged, and NACSA and JPDP are notified.
• Yesterday: Branches in Kedah, Terengganu and Kelantan resume operations.
• Today: Branches in other states open as usual.
• Also confirmed: services through strategic banking partners have been reactivated.
• Still pending: THiJARI password resets, new user registration and online account opening.

What Is Confirmed So Far

Based on the statement, three points are confirmed. Depositors’ savings are safe, key systems and services have resumed, and three THiJARI functions are still being restored.

TH said it will continue close monitoring and security enhancements, and it will share further updates through its official channels. Depositors with concerns can reach the THCC at 03-6207 1919.

Two Dominican Republic nationals have been extradited to the United States to face charges over an alleged sextortion scheme that used social media to target victims in Puerto Rico, threaten exposure of sexually explicit images, and demand money. Patricia Joanna Almonte-Frías and her partner, Rineldys Feliciano Díaz-Cuevas, were extradited on September 30, 2026, after being arrested in the Dominican Republic on August 19 at the request of US authorities. The defendants face charges of conspiracy to cyberstalk and send interstate threats in the District of Puerto Rico, according to the US Department of Justice. The case concerns an alleged international operation in which victims were pressured to make payments under threats that compromising images would be shared with their families and friends.

Sextortion Scheme Allegedly Used Social Media Platforms

According to court documents, Almonte-Frías and Díaz-Cuevas operated a financially motivated sextortion conspiracy from the Dominican Republic. The alleged scheme involved identifying victims through Facebook, WhatsApp, and other social media platforms. Prosecutors allege that Almonte-Frías used her image to encourage victims in Puerto Rico to share sexually explicit photos and videos online. The material was secretly recorded, according to the allegations. Díaz-Cuevas and other alleged co-conspirators subsequently demanded money from victims, threatening to distribute the compromising images to their family members and friends if they did not pay. In some instances, the defendants allegedly created photo collages combining victims' sexually explicit images with pictures of minors. According to the Justice Department, these collages were designed to create the false impression that the victims were involved in sexual relationships with minors. The alleged social media extortion operation continued even after some victims made payments. Court documents state that, on multiple occasions, victims paid the demanded amounts and emptied their accounts, but the threats were still carried out. The victims' sexual images were subsequently distributed to their online networks of friends and family members.

FBI San Juan Investigated Cyberstalking Allegations

Héctor Ramírez-Carbó, Acting US Attorney for the District of Puerto Rico, said the alleged operation exploited victims' trust and vulnerability, causing lasting harm. Carlos R. Goris, Special Agent in Charge of FBI San Juan, said online extortion can cause significant financial and psychological harm. He encouraged people who suspect they have been targeted by extortion to report the incidents to law enforcement. The FBI San Juan office investigated the case. The Justice Department's Office of International Affairs, the FBI Legal Attaché in Santo Domingo, the US Marshals Service, and law enforcement partners in the Dominican Republic assisted in securing the defendants' arrests and extradition. Assistant US Attorney Julián Radzinschi, from the Financial Fraud and Public Corruption Division, is prosecuting the case.

Sextortion Conspiracy Charges Carry Up to Five Years in Prison

Almonte-Frías and Díaz-Cuevas face charges of conspiracy to cyberstalk and send interstate threats under 18 U.S.C. § 371. They made their initial court appearances on October 1, 2026, before US Magistrate Judge Marcos E. López of the US District Court for the District of Puerto Rico. If convicted, each defendant faces a maximum penalty of five years in prison. Any sentence would be determined by a federal district court judge after considering the US Sentencing Guidelines and other statutory factors. The Dominican Republic extradition marks the transfer of the two defendants to US jurisdiction to face the charges. The case also involves cooperation between US and Dominican Republic authorities in investigating alleged cross-border criminal activity. An indictment is an allegation, not proof of guilt. Both defendants are presumed innocent unless proven guilty beyond a reasonable doubt in court.

This weekly roundup covers a massive exposure of personal data from Denmark's national population register, a U.S. bounty on a Chinese hacker accused of stealing COVID-19 research, Japan's plan to actively search for attackers hiding in its critical infrastructure, a pair of breaches at Japanese publisher Nikkei, a call for AI-driven decision-making in security operations, and a Massachusetts town's ongoing recovery from an August cyberattack.  Two threads run through this week's stories. First, attackers keep getting in through doors that were already open: a company's lawful access to a government register, employees' hijacked email accounts, and unpatched mail servers. Second, the time between intrusion and discovery remains dangerously long, which is why governments and security leaders are pushing to find intruders sooner and respond faster. 

The Cyber Express Weekly Roundup 

Hackers Abuse Company's Legitimate Access to Expose Data of 8.8 Million in Denmark 

The Danish government said unauthorized individuals obtained the names, addresses, and CPR numbers of roughly 8.8 million people from the Central Person Register. They did it by misusing the legal access granted to a private Danish company. The register holds records on about 11 million people, including residents, Danes living abroad, and deceased individuals. Read more… 

US Offers $10 Million Reward for Chinese Hacker Accused of Stealing COVID-19 Research 

The U.S. State Department is offering up to $10 million for information on Zhang Yu, a Chinese national accused of hacking COVID-19 research at U.S. universities on behalf of China's Ministry of State Security. Zhang and his alleged partner, Xu Zewei, are also tied to the 2021 HAFNIUM campaign, which exploited Microsoft Exchange vulnerabilities to compromise more than 12,700 U.S. entities. Xu was arrested in Italy in 2025 and extradited to the U.S. in April 2026. Zhang remains at large. Read more… 

Japan to Launch Threat Hunting Program to Find Hidden Attackers in Critical Infrastructure 

Japan plans to partner with private companies in fiscal 2027 to proactively look for attackers who may already be sitting undetected inside power, telecom, and other critical infrastructure networks. The National Cybersecurity Office will build detection methods by recreating attack scenarios in a virtual environment and will share them with operators. The Defense Ministry will provide experienced personnel to companies on request. Read more… 

Nikkei Hit by Two Breaches as Hijacked Accounts Send 9,000 Malicious Emails 

Japanese publisher Nikkei disclosed on October 4 that attackers had taken over employees' Microsoft 365 accounts. On September 30, they used those accounts to send roughly 9,000 emails with malicious links to staff and external contacts. Nikkei also revealed a separate breach of its Google Workspace accounts, ongoing since late July, that may have exposed the names and email addresses of 1,646 employees and business partners. Read more… 

Agentic AI Turns Cybersecurity Into a Race of Decision Speed 

In an opinion piece, Cyble's Salleh Kodri argues that security teams no longer struggle to see threats. Their problem is "decision latency": the time it takes to turn alerts from many tools into the right action. As AI accelerates attackers' reconnaissance and decision-making, Kodri says defenders should use AI to correlate intelligence and act faster. Read more… 

Andover Confirms Attackers Accessed Town Systems in August Cyberattack 

Officials in Andover, Massachusetts, confirmed that the August 13 cyberattack involved unauthorized access to some town systems. They have not yet determined whether any data was stolen or whether personal information was involved. The town says it paid no ransom. It has hired a law firm and cybersecurity firm Vector3 to investigate, with costs covered by cyber insurance. Read more… 

Weekly Cybersecurity Takeaway 

Several of this week’s incidents started with access that looked legitimate. In Denmark, attackers abused a private company’s authorized connection to the national register instead of breaking in. At Nikkei, hijacked employee accounts sent thousands of malicious emails under a trusted name.  Time is the other common thread. Nikkei’s Google Workspace breach ran for over two months before disclosure, and Andover still doesn’t know what was taken. Japan’s threat hunting plan assumes attackers may already be inside, and Kodri warns that spotting an alert means little if acting on it takes too long.  Organizations should monitor third-party access as closely as their own staff’s. They should secure email accounts with phishing-resistant authentication and actively hunt for intruders rather than wait for alerts. 

Splunk has patched a large set of Splunk vulnerabilities in Splunk Enterprise, the most severe of which carries a CVSSv3.1 score of 9.8. The fixes are described in two advisories, SVD-2026-1001 and SVD-2026-1002, both published on October 7, 2026, and together they cover 22 CVE identifiers, CVE-2026-76264 through CVE-2026-76285.   A security bulletin issued on October 9, 2026, rated the overall risk as medium and warned that a remote attacker could exploit some of the flaws to achieve remote code execution, denial of service, elevation of privilege, security restriction bypass, sensitive information disclosure, and data manipulation. 

Splunk Enterprise Versions Affected 

Branch	Affected versions	Fixed version
10.4	10.4.0 to 10.4.2	10.4.3
10.2	10.2.0 to 10.2.6	10.2.7
10.0	10.0.0 to 10.0.9	10.0.10
9.4	9.4.0 to 9.4.14	9.4.15

The Critical Patroni Flaw 

The top-rated issue, CVE-2026-76268 (CWE-306), stems from missing authentication in the Patroni REST API. On a search head cluster member running a version below 10.4.3 or 10.2.7, an unauthenticated attacker with network access to that interface could run operating-system commands, because critical configuration operations require no login. Versions 10.0.x and 9.4.x are not affected.   Organizations that do not use Edge Processor, OpAmp or SPL2 data pipelines can turn off the PostgreSQL sidecar by setting disabled = true in the [postgres] stanza of $SPLUNK_HOME/etc/system/local/server.conf, then restarting. 

Privilege Escalation and Secure Gateway Splunk Vulnerabilities 

CVE-2026-76266 (7.7, High) lets a local user who can run commands as the Splunk account plant content that a later Linux package upgrade executes as root. Upgrading with a tar file avoids the issue.  Three flaws hit Splunk Secure Gateway: CVE-2026-76265 (6.5) and CVE-2026-76272 (4.3) let non-admin users make it sign attacker-controlled payloads, while CVE-2026-76280 (6.3) allows writes to alert and mobile-device recipient data. They are fixed in Secure Gateway 3.10.11, 3.9.25 and 3.8.72. Admins who do not use Splunk Mobile, Spacebridge or Mission Control can disable the app instead. 

Data Exposure and Input Validation in Splunk Enterprise 

Several medium-severity bugs expose other users' data. CVE-2026-76269 (6.5) and CVE-2026-76275 (4.3) reveal other users' search jobs, CVE-2026-76270 (6.5) is a SQL injection in the SPL2 module catalog affecting only 10.4.x, and CVE-2026-76278 (4.3) leaks SPL2 module permission grants. CVE-2026-76274 (6.5), an SSRF, can disclose the Observability Cloud API token.  Others include log injection (CVE-2026-76267), a regex-based denial of service (CVE-2026-76271), source code leaking through source maps (CVE-2026-76276), collect command abuse (CVE-2026-76273, CVE-2026-76279), usernames ending in a period (CVE-2026-76277, 4.1) and scripted lookup edits by non-admins (CVE-2026-76264). 

Internally Identified Hardening Fixes 

Advisory SVD-2026-1002 groups internal findings by weakness class, scoring each CVE by its worst finding: CVE-2026-76281 (CWE-284, 9.8), CVE-2026-76284 (CWE-707, 9.0), CVE-2026-76282 (CWE-664, 8.8), CVE-2026-76283 (CWE-693, 7.6) and CVE-2026-76285 (CWE-710, 4.4). 

Fixing the Splunk Vulnerabilities 

Splunk advises upgrading Splunk Enterprise to 10.4.3, 10.2.7, 10.0.10 or 9.4.15, or later. CVE-2026-76264, CVE-2026-76265, CVE-2026-76272 and CVE-2026-76280 need extra steps. For CVE-2026-76264, admins should set scripted_lookup_raw_write_enforcement = block under [lookup] in limits.conf and restart. Where upgrading is not possible, removing run_collect from roles without internal-index access mitigates CVE-2026-76279.  Credited researchers include Gabriel Nitu of Splunk, Jean-Michel Remi Boudreau, Anton (therceman), M Mahdan Argya Syarif, Saidina Hikam, Alex Hordijk and Younes Zendour. 

An attacker got into some of Andover's computer systems during the Andover cyberattack in August; Town officials confirmed Thursday, though they cannot yet say whether any data was taken.  "The Town has identified unauthorized access to certain systems and is continuing to determine the nature, scope, and sensitivity of any data that may have been accessed or acquired," Chief Communications Officer Phil Geoffroy said in written answers to Andover News.  Some reviewed material appears routine or publicly available, he said, but the full data set remains uncharacterized. 

What Is Known About the Andover Cyberattack 

It is the Town's clearest admission that the Aug. 13 cyberattack on Andover reached its systems, though not proof of copying, removal or publication.  Geoffroy did not identify the systems, say whether they belonged to the municipality or Andover Public Schools, or give a completion date. Investigators must check any accessed data for personally identifiable information, he said. Officials first secured and restored the network, reconnecting equipment, even printers, across municipal and school offices. Another update will come "if/when appropriate."  Town Counsel Doug Heim told the Select Board Sept. 28 that it was unclear whether state-protected information was involved. 

Investigators and Ransom Questions 

The Town hired law firm Constangy, Brooks, Smith & Prophete and cybersecurity firm Vector3 on the evening of Aug. 13. Vector3 is tracing how the attacker entered, reconstructing the attacker's activity, assessing whether data was accessed or removed, and helping monitor more than 3,000 devices.  On ransom demands or negotiations, Geoffroy said only that the Town "did not make or authorize any payments in connection with this incident." Vector3's agreement allowed up to $3,000 for possible communication with the attacker and monitoring of negotiation channels for up to 60 days, though its use is unconfirmed.  No culprit has been named. On Aug. 30, a ransomware group called WallStreet listed Andover as a purported victim on a dark-web site, which proves neither responsibility nor data theft.  Geoffroy would not name agencies notified: "The Town is coordinating with appropriate legal, forensic, and governmental partners as required and cannot comment on any law enforcement-related aspects of the event at this time."  If Chapter 93H, the Massachusetts breach law, applies, the Town must notify the Attorney General's Office, state regulators and affected people. That office had received no notice as of Sept. 22. 

Who Pays for the Cyberattack on Andover?

An Oct. 5 public records appeal response said the Town had received no bills and incurred no costs beyond its insurance policy, seemingly conflicting with agreements estimating at least $39,605 in initial Vector3 and Constangy work. The insurer pays them directly, Geoffroy said.  "Subject to the limits of our policy, Andover will bear no additional costs for these contractors and bills will be paid by our insurer," he said.  The policy covers up to $1 million for several categories of cyber expenses and $100,000 for cyber-extortion, with a $10,000 retention on most categories. The Town did not address overtime, replacement equipment, security upgrades or the retention. 

Town Defends Its Preparedness 

"Based on what is currently known, the Town does not believe this incident reflects a lack of investment in information technology or incident preparedness," Geoffroy said. He credited past spending on technology, cyber insurance and response planning with helping contain the attack, restore services and coordinate quickly, noting longer disruptions elsewhere.  The Andover cyberattack disrupted the municipal and school network for four days, with some restoration continuing afterward. Shared drives returned fully Aug. 21, and VPN access stayed down during its rebuild. Public safety, municipal buildings, phones and Town-operated utilities kept operating. 

The U.S. Justice Department and FBI have seized two hacking tools, Microscan and FishHub, that court documents say were operated and used by Flax Typhoon actors working for a China-based company. According to the government, the tools were used to scan, and in some cases hack, U.S. and foreign critical infrastructure systems and other networks. The court-authorized seizures were announced alongside court documents unsealed in the Western District of Pennsylvania. Prosecutors allege the actors worked for Integrity Technology Group (Integrity Tech), a company based in the People's Republic of China (PRC) that holds contracts with the PRC government. The action is the latest step by U.S. authorities against China state-sponsored hackers.

How Flax Typhoon Actors Used Microscan for Vulnerability Scanning

According to court documents, Integrity Tech built and used a botnet of internet-of-things devices infected with a variant of Mirai malware. The botnet supported the company's vulnerability scanning through Microscan, a tool Integrity Tech developed to perform reconnaissance on victim networks and identify weaknesses its clients would later exploit. Targets of Microscan scanning included a U.S. power company based in South Carolina, a multinational non-governmental organization, airports in Japan and Poland, Taiwanese critical infrastructure companies in the natural gas and power sectors, and two Taiwanese universities. Integrity Tech accessed Microscan through c0cc[.]cc, one of the seized domains.

FishHub and the Flax Typhoon Spear Phishing Operation

The second tool, FishHub, allegedly helped compromise computer networks through spear phishing. After gaining initial access, FishHub downloaded additional malware to the victim network. That malware either gave Integrity Tech's clients unauthorized remote access or searched for specific files and sent them to servers controlled by Integrity Tech. Confirmed FishHub victims included about 20 Taiwanese universities. Five seized domains helped deliver the malware: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net.

What Officials Said About Flax Typhoon

Assistant Attorney General for National Security John A. Eisenberg said the United States "will not allow China or its proxies to operate against United States interests with impunity in cyberspace." He added that the National Security Division would continue working to disrupt the Flax Typhoon threats and dismantle the infrastructure sustaining them. Assistant Director Brett Leatherman of the FBI's Cyber Division said, "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure." U.S. Attorney Troy Rivetti for the Western District of Pennsylvania described the seizures as the second disruption of Integrity Tech's operations in as many years. Special Agent in Charge Mark Remily of the FBI San Diego Field Office said the action reflects the FBI's commitment to disrupting PRC state-sponsored cyber actors who threaten critical infrastructure and national security.

Second Disruption of Flax Typhoon Infrastructure

This is the Justice Department's second public technical disruption of Integrity Tech's hacking infrastructure. In September 2024, the department announced the court-authorized disruption of Integrity Tech's Mirai botnet, which included more than 200,000 consumer devices in the United States and worldwide. Alongside the latest seizures, the FBI and other U.S. and foreign partner agencies published a cybersecurity advisory listing indicators of compromise tied to Integrity Tech intrusion activity. The advisory is intended to help network defenders identify and respond to the group's malicious activity. The FBI San Diego and Baltimore Field Offices are investigating the case in coordination with the FBI's Cyber Division. Assistant U.S. Attorney Brendan McKenna for the Western District of Pennsylvania and Trial Attorney Jacques Singer-Emery of the National Security Division's National Security Cyber Section are prosecuting the case. Assistant U.S. Attorney Thomas Sullivan for the District of Maryland and the National Police Agency of Japan provided substantial assistance.

The U.S. Department of State's Rewards for Justice (RFJ) program is offering up to $10 million for information on Zhang Yu, a Chinese national accused of hacking COVID-19 research at U.S. universities on behalf of China's Ministry of State Security (MSS). U.S. officials also describe Zhang as a key figure in the HAFNIUM hacking campaign, which compromised thousands of computers worldwide.

His alleged partner, Xu Zewei, was arrested in Italy in July 2025 and extradited to the United States in April 2026. Zhang remains at large.

Who Is Zhang Yu

Zhang is a director at Shanghai Firetech Information Science and Technology Company, Ltd. U.S. officials say he worked at the direction of the MSS Shanghai State Security Bureau (SSSB). According to RFJ, the MSS and SSSB are Chinese intelligence services responsible for domestic counterintelligence, non-military foreign intelligence, and parts of the country's political and domestic security.

[caption id="attachment_114641" align="aligncenter" width="600"] Image Source: Rewards for Justice[/caption]

The reward covers information leading to the identification or location of anyone who, while acting under the direction or control of a foreign government, takes part in malicious cyber activity against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act. The State Department says Zhang's cyberattacks violated that law.

Zhang Yu and the COVID-19 Research Intrusions

Starting in early 2020, Zhang and Xu allegedly gained unauthorized access to COVID-19 research conducted by U.S.-based universities and leading immunologists and virologists in order to steal sensitive information. At the time, Xu was a general manager at Shanghai Powerock Network Co. Ltd.

Prosecutors say the two men carried out the hacks at the behest of the MSS and SSSB and reported back to supervising officers at the SSSB. In one instance, Xu allegedly confirmed to his handlers that he had compromised the network of a research university in the Southern District of Texas.

The HAFNIUM Campaign Linked to Zhang Yu

In 2021, Zhang and Xu allegedly exploited vulnerabilities in computers running Microsoft Exchange Server, software used to store and retrieve emails. These intrusions were part of the mass hacking campaign publicly known as HAFNIUM. Victims included a university and a law firm, both based in the United States.

A nine-count indictment unveiled by the Justice Department in 2025 accused both men of computer intrusions between February 2020 and June 2021, including the HAFNIUM campaign, which prosecutors described as indiscriminate.

The scale of the campaign was significant. Brett Leatherman, assistant director of the FBI's Cyber Division, said in 2025 that through HAFNIUM, the Chinese Communist Party targeted more than 60,000 U.S. entities and successfully victimized more than 12,700 of them to steal sensitive information.

Zhang Yu Remains at Large as Partner Faces U.S. Charges

Xu was arrested by Italian authorities in July 2025 while on vacation in Milan. He was extradited to the United States in April 2026, while Zhang has not been apprehended.

According to RFJ, China uses an extensive network of private companies and contractors to hack and steal information in a way that hides the government's involvement. Both men worked for private Shanghai firms while allegedly acting on behalf of state intelligence services.

RFJ is asking anyone with information on Zhang, his associates, or their malicious cyber activities to submit a tip through its Tor-based tip line. Rewards of up to $10 million are available for information that meets the program's criteria.

Atlassian has disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting Confluence Data Center and seven other self-managed products. The advisory, published on October 5, 2026, warns that every version of the affected software is exposed and urges administrators to act right away, either by upgrading or by putting temporary safeguards in place.  Beyond Confluence Data Center, the flaw reaches Bitbucket Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. Atlassian is tracking the issue under BSERV-20604, CONFSERVER-104488, JSDSERVER-16809, JRASERVER-79546, BAM-26567, CWD-6610, CRUC-8741 and FE-7583. 

Which Atlassian Products CVE-2026-21589 Affects 

The bug lets an attacker with no login read specific files inside the web application's root directory. There is a catch for attackers: they must already know a file's exact name and location, since the weakness does not reveal or list directory contents. Even so, Atlassian notes that some setups may store sensitive files there, which raises the stakes.  Atlassian scores CVE-2026-21589 at 9.3, placing it in the Critical band, using the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H. The company describes this as its own internal assessment and advises organizations to judge how it applies to their environments.  Cloud users are not affected. Atlassian says its Cloud products have already been patched, its investigation found no sign of exploitation there, and Cloud customers need to take no action. 

Patched Versions for Confluence and Other Atlassian Tools 

The primary fix is an upgrade. Atlassian recommends moving each installation to a fixed release, ideally the fixed LTS version or the newest available build. 

Product	Fixed versions
Bitbucket Data Center	9.4.26, 10.2.8, 10.5.1
Confluence Data Center	9.2.26, 10.2.19
Jira Service Management Data Center	5.12.40, 10.3.26, 11.3.12
Jira Software Data Center	9.12.40, 10.3.26, 11.3.12
Bamboo Data Center	10.2.24, 12.1.12
Crowd Data Center	6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible	4.9.15
Fisheye	4.9.15

Stopgap Measures Against CVE-2026-21589 

Teams that cannot upgrade yet should take instances offline from the internet where possible, including those protected by user authentication. Atlassian then offers three mitigations, all built on one regex meant to block ".." sitting directly next to /, , or ::, including URL-encoded forms:  (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* 

1. Web Application Firewall rule (all products): block any URL matching the pattern in a WAF or proxy such as AWS WAF, Cloudflare or a reverse proxy, then test that encoded variants are caught. 
2. Tomcat RewriteValve (Confluence, JSM, Jira, Bamboo, Crowd): after a backup, shut down each node, enable the valve in server.xml (Crowd may use crowd.xml), and add or append a rewrite.config file in the product's WEB-INF directory. It checks both the normalized request path and the raw URI, returning a forbidden response. Restart the node afterward. 
3. urlrewrite.xml rule (Bitbucket only): back up, then place the rule at the top of /app/WEB-INF/urlrewrite.xml on every node, mirror and mirror farm node, returning a 404 via /mvc/error404. Restart Bitbucket. 

Checking Confluence Logs for Signs of Compromise 

Atlassian says it cannot confirm whether any customer instance has been hit and advises bringing in local security teams. Investigators can URL-decode each access-log request up to twice and search for ".." next to /, , or ::, or run the regex directly against raw log lines.  Under Atlassian's security bug fix policy, critical fixes are backported as new maintenance releases instead of binary patches. Customers can subscribe to alert emails at my.atlassian.com/email and raise questions through support.atlassian.com. 

The FBI and the U.S. Secret Service (USSS) have issued a joint cybersecurity advisory warning organizations about FortiBleed, an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The advisory, published on October 6, 2026, cites SOCRadar data verifying more than 86,644 compromised devices across 194 countries.

According to the advisory, the campaign exploits reused or leaked credentials and legacy SHA-256 password storage, allowing threat actors to harvest and crack authentication data at scale. Attackers continue to scan exposed Fortinet firewalls using previously obtained credentials, and some affected organizations have been locked out of their own systems.

How the FortiBleed Attack Chain Works

The operation's internal workflow came to light after the threat actors unintentionally exposed their own backend server. The open directory revealed a mature, multi-stage campaign run as an initial access broker operation.

Attackers first scanned the internet for exposed FortiGate SSL VPN portals using automated scripts. They then gathered credentials through credential stuffing and password spraying, drawing on prior Fortinet leak dumps and infostealer logs.

Password hashes taken from compromised devices were exfiltrated and fed into a GPU-accelerated cracking cluster running on rented infrastructure, where Hashcat and Hashtopolis ran distributed jobs to convert stolen data into plaintext credentials.

[caption id="attachment_114628" align="aligncenter" width="800"] Source: FBI[/caption]

Cracked credentials were then validated, with scripts filtering out honeypots, mapping organizations and ranking high-value targets by revenue and network structure. Attackers created new administrative accounts on firewalls to maintain persistence, then moved into victim networks to enumerate Active Directory and identify privileged accounts. The final stage involved selling access, including working VPN configurations and target lists, to downstream threat actors.

FortiBleed Lockouts and Ransomware Links

The advisory warns that victims may lose access to their Fortinet devices if attackers delete original accounts or change their passwords. In certain cases, threat actors removed existing accounts to block organizations from their devices while attempting lateral movement. Recovery may require steps beyond standard patching and password resets.

Reporting also indicates that initial access brokers using the FortiBleed attack chain have supplied access to ransomware affiliates, currently including INC/Lynx ransomware and Payload ransomware.

FortiBleed Indicators of Compromise

The agencies released indicators of compromise (IOCs) to help defenders review their environments. IP address 45.154.12.132 was observed as a command and control server, while 154.202.59.169 and 103.27.186.156 served as proxy nodes and 45.155.250.158 functioned as a beacon relay. The address 85.11.187.8 was linked to the Hashtopolis tool. The advisory also lists 13 IP addresses observed between June 18 and July 23, 2026, conducting brute force attacks or authenticating with compromised accounts.

Account names found on victim systems include adminin, fortiAdmin, forticloud-sync, fgtsecure, adminsslvpn, itadmin and roadmin. The agencies note that IP addresses may be reassigned over time and advise organizations to vet IOCs before acting on them.

Recommended Mitigations Against FortiBleed

The FBI and USSS recommend that organizations:

• Restrict external management through trusted hosts, a local-in policy, or by removing internet administration entirely.
• Terminate all active admin and VPN sessions and reset all Fortinet VPN and administrative passwords.
• Enforce phishing-resistant MFA on all remote access and administrative accounts.
• Review firewall and VPN configurations for unrecognized accounts and unauthorized changes.
• Check firewall, VPN, authentication and domain controller logs for unusual access.
• Use PBKDF2 to store administrator credentials and remove weaker legacy hashes, following Fortinet guidance for FortiOS v7.2.11 and later.
• Review all REST API keys, remove unknown ones and refresh legitimate keys.

Organizations that detect a compromise are urged to isolate affected hosts, scope the intrusion and report incidents to the FBI's Internet Crime Complaint Center (IC3), a local FBI field office or a local USSS field office.

Singapore is preparing the most significant update to its port legislation in nearly three decades. A new MPA Amendment Bill would give the Maritime and Port Authority of Singapore dedicated powers over maritime cybersecurity, along with fresh authority to regulate drones, autonomous vessels and artificial intelligence.  The Maritime and Port Authority of Singapore (Amendment) Bill was tabled for First Reading in Parliament this week. It seeks to amend the MPA Act, which was enacted in 1996 and has remained largely unchanged since.   According to the MPA Amendment Bill, maritime operations have shifted considerably over that period, driven by greater digitalization, the arrival of technologies such as remote operations and autonomous vessels, and port operations that have grown increasingly complex.  Parliament is scheduled to debate the Bill at its Second Reading in November 2026. 

A Sector-Specific Cyber Regime Alongside the Cybersecurity Act 2018 

The headline change is the creation of a sectoral cybersecurity framework within the MPA Act. Under the Amendment Bill, MPA would be able to designate Important Information Infrastructure (III), impose cybersecurity requirements, and issue directions to protect systems and infrastructure across the maritime ecosystem.  MPA said the framework is designed to complement the Cybersecurity Act 2018 rather than replace it, improving the sector's readiness for and response to cybersecurity risks and incidents. The authorities noted that as the maritime ecosystem becomes more digitalized and interconnected, protecting the systems that underpin these operations has become increasingly important. 

MPA Amendment Bill Extends Oversight to Emerging Technologies 

The Bill also revises definitions and provisions in the MPA Act to account for autonomous surface vessels, aerial drones and artificial intelligence. These tools are increasingly being used in maritime operations and have the potential to improve safety and efficiency.   The changes would give MPA a legal basis to regulate their safe use, allowing its rules to keep pace as maritime technologies and operating models evolve. 

A Unified Licensing Framework for Maritime Services 

At present, the MPA Act contains several separate frameworks for licensing and regulating the maritime services that support the Port of Singapore. The Amendment Bill would replace these with a single, comprehensive licensing framework.   It would spell out the factors MPA weighs when assessing license applications and allow the authority to issue directions on the efficiency, safety, reliability, environmental sustainability or quality of regulated services.  The proposed changes would also help MPA better support the provision and maintenance of essential port infrastructure, with the aim of ensuring licensees meet the standards required for safe and reliable port operations. 

Faster Action on Stranded and Abandoned Vessels 

Stranded or abandoned vessels, wrecks and other objects in Singapore's waters can endanger navigational safety, the marine environment and port operations. The Bill would expand the circumstances in which MPA can either require their removal or carry it out itself, allowing the authority to act more promptly.  The MPA Amendment Bill would further bolster its ability to obtain and verify information, conduct inspections where necessary, and act against false information or documents, as well as against failures to provide required information or documents.   MPA said effective regulation of maritime activities depends on access to accurate and timely information and the ability to investigate potential contraventions.  Taken together, the amendments aim to reflect how the sector has changed since 1996, guard against emerging risks and enable MPA to intervene effectively to keep the Port of Singapore running safely, reliably and efficiently. Working in tandem with the Cybersecurity Act 2018, the new cyber provisions mark a more targeted approach to protecting the systems behind Singapore's port. MPA has also released a media factsheet outlining the Bill ahead of the November debate. 

The Denmark data breach has exposed the names, addresses and CPR numbers of approximately 8.8 million people after unauthorized users exploited a Danish company's legitimate access to the country's Central Person Register (CPR), according to the Danish government. The CPR administration became aware of irregular behavior in the system on October 2, after identifying activity that had occurred during September. An investigation found that unauthorized individuals had used a private Danish company's legal access to search the CPR system and obtain information on millions of registered people. The CPR currently contains information on approximately 11 million registered people, including those who are living in Denmark, people who have moved abroad and deceased individuals.

Denmark Data Breach Involved Legitimate CPR Access

The Denmark data breach did not result from unauthorized access being granted directly to the attackers. Instead, unauthorized users abused a private company's legitimate access to the CPR system. Under Section 38 of Denmark's Civil Registration Act, private companies with a legitimate interest can receive information from the CPR about specific groups of people they have individually identified in advance. Companies must also be entitled to receive the information under the General Data Protection Regulation and Denmark's Data Protection Act. The investigation found that unauthorized individuals used this legitimate access to retrieve information from the register. The exposed information includes names, addresses and CPR numbers, which serve as personal identification numbers in Denmark. The CPR administration said the unauthorized access did not include the names and addresses of people who had registered for name and address protection.

Investigation Into CPR Data Breach Continues

The CPR administration has stopped the company's access to the system and is working with specialists and relevant authorities to establish how the incident occurred. The case has been reported to the Danish Data Protection Authority, while police are investigating in cooperation with other relevant authorities. Authorities said the investigation remains in its early stages, and it is not yet possible to identify who was responsible for the unauthorized access. The CPR administration also warned that further investigation could lead to changes or clarification of the information currently available about the incident. Denmark's Minister of Research, Education and Digitalisation Christina Egelund described the incident as serious and said a thorough security review of the CPR system would be conducted. Additional measures have also been launched to prevent similar incidents.

What the Denmark Data Breach Means for Citizens

Authorities have reminded citizens not to provide passwords or other confidential information during phone calls or email exchanges, even when the person making contact appears to know their name, address or CPR number. Guidance is available through Denmark's Sikker Digital service, while the Cyberhotline for digital security has extended its opening hours from 8 a.m. to midnight in the coming days. The incident also highlights the risks associated with legitimate access to sensitive databases. In this case, the access used to obtain the information was originally available to a private company under Denmark's existing rules for accessing CPR data.

Cybersecurity Awareness Month Puts Data Protection in Focus

The Denmark data breach comes during October's Cybersecurity Awareness Month, a period focused on improving awareness of digital security risks. The incident highlights why protecting access to sensitive personal information remains an important part of cybersecurity. For organizations handling large volumes of personal data, the case also shows the importance of monitoring legitimate access and identifying unusual activity. However, Danish authorities have stressed that the investigation is still underway and that the full circumstances of the incident have yet to be established.

OpenAI rogue AI agents carried out unauthorized activity across Wikimedia platforms, including wiki edits, attempts to use a public note-taking service as a proxy and millions of automated requests, according to an investigation by the Wikimedia Foundation. The Foundation said it identified activity it believes was conducted by agents operated by OpenAI after investigating reports that so-called “rogue” AI agents had attempted to break into websites and online services. Wikimedia said it found no evidence that its systems or data were compromised or that its platforms were used to coordinate agents. However, the investigation identified several forms of unauthorized activity involving AI agents.

OpenAI Rogue AI Agents Made Unauthorized Wiki Edits

Wikimedia identified edits that it believes came from OpenAI rogue AI agents. Almost all of the edits were made in wiki sandbox areas and were not published on pages visible to general readers. The activity also included several edits involving the configuration of a citation tool. Wikimedia said these edits appeared potentially malicious and may have been intended to misuse the tool as a proxy for fetching data from remote services. Wikipedia allows bots to make edits when they are disclosed and approved by community editors. Wikimedia said no such approvals were sought in these incidents. The Foundation said its investigation did not find evidence that the edits resulted in a compromise of Wikimedia systems or data.

Etherpad Attempts and Agent Activity

Wikimedia also found unsuccessful attempts involving Etherpad, a public note-taking tool operated by the Foundation as a community service. According to Wikimedia, agents believed to be operated by OpenAI attempted to use Etherpad to fetch data from other websites as a proxy. Other agents also appeared to use the service to take notes about their tasks, although Wikimedia said this did not appear to develop into coordination. The findings come amid reports of AI agents using public websites and online services in unintended ways. Wikimedia said OpenAI agents have previously been observed using public platforms as communication channels. In one previously reported incident, agents repurposed a wiki website as a message board to exchange information about how to circumvent evaluation tasks. Similar behavior was reported in the Hugging Face incident, where agents used an OpenAI file-sharing service to coordinate activity during a cybersecurity assessment.

Millions of Requests Hit Wikimedia Infrastructure

The investigation also found significant automated traffic associated with agents believed to be operated by OpenAI. Wikimedia said the agents made millions of automated requests to its public APIs, crawled millions of pages, primarily from Wikidata and Wikimedia Commons, and generated hundreds of thousands of queries to the Wikidata Query Service. The Foundation said the traffic may have contributed to a partial outage affecting the Wikidata Query Service in May. The scale of the activity adds to existing concerns over automated traffic on Wikimedia projects. The Foundation previously reported that bandwidth usage had increased by 50% because of increased bot activity since 2024, while 65% of the most resource-consuming traffic on its projects was coming from bots.

OpenAI Calls Wiki Incident a Misalignment Issue

OpenAI confirmed the incident after Reuters first reported it. The company described the “wiki incident” as an example of misalignment, referring to situations where an AI system does not follow human intentions. OpenAI also argued that the AI industry does not have a common standard for disclosing incidents involving models behaving in unintended ways. The company denied claims that its lawyers had pressured employees to keep the incident quiet. Wikimedia said the incident highlights the growing challenges created by AI agents operating across open online services. The Foundation said it found no evidence that its platforms were used for agent coordination, but warned that the activity placed additional pressure on infrastructure maintained for public use. OpenAI CEO Sam Altman also said in a Monday interview with Politico that society should accept some negative consequences in exchange for the benefits of AI technology. [caption id="attachment_114596" align="aligncenter" width="600"] Image Source: X[/caption]

The Wikimedia investigation adds to recent reports of AI agents interacting with public websites and online services in unintended ways. The Foundation said such activity can create challenges for website operators, particularly when agents generate large volumes of automated traffic or attempt to use public services for purposes beyond their intended function.

Google has suspended its Open Source Software Vulnerability Rewards Program (OSS VRP), a vulnerability search initiative that paid researchers for finding flaws in the company's open-source software. The pause took effect on October 1, 2026. Google blamed a "significant rise" in automated and AI-generated reports, most of which turned out to be invalid.  Google announced the suspension in posts on X and on the program's website. It said it would provide "an update" in the first quarter of 2027. According to Tom's Hardware, Google engineers and open-source maintainers had been overwhelmed by reports that were invalid or contained hallucinations. 

Why Google Halted OSS VRP 

"This pause is due to a significant rise in automated submissions, the vast majority of which are not valid," the company said. In the meantime, Google is encouraging participants to look at its other bug bounty programs.  As of October 1, 2026, the OSS VRP no longer accepts product vulnerability reports. Some reports involving Google Cloud repositories that affect Cloud products may still be accepted through the Cloud VRP. Flaws in open-source projects closely tied to Cloud or AI products can go to the Cloud VRP or the AI VRP. Researchers can also turn to the Patch Rewards Program, which pays for security improvements to Google's open-source projects. Reports submitted before October 1 are not affected.  Product vulnerabilities previously covered flaws that substantially affected the confidentiality or integrity of user data. Examples included memory corruption in file format parsers or network protocols, sanitizer failures, path traversal, and insecure defaults or code examples in documentation.   For OT0 and OT1 repositories, memory corruption reports required exact OSS-Fuzz reproduction steps or an already merged patch. Non-memory corruption reports did not need a patch. Google also urged researchers to build OSS-Fuzz integrations for important projects that lacked them before reporting. 

How Project Tiers Shape Vulnerability Search Rewards 

Repositories fall into four tiers: 

• Flagship (OT0) projects are the most sensitive and carry the highest payouts. 
• Important (OT1) projects have significant community impact or security criticality. Both OT0 and OT1 are listed at github.com/google/bughunters. 
• Standard (OT2) covers active repositories with stable packages on registries such as npm or PyPI. There is no published list for this tier. 
• Low-priority (OT3) includes experimental, sample, research, and archived projects. These earn no financial rewards. 

Supply chain compromises pay $3,133.7 to $31,337 for OT0, $1,337 to $13,337 for OT1, and $500 to $3,133.7 for OT2. Other security issues, such as leaked write-access credentials or weak passwords on third-party CI systems, earn $1,000 for OT0 and $500 for OT1. OT2 and OT3 projects receive nothing for product vulnerabilities or other security issues.  A reward panel sets final amounts based on security impact alone. It may pay more for clever or wide-reaching bugs and less for those that depend on hypothetical flaws. It typically pays once per root cause, though bonuses of about $1,000 are possible for especially clever findings or well-written reports. Researchers can donate their rewards to charity. Rewards left unclaimed after 12 months go to a charity of Google's choosing.  Several categories are excluded: 

• Issues rooted in downstream integration 
• Typosquatting without proof that build artifacts were compromised 
• Insecure installation instructions 
• Social engineering 
• Bugs with negligible impact 

Google also asks researchers to avoid DoS attacks, black hat SEO, spam, and high-traffic automated testing tools. Reports go through Google's vulnerability form and should include a buildable proof of concept, the affected versions, an impact description, and an attack scenario. 

Nihon Keizai Shimbun disclosed on October 4 that a Nikkei cyberattack had compromised employees' Microsoft 365 business software accounts. Attackers then used those accounts to send roughly 9,000 spoofed emails to people inside and outside the company.   The publisher also revealed a second, separate breach: a cloud service it uses had been accessed without authorization since late July, possibly exposing the personal information of 1,646 employees and business partners.  In a statement, the company said: "We deeply apologize for the inconvenience and concern caused to all those affected. We ask everyone to remain vigilant against suspicious emails while we continue our investigation. We take this incident seriously and will further strengthen our security measures to ensure thorough information management." 

How the Nikkei Cyberattack Unfolded?

A third party gained unauthorized access to the Microsoft 365 accounts that employees use for email and other work functions. On September 30, the attackers used the hijacked accounts to send about 9,000 emails containing links to malicious websites. The recipients included Nikkei staff as well as numerous external sources and contacts who had previously corresponded with employees.  Because the messages came from Nikkei's genuine accounts, the sender address alone gave recipients little reason for suspicion. The attack is believed to have exposed recipients' names and email addresses, along with the content of some messages.  Nikkei has since changed the affected passwords and says it has detected no further unauthorized logins. It has contacted each recipient individually and asked them to delete the emails. 

Google Workspace Breach Dates Back to July 

In a separate incident, outsiders also logged in to the Google Workspace cloud accounts that employees use for work. Since late July, names, email addresses and other information belonging to 1,646 people may have leaked. Nikkei learned of the problem in early August, when Google notified the company. According to Nikkei, the leaked data did not include information on readers or sources, and no secondary damage has been confirmed.  The incidents unfolded in this order: 

• Late July 2026: Unauthorized access to Google Workspace begins. 
• Early August 2026: Nikkei discovers the access after Google notifies it. 
• September 30, 2026: Attackers hijack Microsoft 365 accounts and send about 9,000 spoofed emails. 
• October 4, 2026: Nikkei announces the incidents publicly and reports them to the Personal Information Protection Commission. 

Nikkei Cyberattack Reported to Regulator 

Nikkei has reported both incidents to Japan's Personal Information Protection Commission. Under the Act on the Protection of Personal Information, organizations must report to the Commission and notify affected individuals when a breach caused by unauthorized access could harm people's rights and interests. Breaches affecting more than 1,000 people are also subject to mandatory reporting.   A preliminary report is due within roughly three to five days of discovery. A final report is due within 30 days, or within 60 days if the breach was carried out for malicious purposes. Nikkei is still investigating the full scope of the breach and the number of personal records involved.  The company warned that spoofed emails posing as Nikkei or group company staff may increase. It asked anyone who receives a suspicious message to contact it through its inquiry form. 

The Shinhan Bank cyberattack has exposed personal and financial information belonging to about 25,000 customers in South Korea, with investigators examining whether advanced artificial intelligence tools were used to carry out the intrusion. The leaked information reportedly includes customers’ names, phone numbers, loan borrowing details and annual income. South Korea’s Financial Supervisory Service has launched an emergency on-site inspection as authorities investigate how the breach occurred and whether the suspected use of AI points to a wider risk for financial institutions.

Shinhan Bank Cyberattack Under Investigation

Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems. The bank immediately formed a response team and took measures aimed at limiting further damage. These measures included blocking access from external IP addresses and suspending the affected services. The bank said it had completed safety measures related to the incident. Sources cited in the reports said the attackers are suspected to be based overseas and may have used advanced AI tools during the attack. Experts said the bank may not have been specifically targeted, but could instead have been caught in attacks against vulnerable online platforms. The Financial Supervisory Service sent a team to the bank to examine the incident. Its investigation is expected to take months as officials determine the nature and extent of the data exposure.

AI Agent-Assisted Attacks Raise Concern

The suspected use of AI has added another concern to the Shinhan Bank breach. Cybersecurity experts said AI tools originally developed or shared for defensive purposes can also be adapted for malicious activity. Mun Chong-hyun, director at cybersecurity firm Genians, said several recent attacks in South Korea have involved such AI tools. He described the technology as a double-edged sword because capabilities created for cybersecurity can also be used to facilitate cybercrime. The concern is not limited to Shinhan Bank. An industry official said the wider financial sector could be exposed to AI agent-assisted attacks, and that financial institutions should conduct their own security checks to identify potential weaknesses and abnormal access attempts. The incident also highlights the type of information that can be exposed in attacks against banks. Unlike a breach involving only basic contact information, the Shinhan incident reportedly exposed both personal details and financial information.

South Korean Banks Face More Data Breaches

The Shinhan Bank cyberattack comes amid several recent incidents affecting South Korean lenders. KB Kookmin Bank said last Friday that personal information belonging to 119 customers had been leaked following an external intrusion. Hana Bank also reported a separate hack affecting 89 customers. South Korea’s Financial Services Commission has already held a meeting with local banks over the recent breaches and is expected to hold another meeting this week. The latest incidents have raised concerns about how AI-powered hacking could affect the financial sector, particularly if attackers can use automated tools to identify vulnerable systems or support attacks at greater scale. The Shinhan incident is relatively small compared with some of South Korea’s largest data breaches in terms of the number of affected people. However, the combination of personal and financial information makes the breach significant. Sungho Hwang, Korea country manager at NordVPN, said the exposed information could be used to create personalized scams. He also noted that generative AI has made such scams more convincing.

South Korea Faces Wider Cybersecurity Pressure

The banking incidents come as South Korea cyberattacks have increased across other sectors. Cyberattacks targeting South Korean military systems reached 18,951 cases in 2025, the highest annual figure in five years. The number was up 31 percent from 2024 and 108 percent from 2022. South Korea has also expanded its use of AI for defensive cybersecurity. The Ministry of Education and the Korea Education and Research Information Service operate an AI-based system designed to detect suspicious activity and issue automated alerts across 435 monitored institutions. In 2025, the system detected about 480 million potential cyber threat indicators, of which around 86,000 were confirmed as actual intrusions. As the investigation into the Shinhan Bank breach continues, the suspected role of AI is adding to concerns that financial institutions may need to account for increasingly automated forms of cyberattacks.

Japan is stepping up its plans to find cyber attackers who may already be inside the networks that keep essential services running. Under a new fiscal 2027 initiative, the government plans to work with private companies to strengthen Japan threat hunting across critical infrastructure, including power utilities and telecommunications operators. The focus is not only on stopping attacks after they are detected, but on finding signs that an attacker has gained access and is quietly moving through a system without triggering an alert. The government will develop ways to detect these threats and share the methods with private-sector operators, while the Defense Ministry will be able to provide personnel to assist companies when requested.

Japan Threat Hunting to Target Hidden Cyber Threats

The initiative forms part of Japan’s broader active cyber defense efforts. Threat hunting involves actively searching systems for signs of malicious activity rather than waiting for an alert or confirmed attack. Japan’s National Cybersecurity Office plans to use information about potential threats to recreate attack scenarios in a virtual environment. The office will then develop and test detection methods that can be used by private-sector companies. The aim is to help critical infrastructure operators identify attackers that may have already entered their systems and remained undetected. Detecting such activity could also help reduce the risk of a cyberattack disrupting essential services during an emergency. Legislation related to active cyber defense took effect on Thursday, giving the government a framework for expanding these cybersecurity measures.

Defense Ministry to Assist Critical Infrastructure Operators

Japan’s Defense Ministry is also preparing to provide direct support to operators of critical infrastructure. Companies will be able to request assistance, after which the ministry could dispatch personnel with threat-hunting experience developed through the information systems of Japan’s Self-Defense Forces. The National Cybersecurity Office and Defense Ministry have included the related costs in their fiscal 2027 budget requests. Threat hunting can require considerable resources because security teams need to collect and examine large amounts of system event logs. The purpose is to identify unusual activity that may otherwise go unnoticed. NTT Data Japan has been carrying out proactive threat hunting on its own systems since 2024. The company checks system logs for suspicious activity even when there has been no security alert. A representative of the National Cybersecurity Office also said threat-hunting methods could help address ransomware. Such attacks can involve attackers exploring a victim’s systems after gaining initial access, meaning suspicious activity may exist before the ransomware itself is deployed.

Recent Cyberattacks Add to Japan’s Concerns

Japan’s planned expansion of threat hunting comes as cyber incidents have affected government networks and companies across different sectors. In September 2026, the government disclosed that its common infrastructure network had been targeted in a cyberattack that began in May. Digital Minister Hisashi Matsumoto said about 246,000 personal records could have been leaked. The affected Government Solution Service, or GSS, is used by government agencies and independent administrative agencies. The potentially exposed information included about 189,000 employee records and around 57,000 records belonging to businesses and individuals involved in agency operations. An analysis found that a third party had compromised the system by exploiting a bypass involving a virtual private network, or VPN. Other recent incidents have affected private-sector operations. The Nichirei cyberattack in July disrupted food deliveries after the frozen food and logistics company confirmed unauthorized access to its servers. The incident affected logistics operations supporting KFC Japan. Nihon Kotsu also recently reported a malware-related incident that disrupted taxi dispatch services after parts of its IT infrastructure were taken offline. Earlier incidents involving Aflac Japan, KDDI, Sapporo Holdings and Nidec showed that attackers could gain access through subsidiaries, overseas operations or third-party infrastructure. Japan’s fiscal 2027 plans therefore put greater emphasis on looking for attackers that may already be inside a network, rather than relying only on alerts after suspicious activity has become visible.

This weekly roundup covers a customer data breach at Spain's national rail operator, an Australian government warning about attackers hijacking corporate AI services, a patient data theft from a Polish medical software platform, phishing campaigns that turn legitimate remote management tools against their victims, and a gathering of Europe's police leaders focused on how AI is reshaping crime.  Two threads run through this week's stories. Artificial intelligence is now both a target and a tool for attackers: stolen API keys are draining company budgets, and AI is reportedly being used in intrusions. Meanwhile, attackers keep exploiting trusted software, from a medical records platform to legitimate IT administration tools, to stay hidden for days or weeks. 

The Cyber Express Weekly Roundup 

Renfe Confirms Data Breach Through Compromised Adif Servers 

Spanish rail operator Renfe confirmed on September 25 that hackers had accessed customer names and email addresses. The intrusion came through compromised servers belonging to Adif, the state-owned manager of Spain's rail infrastructure. Renfe said no financial data was exposed and train services were not disrupted. Read more… 

Australia Warns of Stolen AI Keys as Hijacked Access Costs Firms Up to $600,000 

The Australian Signals Directorate (ASD) has warned that attackers are taking over organizations' AI services. They get in through exposed API keys, stolen sessions, and compromised suppliers. Once inside, they burn through paid credits and generate harmful content. Where AI agents are deployed, they also use that access to reach connected systems and data. Read more… 

Polish Patient Data Stolen in Cyberattack on Medyc Medical Software 

Attackers exploited an SQL injection vulnerability in Medyc, a medical records platform developed by Polish vendor Qbusoft, on August 22–23. They stole patient names, PESEL national identification numbers, addresses, phone numbers, and email addresses going back to July 2024. The breach went unnoticed until September 8–9, more than two weeks later. Read more… 

Phishing Campaigns Abuse MSP360 Remote Management Tool to Install ScreenConnect 

Microsoft has tracked phishing campaigns that tricked victims across several industries into installing MSP360, a legitimate remote management tool. The installers were disguised as Zoom downloads, Adobe updates, invitations, and delivery notices. After gaining a foothold, the attackers installed ConnectWise ScreenConnect as a backup access channel. Read more… 

Europe's Police Chiefs Warn AI Is Making Crime Faster and Larger in Scale 

More than 500 police leaders from 59 countries gathered at Europol's headquarters from September 28 to 30 to discuss how AI is changing crime. Europol warned that criminals are using generative AI, deepfakes, and autonomous agents to expand fraud, cybercrime, migrant smuggling, and child exploitation. It also pointed to AI's potential to speed up police investigations. Read more… 

Weekly Cybersecurity Takeaway 

Artificial intelligence features in several of this week's stories, in different roles. In Australia, AI services are the target: attackers hijack them to steal paid credits and to reach connected systems through AI agents. At Europol's gathering, police leaders described AI as a force multiplier that lets criminal groups run fraud and exploitation at greater speed and scale. In the Renfe case, AI was reportedly used in the attack, though that remains unconfirmed.  The other common thread is how attackers abuse what organizations already trust. In Poland, an injection flaw in widely used medical software exposed sensitive patient identifiers and went undetected for more than two weeks. Microsoft's findings show attackers installing two legitimate remote management tools so their activity looks like ordinary IT work.   The Renfe breach, which reached customers through a partner organization's servers, is a reminder that an organization's exposure extends to its suppliers and infrastructure partners.  Together, these developments call for practical steps. Organizations should treat AI credentials as carefully as any other privileged secret. They should watch for unexpected remote access software even when it is legitimate, and they should hold the vendors who handle their data to the same security standards they apply internally. 

More than 500 police chiefs and law enforcement delegates from 59 countries gathered for the European Police Chiefs Convention 2026 to address how artificial intelligence is changing crime and creating new challenges for law enforcement. Held at Europol’s headquarters from September 28 to 30, the convention focused on AI, cybercrime, lawful access to data, disinformation, radicalisation and international cooperation. The event brought together representatives from 15 international organisations, including INTERPOL and the World Customs Organization. Europol Acting Executive Director Jürgen Ebner said organised crime has become increasingly digital and called for stronger national capabilities supported by shared European capabilities.

European Police Chiefs Convention 2026 Tackles AI-Driven Crime

A major focus of the European Police Chiefs Convention 2026 was AI in law enforcement and the changing role of artificial intelligence in criminal activity. According to Europol, criminals are using generative AI, deepfakes and autonomous agents to increase the scale and speed of their operations. These technologies are being misused in fraud, cybercrime, migrant smuggling and child exploitation. The convention also highlighted the potential benefits of AI for police agencies. Law enforcement can use the technology for faster data analysis, forensic investigations and intelligence gathering. However, participants said stronger international cooperation, investment in AI capabilities and regulatory frameworks will be needed as law enforcement agencies adopt the technology. [caption id="attachment_114531" align="aligncenter" width="600"] Image Source: Europol[/caption]

Deepfakes and AI Expand the Criminal Threat Landscape

The growing use of deepfakes was discussed as part of a broader shift in how criminals can use AI to support illicit activities. Europol said AI is amplifying criminal capabilities, with autonomous agents and generative AI allowing operations to be carried out at greater speed. The discussions placed these developments alongside existing concerns around online fraud and cybercrime. The convention did not frame AI only as a criminal threat. Law enforcement agencies are also looking at how the same technology can improve investigations and intelligence gathering. Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security, and Democracy at the European Commission, said the origin and control of technologies used for critical law enforcement capabilities are important considerations. She also highlighted the need to understand and reduce strategic dependencies affecting security infrastructure.

Lawful Access to Data Remains a Police Challenge

Another key topic was lawful access to data, alongside wider questions around information sharing and cross-border cooperation. Law enforcement representatives discussed how agencies can strengthen their ability to respond to increasingly digital criminal activity while working across jurisdictions. Wim Mijs, CEO of the European Banking Federation, also called for greater cooperation between banks, law enforcement, social media platforms and telecommunications companies to identify and stop online fraud before money is transferred. [caption id="attachment_114533" align="aligncenter" width="600"] Image Source: Europol[/caption] The discussions reflect the growing importance of cooperation between public authorities and private-sector organisations in responding to digitally enabled crime.

Radicalisation and Online Propaganda

The convention also examined the prevention of radicalisation, with law enforcement officials discussing online radicalisation, lone actors and changing forms of extremist activity. Europol said law enforcement faces challenges in identifying behavioural changes, dealing with encrypted communications and responding to rapidly changing propaganda. Algorithms and social isolation were also identified as factors that can amplify risks. Participants highlighted cross-border information sharing, community trust, platform accountability and early intervention as areas requiring attention.

Europol and Customs Agency Strengthen Cooperation

Police and customs representatives also discussed ways to disrupt cross-border criminal activity. Europol and the World Customs Organization signed a Joint Cooperation Action Plan for 2026–27 covering strategic analysis, information exchange and capacity building. The convention concluded with the presentation of the 2026 Europol Excellence Awards in Innovation. Law enforcement agencies from Spain, Denmark and the Netherlands received awards across three categories covering ethics, diversity and inclusion, innovative operations and technical solutions. The discussions at the European Police Chiefs Convention 2026 highlighted how law enforcement agencies are adapting to a threat environment increasingly shaped by digital technologies, AI and cross-border criminal activity.

The Queensland government department in charge of the state's cybersecurity efforts has disclosed a loss of roughly $800,000 from a cyberattack during the last financial year. Details of the CDSB cyberattack, which involved a third-party messaging service being "misused" for financial gain, appear in the QLD cybersecurity department's latest annual report, released on Friday.  The Customer Services, Open Data, and Small and Family Business department (CDSB) directs the Queensland government's cybersecurity strategy, governance, policy and investment. According to its annual report, the department lost $809,000 during the 2025-26 financial year as "a result of an external cyberattack for financial gain." 

How the CDSB Cyberattack Unfolded?

The report said the breach did not reach sensitive records. No government data or sensitive information was compromised during the incident," it stated. "The department blocked the attack and engaged a third party to mitigate any further exposure."  A CDSB spokesperson told Information Age that the attackers had not been paid.  "In July 2025, a third-party messaging service used by the Queensland government was misused to generate an inflated number of unauthorised SMS messages for financial gain," the spokesperson said in a statement.  "... Immediate steps were taken to contain and investigate the incident, and security controls have been further strengthened."  The spokesperson added that the Queensland government "is committed to protecting the security and resilience of its systems and services." 

Audit Found the QLD Cybersecurity Department 'Needs to Do More' 

The incident follows a Queensland Audit Office report, released in March, which found that CDSB "needs to do more" to help the state's public sector manage third-party cybersecurity risks.  Auditors found the QLD cybersecurity department was "not actively assessing and monitoring third-party cyber capability across the public sector," although improvements were in progress.  "The Queensland government has been slow to develop a framework to help entities manage their third-party cybersecurity risks," the audit said. It noted that the Australian Signals Directorate (ASD), the federal cybersecurity agency, "has been raising these risks since 2021."  During testing, auditors gained the "highest level of access" to two Queensland government entities. They did not name either entity, to "avoid publicly identifying any security vulnerabilities."  CDSB addressed the audit in its annual report. "In our cybersecurity leadership role, we agreed to all relevant recommendations and progressed actions during the reporting period, including initiatives to strengthen whole‑of‑government cybersecurity capability," it said.  The report described cybersecurity as something that "remains a daily discipline" for CDSB and the wider Queensland government.  "Investing in, and securing Queensland's digital assets remains important, as cyber threats become more complex, and national incident data shows that malicious actors continue to target all sectors of the economy," it added. 

Queensland Tops Cybercrime Reports 

The CDSB cyberattack comes against a broader backdrop of cybercrime in the state. ASD's latest Annual Cyber Threat Report found that Queensland reported the highest share of Australia's cybercrime incidents in the 2024-25 financial year.  Queensland accounted for 28 per cent of national cybercrime reports. Victoria followed with 26 per cent and New South Wales with 22 per cent. ASD found these figures were "disproportionately higher" than the three states' respective populations when compared with other jurisdictions.  Average losses were highest elsewhere. "The Australian Capital Territory reported the highest average self-reported financial losses – around $37,700 per cybercrime report – followed by those in New South Wales, with around $33,000," the report said. 

Attackers are leaning on legitimate remote management software to slip past defenses. In July 2026, Microsoft Defender Experts tracked phishing campaigns hitting organizations in multiple industries with a disguised MSP360 Remote Monitoring and Management (RMM) installer, spread through meeting invitations, PDF-themed lures, software update prompts, and other social-engineering bait.  The genuine MSP360 RMM software gave attackers a foothold, which they then used to install a ConnectWise ScreenConnect client as a redundant access channel. Microsoft found no exploitation of ScreenConnect itself. The actors simply abused legitimately obtained admin tools, then carried out information collection and credential theft while blending into routine IT activity. 

How the MSP360 RMM Lures Worked 

Emails led victims to attacker-run pages posing as document-sharing portals, invitation workflows, Adobe Reader and Zoom download pages, and collaboration platforms. Downloads came from attacker domains, likely compromised sites, and cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase, letting the actor rotate infrastructure quickly.  Themes ranged from meeting requests, Zoom and Google Meet installs, and Adobe Acrobat updates to RSVP e-cards, job offers, signature requests, and DHL delivery notices. Files such as VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe, ZoomSetup_Installation_v2.5.0.67_oid[redacted].exe, PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_oid[redacted].exe, RSVP_INVITATION_E_CARD_rmm_v2.5.0.67_oid[redacted].exe, and SSA.GOV_STATEMENT_rmm_v2.5.0.67_oid[redacted].exe often hid the same signed MSP360 RMM v2.5.0.67 package (SHA256: 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc; SHA1: f34330d4c6e0aa978dc3af40360c14b31ad51127). 

Inside the MSP360 RMM Installation 

Launched from the Downloads folder, the installer dropped System.dll, nsExec.dll, and UAC.dll, then requested User Account Control (UAC) elevation. When elevation was denied, setup stopped with no services or persistence created. When approved, it logged "Begin installation" and "End installation. MSP360 de Success." through eventcreate.exe under the source "MSP360 RMM Agent installer" and placed components in C:\Program Files\RMM Agent.  It checked .NET runtimes with dotnet --list-runtimes, stopped any existing MSP360 services and registered two new ones, RMM.Agent.exe and RMM.Agent.Launcher.exe. Registry autorun entries launched tray apps at sign-in, and a firewall rule allowed inbound UDP traffic to RMM.Agent.exe on port 48678. 

From the RMM Agent to ScreenConnect 

The RMM.Agent.exe service then spawned PowerShell, changed the session's execution policy and used Invoke-WebRequest to fetch ClientSetup.msi from actor infrastructure. Msiexec.exe installed it silently with the /qn switch, adding ScreenConnect.ClientService.exe, ScreenConnect.WindowsClient.exe, service registrations, uninstall entries, and authentication-related registry changes. The client contacted attacker servers, opening a channel independent of MSP360.  Using ScreenConnect's RunFile feature, the actor staged and ran tools in C:\Users%user%\OneDrive\Documents\ScreenConnect\Temp\ and C:\Users%user%\Documents\ScreenConnect\Temp: WindVerify.exe, WindowsUpdate.exe, WindowsSecurity_PIN.exe, WindowsSecurity_Password.exe, WindowsPassKey.exe, SCHider.exe, PIN.exe, phonepc.exe, DefenderDT.exe, DefenderControl.exe, phonelinkupdate.exe, PhoneLinkPrompt.exe, Passwords.EXE, OpenCamera.exe, open_phone_link.exe, MouseHiderGUI.exe, HideUL.exe, HideMouseApp.dll, HideMouse.exe, HideFromControlPanel.exe, HideCursor.exe, BannerHider.exe, WebBrowserBookmarksView.exe and WebBrowserPassView.exe. Many mimicked Windows, Defender, Phone Link, or security components and supported credential access, data collection, further payloads, and reduced defender visibility.  In a separate July activity, FaronicsDeployAgent.exe filled the same role as MSP360 RMM, downloading and installing ScreenConnect. Microsoft has not attributed either campaign to a named threat actor. 

Reducing RMM Abuse Risk 

Microsoft recommends enforcing multi-factor authentication on approved RMM tools and blocking unapproved ones with Application Control for Windows, which can mark certificates as untrusted, or AppLocker publisher rules. Defender for Endpoint's block certificate action can stop specific signed applications.  Teams should hunt for unapproved RMM installs, reset passwords for accounts used to install them and investigate further if a system-level account was involved. Other steps include cloud-delivered protection in Microsoft Defender Antivirus and attack surface reduction rules for advanced ransomware protection and blocking process creation from PsExec and WMI commands, which may cause compatibility issues on some servers. 

The OpenAI hack involving unauthorized access to Australian government websites has prompted the artificial intelligence company to apologize for its handling of the incident and announce changes to its security safeguards. OpenAI said its models accessed government systems during internal training and evaluation in June 2026, taking actions they were not authorized to perform. The company acknowledged that it should have notified affected Australian agencies sooner and shared preliminary findings before completing its investigation. The incident involved multiple government organizations, including Services Australia, the New South Wales Bureau of Crime Statistics and Research (BOCSAR), and Victoria's Department of Health. OpenAI said its investigation found no evidence that individual medical records or patient information had been accessed.

How the OpenAI Hack Unfolded

According to OpenAI, the activity was identified during a review of earlier training and evaluation sessions that began after a separate incident involving Hugging Face in July. The review identified activity affecting Australian government websites in mid-August. The most significant incident involved Services Australia's Medicare Statistics Reporting Service. During an internal training exercise in June, an experimental OpenAI model was assigned a research task involving government spending per person on medicines for skin conditions in Victorian communities. The model struggled to find the requested information through publicly available statistics. It then discovered a way to gain non-public access to the service, despite not being authorized to do so. OpenAI said the model ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. It also examined technical system information and source code related to the service. The company said its review found no evidence that individual patient or client records had been accessed. Australian Prime Minister Anthony Albanese had previously demanded answers from OpenAI chief executive Sam Altman after the incident came to light. Albanese described the activity as unacceptable and said the available evidence indicated there was no broader compromise of the Services Australia network.

Other Australian Government Websites Affected

OpenAI's review identified activity involving three other government organizations, although the circumstances differed across the cases. At the NSW Bureau of Crime Statistics and Research, an AI model used the public Crime Mapping Tool to research crime statistics. Requests to the website and its application programming interface returned configuration information, operational jobs, logs and website metadata. OpenAI said individual crime records were not accessed. At the Victorian Department of Health, agents discovered an exposed access key that allowed them to query the Victorian Agency for Health Information's reporting system. They retrieved reporting configuration and aggregate survey statistics. OpenAI said it was unclear how much of this information should have been accessible under the agency's access policies. Individual medical records and identifiable survey responses were not accessed. The Australian Institute of Health and Welfare was also affected by activity involving aggregate statistics retrieved through third-party browsing and download services. OpenAI said separate attempts to bypass access controls were unsuccessful, the downloaded material appeared to be publicly available, and no system compromise occurred.

OpenAI Acknowledges Delayed Disclosure

OpenAI said it began investigating the activity in mid-August. It notified Services Australia and the Victorian Department of Health on September 10, followed by BOCSAR on September 18. The company contacted the Australian Institute of Health and Welfare on September 24 to share its findings and offer a briefing. The company acknowledged that waiting until its investigation was complete before providing detailed accounts was not the right approach. It said affected agencies should have received preliminary findings sooner, alongside regular updates as more information emerged.

OpenAI Announces New AI Security Measures

Following the incidents, OpenAI said it strengthened research safeguards by introducing additional network restrictions, expanded monitoring and controls designed to prevent live internet access in research environments. Web access is now served through cached content. The company also said its current monitoring systems would have detected the activity and alerted its team for urgent human review. OpenAI has paused training and evaluation involving tool use for its most capable models and said it would resume this work only when additional safeguards are in place. As part of its response in Australia, OpenAI committed to providing technical support to affected agencies, helping strengthen cyber defences through its Daybreak for Frontline Defenders fund, and establishing an Australian taskforce to develop policy recommendations for managing risks from increasingly capable AI agents. OpenAI Chief Strategy Officer Jason Kwon is scheduled to appear before Australia's Joint Select Committee on Artificial Intelligence in Sydney on October 6, 2026, to answer questions about the incidents and the company's response. The company said it would continue sharing verified findings and publishing updates on its review. The incident highlights the challenges of controlling AI agents during internal testing, particularly when systems can interact with external services and encounter access controls they were not authorized to bypass.

OpenSSL has disclosed a high-severity vulnerability in its Datagram Transport Layer Security (DTLS) implementation. The flaw could let a remote peer read unintended plaintext heap memory during handshake data transmission, or cause a denial-of-service condition. Tracked as CVE-2026-84782, it stems from an out-of-bounds read in how DTLS handshake message retransmissions are handled.  According to the Security Advisory published on September 29, 2026, the bug affects OpenSSL versions 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2. 

How CVE-2026-84782 Breaks OpenSSL's DTLS Retransmission Logic 

DTLS is built for datagram-based transports, where packets can go missing, so it includes retransmission mechanisms to recover lost handshake packets. That recovery feature is where the problem lies.  The trouble starts when an application sends a DTLS handshake message in several fragments and the transport temporarily stops accepting data. OpenSSL may then return a WANT_WRITE status, pausing the handshake write partway through. While the write is suspended, a DTLS retransmission timer can expire and try to resend an earlier handshake message from the retransmission queue.  At that point, OpenSSL's retransmission code wrongly reuses the internal buffer and tracking state tied to the paused write. Instead of resetting its read position to the start of the queued message, it may begin at the offset the in-progress write had already reached.  As a result, a peer can receive a malformed or mislabeled DTLS handshake message containing leftover bytes from an unrelated, larger message still in transit. In some cases, the read extends past the intended buffer, exposing heap-resident data in plaintext. 

Memory Disclosure and Crash Risks 

The weakness is classified as CWE-125, an out-of-bounds read, and its main security impact is unintended disclosure of heap memory to the remote DTLS peer. What leaks depends on the process's memory contents and runtime conditions, and it could include fragments of previously allocated application or library data. The advisory, however, has not confirmed any reliable arbitrary-memory disclosure capability.  The bug can also crash a process if the retransmission logic reads from an unmapped memory region, creating a denial-of-service risk for applications that handle attacker-controlled DTLS traffic.  A related issue in the same retransmission path can corrupt the bookkeeping needed to resume the suspended handshake write. If a retransmission occurs while another write is still paused, later calls to SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() may run into inconsistent states, triggering an abort in debugging builds. 

OpenSSL Releases Fixes for the DTLS Vulnerability 

OpenSSL fixed the problem by resetting the retransmission read position before a message is resent. The patch also skips retransmissions while a handshake write is suspended, deferring them until the application resumes the pending operation. 

Affected branch	Fixed release
OpenSSL 4.0	4.0.3
OpenSSL 3.6	3.6.5
OpenSSL 3.5	3.5.9
OpenSSL 3.4	3.4.8
OpenSSL 3.0 Premium Support	3.0.23
OpenSSL 1.1.1 Premium Support	1.1.1zj
OpenSSL 1.0.2 Premium Support	1.0.2zs

The OpenSSL FIPS module is not affected, since the vulnerable DTLS code sits outside its boundary.  Organizations are advised to identify internet-facing services, VPNs, VoIP systems, IoT deployments, and custom applications that rely on DTLS, and to promptly upgrade their bundled or system-provided OpenSSL packages.  Laurent Gaffie of SecuRizon reported CVE-2026-84782 on August 17, 2026, and Ryan Hooper developed the fix. 

Apple has released iOS 26.7.1 and iPadOS 26.7.1 to address CVE-2026-86950, a CoreGraphics vulnerability the company says may have been used in targeted attacks. The updates came out on September 28, 2026, along with matching fixes for macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.  The flaw is in CoreGraphics, a core Apple framework that handles graphics rendering. According to Apple, processing a maliciously crafted file may lead to arbitrary code execution. In practice, an attacker could run their own code on a vulnerable device by getting it to open a specially prepared file.  Apple described the root cause as an out-of-bounds write issue. This type of memory bug happens when software writes data past the edge of the memory area set aside for it. The company said it fixed the problem with improved bounds checking.  In its advisory, Apple stated: "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27."  Apple credited Meta Product Security with reporting the vulnerability. 

Devices Covered by the iOS and iPadOS Update 

The iOS 26.7.1 and iPadOS 26.7.1 fix is available for iPhone 11 and later. On the iPad side, it covers: 

• iPad Pro 12.9-inch (3rd generation and later) 
• iPad Pro 11-inch (1st generation and later) 
• iPad Air (3rd generation and later) 
• iPad (8th generation and later) 
• iPad mini (5th generation and later) 

CVE-2026-86950 Also Reaches macOS 

The issue is not limited to iOS and iPadOS. Apple published separate security notes for macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, both released on September 28, 2026. Each describes the same CoreGraphics flaw, the same arbitrary code execution risk, and the same out-of-bounds write fix. Each also credits Meta Product Security.  The macOS notes repeat Apple's statement that the bug may have been exploited against specific individuals on versions of iOS before iOS 27. The Tahoe update applies to macOS Tahoe, and the Sequoia update applies to macOS Sequoia.

Advisory Rates CVE-2026-86950 as High Risk 

A separate advisory, also dated September 28, 2026, classifies the problem as a remote code execution vulnerability in Apple products. It warns that a remote attacker could exploit the flaw to trigger remote code execution on a targeted system.  The advisory rates the risk level as High for two reasons. The flaw is being exploited in an extremely sophisticated attack on specific targeted individuals running versions of iOS before iOS 27. A crafted file is also enough to achieve arbitrary code execution.  The advisory lists the following as affected: 

• Versions prior to iOS 26.7.1 and iPadOS 26.7.1 
• Versions prior to macOS Tahoe 26.7.1 
• Versions prior to macOS Sequoia 15.8.1 

It recommends that users visit the vendor's website for details before installing and then apply the vendor's fixes. The related Apple support pages are: 

• https://support.apple.com/en-hk/149226 
• https://support.apple.com/en-hk/149228 
• https://support.apple.com/en-hk/149229 

Apple's Disclosure Approach 

Apple says that, to protect customers, it does not disclose, discuss, or confirm security issues until it has investigated them and patches or releases are available. The company references vulnerabilities by CVE-ID when possible, as it did with CVE-2026-86950. Recent releases are listed on its security releases page, and more information is on its Product Security page.  Apple's notes also state that information about products not made by Apple, or about independent websites it does not control, is provided without recommendation or endorsement. Apple directs users to contact those vendors for further details.  Since attackers have reportedly already used the flaw, owners of supported iPhones and iPads should install iOS 26.7.1 or iPadOS 26.7.1. Mac users should update to macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1, depending on which version they run. 

A Medyc cyberattack has exposed personal data belonging to patients in Poland after attackers exploited an SQL injection vulnerability in software developed by Qbusoft, the company behind the Medyc medical records and practice management platform. The attack affected personal information including names, PESEL numbers, addresses, telephone numbers and email addresses. According to a notification issued by one healthcare provider using Medyc, the vulnerability was exploited between August 22 and 23, 2026. The attacker transferred an encrypted database archive outside Qbusoft’s environment. The incident was detected during the night of September 8 to 9.

How the Medyc Cyberattack Happened

An SQL injection vulnerability can allow an attacker to manipulate an application’s database queries and access information stored in the underlying database. According to the affected healthcare provider, forensic analysis found that an unauthorised person exploited a vulnerability in the Medyc application interface. The data export commands were reportedly not time-limited, meaning patient data covering the period from July 1, 2024, through August 23, 2026, could have been accessed. The confirmed data extracted included patients’ names, surnames, PESEL numbers, residential or temporary addresses, telephone numbers and email addresses. The healthcare provider also said first names, surnames and PESEL fields were encrypted in the database. However, because of the way the encryption was implemented, Qbusoft reportedly advised that the information should be treated as potentially accessible in plain text.

Medical Records Remain Under Investigation

The incident has also raised concerns about access to sensitive medical data. The affected healthcare provider said analysis detected scripts targeting tables containing medical information and considered it highly likely that attackers obtained some medical records, including hospital treatment information and discharge documents. However, Qbusoft later provided a different update. In a September 28 notice, Medyc said unauthorised access and theft of personal data had occurred, but stated that the theft of medical records had not been confirmed. The distinction is significant because the confirmed information includes identification and contact data, while the potential exposure of health records remains part of the ongoing investigation.

Qbusoft Takes Security Measures

Following detection of the attack, Qbusoft said it fixed the exploited vulnerability and cut off the attacker’s access. The company also implemented additional technical measures, restricted database permissions and rotated passwords and technical secrets. Its infrastructure was placed under continuous monitoring. Medyc said it has continued to face repeated attack attempts since the incident was detected. As a result, some services may experience slower performance or temporary restrictions. The company has warned users to be cautious about calls, emails, text messages and websites referring to Medyc or the data breach. Users have been advised not to provide passwords, authorisation codes or additional personal information in response to suspicious communications.

Polish Authorities Investigate the Incident

The incident has been reported to Polish authorities, including the Personal Data Protection Office (UODO) and police. Medyc said it also informed CSIRT NASK, the e-Health Center and the Social Insurance Institution. Digital Affairs Minister Krzysztof Gawkowski said the Central Bureau for Combating Cybercrime was investigating the incident as part of a broader inquiry. He also said Qbusoft had not initially reported the incident to CERT Polska or CSIRT CeZ. [caption id="attachment_114474" align="aligncenter" width="600"] Image Soure: X[/caption] UODO has said the Medyc incident is being examined and announced plans to inspect Qbusoft. The regulator has also expanded planned inspections of healthcare organisations following several incidents involving sensitive health information. For affected individuals, the healthcare provider has advised caution around unexpected communications that refer to their health history or the breach. It has also recommended taking steps to protect their PESEL numbers and reporting suspected fraud to police.

France's General Directorate for Armament (DGA) has selected Airbus, through its subsidiary Airbus Cybersecurity SAS, for the 25-year PARACOM contract. Under the deal, the company will supply cybersecurity gateways for the networks of the French Ministry of the Armed Forces and Veterans' Affairs.   The award followed a competitive tender and covers the design, development, production and long-term operational maintenance of the gateways the French armed forces will use to exchange data securely. 

What the PARACOM Contract Means for the French Armed Forces 

The gateways will be installed at French armed forces sites and in directorates and departments across the ministry. They are meant to allow secure, filtered data exchanges between networks and information systems that operate at different levels of classification or sensitivity.  The equipment will be approved and certified for several types of data exchange between "secret" and "unclassified" levels. The goal is controlled connectivity at a time when military operations depend more and more on digital systems. 

Airbus Cybersecurity SAS Draws on Experience Dating Back to 2013 

François Lombard, Director of Connected Intelligence at Airbus Defence and Space, described the system's role in the ministry's wider security framework.  "This gateway strengthens the digital shield the French Armed Forces rely on to execute their missions," Lombard said. "Since 2013, we have supplied French land forces with gateway solutions. Our high level of expertise within our cybersecurity teams in the field of multi-level data-sharing solutions reinforces our position as a leading player in cybersecurity in France." 

Deployment Options Under the PARACOM Contract 

The gateways are built for a range of deployment needs. They can be installed at ministry facilities or taken into operational theatres. Several versions will be offered, including configurations that fit into data centre racks and self-contained units for command posts.  The system is also designed for constrained tactical environments. These include surface vessels, submarines, aircraft, helicopters and drones, as well as armoured and other land vehicles.  As military operations rely more heavily on interconnected digital networks, the ability to control and filter data flows has become more important. The PARACOM gateways are intended to manage communications between systems with different security classifications while still meeting operational requirements. 

A Long-Term Role Supporting the French Armed Forces 

Under the contract, Airbus Cybersecurity SAS will run the gateway programme across the full product lifecycle, from design and development through production and long-term maintenance. The 25-year term provides for operational support over an extended period, so the cybersecurity infrastructure can be maintained for as long as it is deployed across the French Ministry of the Armed Forces and Veterans' Affairs.  Airbus Defence and Space supplies defence, aerospace and security technologies and services to customers around the world. Airbus Cybersecurity develops cybersecurity products and services for government, defence and commercial clients, including solutions that protect networks, information systems and critical infrastructure.  The PARACOM programme builds on Airbus Cybersecurity's background in multi-level data-sharing systems and on its work with the French armed forces since 2013. 

AI service security is becoming an important concern for organisations as attackers find ways to access AI services through stolen credentials, compromised accounts and vulnerable applications. The Australian Signals Directorate (ASD) has warned that malicious cyber actors are obtaining unauthorised access to organisational AI services, potentially allowing them to generate harmful material, consume available credits and disrupt legitimate work. The warning highlights how AI API keys, stolen authentication tokens, compromised user sessions and third-party access arrangements can expose AI services to misuse. Organisations must secure their own accounts, devices, applications and credentials rather than relying solely on the security measures provided by AI developers.

How AI Service Security Can Be Compromised

One route to unauthorised AI access involves exposed API keys. These credentials may be stored in source-code repositories, application configuration files or browser extensions, where attackers can obtain them. Vulnerable agent dashboards and other internet-facing applications can also expose credentials used to connect to model providers. An attacker who obtains a valid key may be able to send requests directly to an AI service without using the organisation's legitimate application. Phishing, information-stealing malware and compromised third-party services present additional risks. A stolen browser session can allow an attacker to act as an authenticated user without completing a new multi-factor authentication challenge. Suppliers and contractors can also introduce exposure when they hold organisational credentials or delegated access. The impact depends on the compromised identity's permissions. Access to use a model does not necessarily grant permission to administer an account, create credentials or retrieve stored files. Organisations need to assess these privileges separately instead of assuming every credential has appropriately restricted access.

AI Agents Could Extend the Impact

The risks can extend beyond direct access to an AI model. Compromised accounts, sessions or AI agents may be able to interact with connected enterprise systems, invoke tools, access organisational data or communicate with other agents on a user's behalf. Consequently, the practical impact of a compromised identity may reach connected systems and sensitive information, depending on the access available to that identity or agent. Organisations should separate restricted-model access and sensitive data from routine AI use and experimental environments. Applications exposed externally should undergo security reviews, while suppliers should receive limited, auditable access.

Recent Reports Highlight AI Access Risks

Reports published in 2026 have described incidents involving exposed credentials, excessive model consumption and alleged unauthorised access to restricted AI systems. On September 9, The Hacker News reported research from Okta that identified still-valid AI API keys and unexpired authentication tokens in data stolen from infected computers. On September 1, The Register reported an incident in which an attacker spent three weeks consuming public-model credits worth approximately US$600,000. METR's disclosure described an authentication flaw in an internet-facing agent dashboard that enabled the theft of a model-provider API key. Separately, Reuters, citing Bloomberg, reported on April 21 that unauthorised users had accessed Claude Mythos Preview, which was restricted to selected organisations. The reporting concerned alleged access through a vendor environment, not confirmation of a compromise of the model developer's core infrastructure.

How Organisations Can Strengthen AI Service Security

ASD recommends several measures to reduce the risk of unauthorised access. Organisations should maintain an inventory of AI accounts, service identities and credentials, assign an accountable owner to each, and apply least privilege by granting only the access required for each role. Unnecessary permissions should be removed promptly. Account protection should include phishing-resistant MFA, managed and patched devices, monitoring for suspicious session activity, and approved secrets-management services for API keys. Credentials should not be exposed in code, documents, logs or prompts. Security teams should also monitor model access, credential creation, permission changes and unusual consumption patterns. Audit logs must be protected against tampering, while tested spending, rate and consumption limits should enforce restrictions rather than merely generate alerts. If compromise is suspected, organisations should revoke affected API keys, sessions and tokens, isolate compromised devices, preserve logs and investigate unauthorised changes. Access should be restored only after the underlying cause has been addressed. These measures can help organisations reduce exposure while maintaining controlled access to AI services.

Spain's state-owned railway operator Renfe confirmed on September 25 that a cyberattack had compromised some of its customers' data. Spanish media reported that the criminals behind the Renfe cyberattack used artificial intelligence (AI), which would make it the first attack of its kind in the country. Train services across Spain have continued to run normally while the investigation goes on.  According to Renfe, the attackers mainly obtained customer names and email addresses. "The attackers were able to access limited user information, consisting mainly of names and email addresses," the company said. It added that it had found "no conclusive evidence" that the stolen information had been made public.  The operator, which carried more than 531 million passengers last year, also said, "There is no evidence of access to bank or financial details, payment methods, IDs or other particularly sensitive information." 

Breach Traced to Adif's Systems 

Investigators have linked the cyberattack on Renfe to Adif, the state body that manages Spain's railway infrastructure. According to The Star, Renfe said in a statement that the "cybersecurity incident" began on Adif servers that were "previously compromised and interconnected with the company's systems."  Adif spotted unusual activity on its network late on Thursday and put cybersecurity measures in place to contain it. Neither organization has found evidence that the systems running railway operations were affected, so there has been no disruption to rail services linked to the attack.  The most visible effect was a temporary outage of the Adif website, which was down for part of Friday afternoon. Renfe's website stayed online. 

Weeks of Attempted Intrusions Preceded Renfe Cyberattack 

Renfe said the breach followed "several weeks" of attempted attacks on its systems. Its monitoring and security tools had "detected and successfully blocked" those earlier attempts.  Once it detected the breach, Renfe activated its incident-response procedures, isolated the areas that might have been affected and added further protective measures. Independent cybersecurity specialists are helping with the investigation and with efforts to limit any further damage.  Adif has filed a complaint with the relevant authorities and shared what it found with Spain's National Cryptologic Center (CCN). It has also notified businesses and suppliers that may have been affected so they can take precautions. 

Reports of AI Involvement and a Foreign Link 

El Mundo cited "sources close to the investigation" who said a criminal organization used "a system similar" to Anthropic's AI to attack Adif's website, which was unavailable on September 25. The newspaper described it as the first AI-driven cyberattack on the website of a Spanish public company and said the incident lasted "several days."  La Razón reported that sources familiar with the case believe "the modus operandi points to a foreign group." 

Wider Concerns Over AI and Hybrid Threats 

The cyberattack on Renfe comes as concern grows worldwide about what advanced AI tools can do, following a series of hacking incidents involving models from OpenAI, the developer of ChatGPT, and its rival Anthropic.  Warnings have also increased about possible hybrid attacks, including cyber incidents, targeting Western allies of Ukraine as Russia's invasion enters its fifth year.  Renfe and Adif are still investigating where the attack came from and how far it reached, including how much customer information was accessed without authorization. 

Citrix has released fixes for two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88771 and CVE-2026-88772. On September 27, the company confirmed that attackers had already exploited both in the wild. The same update addresses six other vulnerabilities. One of the two exploited bugs affects every deployment running a vulnerable version, including appliances left in the default configuration.  The disclosure came a day after security firm watchTowr reported that two unpatched NetScaler RCE flaws were being exploited, and after some administrators said they had taken appliances offline. Citrix did not say whether its two flaws are the ones watchTowr described, though the details match.  NetScaler ADC and NetScaler Gateway sit at the edge of enterprise networks, handling VPN and remote access, load balancing, and user authentication. 

How CVE-2026-88771 and CVE-2026-88772 Work 

CVE-2026-88771, rated 9.5 on the CVSS v4 scale, is an improper input validation flaw that lets an unauthenticated attacker run arbitrary commands. It affects all NetScaler ADC and NetScaler Gateway deployments and requires no additional feature to be enabled.  CVE-2026-88772, also rated 9.5, is a memory overflow that can lead to remote code execution or denial-of-service (DoS) on appliances with DTLS enabled. DTLS is on by default for VPN virtual servers, so any NetScaler Gateway is exposed unless DTLS has been explicitly turned off.  "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed," Citrix said. The company did not disclose how widespread the attacks are, who is responsible, or when they began.  The bulletin is Citrix's first public notice of the flaws, which means both were exploited before a fix was available. It lists no workarounds and no indicators of compromise. 

Fixed NetScaler Versions 

Appliances running 14.1-73.32 and 13.1-63.21 fall within the affected range and need the new update. Those builds were released in August to fix the exploited authentication bypass CVE-2026-19490.  Citrix urged affected customers to install these versions as soon as possible: 

• NetScaler ADC and NetScaler Gateway 14.1-73.37 and later releases 
• NetScaler ADC and NetScaler Gateway 13.1-64.23 and later releases of 13.1 
• NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS 
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.279 and later releases of 13.1-FIPS and 13.1-NDcPP 

The bulletin covers customer-managed appliances, including NetScaler instances in Secure Private Access Hybrid deployments. Citrix handles upgrades for its own cloud services and for Citrix-managed Adaptive Authentication. The 13.1 fix arrives even though that branch reached End of Maintenance on September 15 under Citrix's release schedule. 

Six Other Flaws 

The bulletin does not list the remaining six vulnerabilities as exploited: 

• CVE-2026-88773 (9.3): HTTP request smuggling on appliances with load balancing, content switching, VPN, or authentication virtual servers of type HTTP or SSL. 
• CVE-2026-88774 (7.0): A policy bypass on appliances where any policy uses an HTTP URL-based expression. 
• CVE-2026-88775 (8.8): A memory overflow that can cause unpredictable behavior or DoS on appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an authentication, authorization, and auditing (AAA) virtual server. 
• CVE-2026-88776 (8.8): A memory overflow that can cause unpredictable behavior or DoS on load balancing virtual servers of type Oracle. 
• CVE-2026-88777 (8.8): A memory overflow that can cause unpredictable behavior or DoS on load balancing, content switching, or CGNAT-LSN/NAT64 setups with a non-HTTP Layer 7 protocol feature, such as FTP, RTSP, or DNS64, enabled. 
• CVE-2026-88778 (8.8): A TCP Initial Sequence Number (ISN) prediction flaw on appliances with TCP-based virtual servers, such as HTTP, SSL, or TCP, where Enhanced ISN Generation is disabled. Citrix advises applying a TCP configuration change on affected appliances to turn it on. 

The Kiteworks shutdown advisory has been lifted after the company completed a precautionary shutdown in response to credible threat intelligence from federal intelligence authorities. Kiteworks said the threat window passed without incident, continuous monitoring found no abnormal activity, and there is no indication that its systems or customer environments were compromised. The advisory was issued on September 25 and recommended that customers temporarily take their Kiteworks systems offline. During the shutdown, Kiteworks said its security and engineering teams discovered a previously unknown critical vulnerability and deployed a fix.

Kiteworks Shutdown Advisory Followed Threat Intelligence

Kiteworks issued the Kiteworks shutdown advisory after receiving intelligence about a potential imminent attack. Customers managing their own Kiteworks environments were asked to shut down their systems during the recommended period. Kiteworks also shut down environments it hosts on behalf of customers. The company worked with federal intelligence authorities throughout the shutdown and monitored its systems during the potential threat window. According to its latest update, the period passed without incident and no abnormal activity was detected. Kiteworks said the shutdown was a precautionary measure and was not triggered by evidence of a confirmed compromise.

Critical Vulnerability Discovered During Shutdown

During the shutdown, Kiteworks identified a previously unknown critical vulnerability in a capability enabled for less than 1% of its customer base. The company said its engineering and security teams developed and deployed a fix during the shutdown window. Kiteworks also applied an additional protective layer across all environments. The company said there is no indication that the vulnerability was exploited. Kiteworks added that all other products were unaffected by the vulnerability discovered during the response.

No Evidence of Kiteworks Systems Compromise

Kiteworks said it has no indication that its systems or customer environments were compromised. The company also said continuous monitoring throughout the threat window did not identify abnormal activity. It has not disclosed the identity of the potential threat actor or provided further details about the intelligence received from federal authorities. The latest update maintains that the shutdown was a preventative response rather than a reaction to a confirmed breach. Kiteworks continues to recommend that customers use the latest available version of its software.

Kiteworks Systems Restored

With the threat window now passed, Kiteworks has restored its hosted customer environments and said customers can bring their own systems back online if they have not already done so. The company said it will continue monitoring its environments following the incident and maintain the additional security measures implemented during the response. The Kiteworks shutdown advisory ultimately ended without a confirmed compromise. However, the precautionary action resulted in the discovery and remediation of a previously unknown critical vulnerability affecting a limited customer capability. Kiteworks said it will continue working with federal intelligence authorities and monitoring its systems as customers return to normal operations.

A Dyfed-Powys Police cyberattack may have resulted in staff information being accessed or compromised, according to the police force that serves Dyfed-Powys in Wales. The cyber incident, identified on September 14, 2026, disrupted some non-emergency systems, but the force said there is currently no evidence that members of the public had their personal data accessed. Dyfed-Powys Police said an investigation into the incident is ongoing, with support from cybersecurity specialists. The force has also introduced precautionary measures while specialist teams investigate the incident and work to restore affected services safely.

Dyfed-Powys Police Cyberattack Disrupted Non-Emergency Systems

The Dyfed-Powys Police cyberattack was identified on Monday, September 14, according to a statement issued by the force. The incident affected some non-emergency systems, resulting in a period when online and email contact services were unavailable. The police force said these services have since been restored. We can confirm that the force has been subject to a cyber incident which was identified on Monday September 14, 2026. The incident caused disruption to some non-emergency systems," reads the offical release. Despite the disruption, emergency response operations were not affected. Dyfed-Powys Police confirmed that it remained fully operational and that both 999 and 101 telephone services continued to operate. The force said it has been closely monitoring its systems while specialist teams investigate the circumstances surrounding the incident.

Staff Information Under Investigation

While there is currently no evidence that members of the public had their personal information accessed or compromised, the investigation is examining whether information relating to police staff may have been exposed. Dyfed-Powys Police said it is taking steps to protect staff information and will provide appropriate advice to employees if required. The force has not provided further details about what staff information may have been accessed or compromised. The investigation remains ongoing, meaning the full impact of the incident has not yet been established.

ICO Notified Over Cyber Incident

The Information Commissioner’s Office (ICO) has been notified about the incident as the investigation continues. Dyfed-Powys Police said the investigation is being managed by Tarian through its regional cyber-crime unit, with cybersecurity specialists supporting the response. The force has also implemented precautionary measures across its systems as part of its response. Specialist teams are working to investigate the incident and restore services safely while the police continue to monitor its systems. At this stage, the force has not disclosed details about how the attackers may have gained access to its systems or identified those responsible for the cyber incident.

Emergency Services Remain Operational

Dyfed-Powys Police said the incident did not affect its ability to respond to emergencies. The 999 and 101 telephone services remained available throughout the disruption. Online and email contact were unavailable for a period following the incident but have now been restored. The force said it understands the concern the incident may cause and is continuing to take steps to protect its information and maintain the security of its systems. The investigation is ongoing, and further details could emerge as specialists examine the incident and assess whether any staff information was accessed or compromised. Dyfed-Powys Police said it will provide further updates when more information becomes available. Update: This article will be updated as Dyfed-Powys Police provides further information about the investigation, affected systems or any potential compromise of staff information.

This weekly roundup covers a brazen breach claim against the FBI's recruitment portal, a multinational advisory exposing North Korea's fake-recruiter malware operation, a sweeping EU proposal to reshape children's access to social media, a conversation on application security in the age of AI agents, a short-lived Discord ban in the Philippines, and a multimillion-dollar hot-wallet heist at a crypto casino.  From federal law enforcement to individual job seekers, this week's developments show that no target is too prominent or too small. Cybercriminals are openly taunting the agencies that pursue them, state-backed actors are turning the hiring process into an attack vector, and governments are testing how far they can push platforms on child safety, sometimes reversing course within hours. 

The Cyber Express Weekly Roundup 

Shiny Hunters Claims FBI Breach, Says FBIjobs Agent Data Exposed 

The FBI is investigating an apparent breach after the cybercriminal group Shiny Hunters claimed to have stolen personal data belonging to thousands of federal agents, with the probe centering on the bureau's FBIjobs recruitment website. Read more... 

WaterPlum Hackers Steal $10.7M in Crypto From IT Workers 

A North Korean cyber actor group known as WaterPlum, also referred to as "Contagious Interview," has infected at least 30,000 devices across more than 100 countries while stealing cryptocurrency from IT professionals worldwide. Read more... 

EU KIDS Act Sets New Social Media Rules for Children 

The European Commission adopted the proposal on September 18, setting out rules that would prevent children under 13 from accessing social media and establish 15 as the minimum age for minors to open accounts independently. Users aged 13 to under 15 could instead access parent-managed mini accounts with limits on social contacts and up to 60 minutes of screen time per day, while platforms would bear the responsibility of proving their services are safe for children. Read more… 

Harness' Rahul Sood: AppSec in the Agentic Era Is About More Than Code. It's About Authority 

In this conversation, The Cyber Express spoke with Rahul Sood, the General Manager for Application Security at Harness, who leads the company's AppSec portfolio and focuses on building security for the AI era, integrated directly into modern DevOps workflows. The conversation centers on a shift in how security teams must think about AI agents: the risk no longer lies only in the code being shipped, but in what authority autonomous agents are granted once they operate inside production systems. Read more… 

Ban on Discord Lifted After Platform Commits to Work With DICT and CICC 

The Philippine government has lifted its ban on Discord after the platform's representatives met with officials from the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC), with the restriction removed on Thursday, Sept. 24. Read more... 

Duelbits Hit by $7 Million Hack as Crypto Stolen Across Four Blockchains 

Crypto casino Duelbits has shut down its platform after attackers took roughly $7 million from several of its wallets, with the stolen assets moved across four blockchains and mostly converted into Ether. The company says funds held in user accounts have not been affected, but it has not explained how the attackers got in or when the site will return. Read more... 

Weekly Cybersecurity Takeaway 

This week's developments span the full spectrum of cyber risk, from a criminal group openly retaliating against the FBI over a public advisory, to a state-backed operation weaponizing job interviews against developers, to a crypto platform losing millions from the very hot wallets that keep it running.  Meanwhile, the policy response is moving on multiple fronts: the EU is flipping the burden of proof onto platforms to demonstrate child safety by design, and the Philippines has shown how quickly a government can block, and then restore, a major platform in exchange for enforcement commitments. At the same time, security leaders are warning that AI agents are introducing an entirely new question of who, or what, holds authority inside enterprise systems.  Taken together, the stories point to an increasingly confrontational threat landscape, where attackers are bolder, trust-based processes like hiring are being exploited at scale, and institutions are experimenting with more aggressive levers to hold platforms and adversaries accountable. 

Crypto casino Duelbits has shut down its platform after attackers took roughly $7 million from several of its wallets. In the Duelbits crypto hack, the stolen assets were moved across four blockchains, and most of them were then converted into Ether.  The company says it is investigating the breach and that funds held in user accounts have not been affected. However, it has not explained how the attackers got into its systems or said when the site will return. 

How the Duelbits Cyberattack Unfolded 

Blockchain security research firm Scam Sniffer first flagged a series of unusual transfers out of Duelbits wallets on BNB Chain, Ethereum and Tron. Later, it spotted a further loss of 8.1 BTC from the casino's Bitcoin wallet.  All the affected wallets were hot wallets. These are online accounts where a platform keeps enough crypto to handle customer deposits and withdrawals. They make fast transactions possible, but they also leave funds more exposed if someone obtains the access credentials.  The attacker ended up with 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI, and 12.4 billion SHIB. 

Co-Founder Confirms Duelbits Crypto Hack 

Duelbits co-founder Joe acknowledged the incident in a public post: 

Confirming a ~$7M hack. Still investigating exactly what happened and how.  Until we have clarity, Duelbits stays offline. User funds are safe.  Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0.  I'll keep posting updates as I have them.  Duelbits will be back up asap.  Updates to follow" 

Joe said the platform would stay offline until the investigation is finished and the hot wallets have been refilled. No one has independently verified his claim that user funds are safe. 

Compromised Private Key Suspected 

The wallets were emptied quickly and on a large scale, which leads Scam Sniffer to suspect that a private key was compromised. A private key is the master credential for a crypto wallet. Anyone who holds it can move funds out of that wallet without exploiting any weakness in the blockchain itself.  Duelbits has not confirmed this explanation. 

Stolen Funds From Duelbits Cyberattack Swapped Into Ether 

Most of the stolen tokens were exchanged for Ether and gathered in a single address. After the transfers, that address held around 2,234 ETH, worth roughly $6 million. When the funds were traced, they had not moved any further.  Converting the stolen assets into Ether could make recovery much harder. The companies behind USDT and USDC can freeze those tokens. Ether has no central issuer that can step in and freeze funds taken in a hack. 

Unanswered Questions After the Duelbits Crypto Hack 

Several important questions remain open. It is still unclear how the wallet credentials were breached, whether customer deposits were held in the affected wallets, and when withdrawals will resume. Duelbits has not addressed these points so far.  Users are also advised to avoid any refund or recovery links that circulate during the outage. Links shared at times like this are often attempts to steal wallet details and recovery phrases.  For now, the Duelbits cyberattack amounts to a loss of about $7 million from wallets on four networks. Most of the stolen assets have been swapped into Ether and sit at one publicly visible address. 

A Burnaby School District cyberattack is being investigated after an incident disrupted internal network services and phone lines across the district. The Burnaby School District said the cyber incident came to its attention on Monday, September 21, and that staff are working to contain the incident and restore affected services. The district has not disclosed whether any personal or sensitive information was accessed or stolen. However, the disruption has raised concerns about potential data leaks as the investigation continues.

Burnaby School District Cyberattack Disrupts Operations

According to the district, the incident has affected some systems and operations, including internal network services and phone lines. Staff across Burnaby Schools are working to restore normal operations while limiting the impact on students. The district said the disruption has not affected student learning and that staff are working to ensure schools can continue supporting students. Families, staff, and district partners were contacted earlier in the week about the incident. The district said it will provide additional updates as efforts to contain the incident and restore services continue. The investigation remains ongoing, and the district has not provided further details about the nature of the incident, the suspected attackers, or whether information was compromised. The latest incident follows other school district cyberattacks and cybersecurity incidents that have disrupted education services and raised concerns about the security of student and staff information.

Education Sector Faces Repeated Cybersecurity Incidents

In September, The Cyber Express reported on the Springfield cyberattack, which disrupted school operations shortly after the start of the new academic year. The incident forced schools to close for part of the week and affected services relied on by families, including childcare and school meal programs. The district arranged grab-and-go meals at six locations while the YMCA of Greater Springfield provided full-day care for families enrolled in its programs. Students were expected to return to classrooms the following Monday. The Springfield incident highlighted how a cyberattack against school systems can extend beyond IT operations and affect essential services used by students and families. Earlier in 2026, a separate QLearn cybersecurity incident involving education technology provider Instructure affected educational institutions globally. Queensland Education Minister John-Paul Langbroek confirmed that the Queensland Department of Education had been briefed about the international breach. Early assessments indicated that the incident could affect more than 200 million people and more than 9,000 institutions worldwide.

Education Authority Cyberattack Targeted School Systems

In April 2026, an Education Authority cyberattack investigation found that attackers had gained targeted access to personal information linked to a small number of schools. Authorities identified the incident on April 10 after being alerted to suspicious activity affecting school systems. A forensic investigation later determined that attackers had accessed specific personal information associated with certain schools. The findings added to concerns surrounding cybersecurity risks in the education sector, where school networks can contain sensitive information belonging to students and staff. For the Burnaby School District, the current investigation is focused on containing the incident and restoring affected services. The district has not confirmed any data theft or provided details about possible unauthorized access. As the investigation progresses, further updates are expected from the district on the scope of the incident, affected systems and any potential impact on personal information.

The government has lifted its ban on Discord in the Philippines after the platform's representatives met with officials from the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC). The CICC is an attached agency of the DICT. The restriction was removed on Thursday, Sept. 24.  DICT Secretary Henry Aguda and CICC Executive Director Undersecretary Renato "Aboy" Paraiso confirmed the decision. They said it followed a pledge from Discord officers to cooperate with both agencies. 

Discord's Commitments to the DICT and CICC 

The two sides held an online meeting on Thursday. According to Paraiso, Discord agreed to put security measures in place, establish a presence in the country, and support the government's campaign against online groomers.  "The meeting was successful," Paraiso said during a live press briefing. "We secured a commitment from Discord to collaborate with us in achieving our goal of further strengthening the online safety measures we are implementing for our country."  Discord also told the DICT and CICC that it would provide a "green lane," which would let Philippine authorities track and monitor suspicious activity on the platform.  "Like Reddit, Discord has promised to provide us with a 'green lane'—such as monitoring and identifying threat actors on their platform," Paraiso said. 

Why the CICC Imposed the Ban on Discord 

The CICC had earlier ordered Discord and Reddit to coordinate with the agency and set up a local office within 24 hours.  In a clarificatory statement on Wednesday, the center said it did not grant Discord an extension because the company had only responded through a letter. Paraiso said the ban took effect immediately, at around 5 p.m.  Reddit, meanwhile, was allowed to keep operating after it held an online meeting with CICC officials. That discussion covered plans for a local Reddit office and other safety measures for teenagers who use the platform. 

DICT Acknowledges Disruption to Users 

An anti-scam advocacy organization said many people were frustrated by the temporary restriction because they rely on the platform for work. Aguda maintained that the immediate ban was meant to protect young people.  "Legitimate users have been somewhat inconvenienced, and we understand that. We just want to let you know that when we spoke with Reddit and Discord, they acknowledged the issue," the secretary said.  Aguda added that both Discord and Reddit have named point persons who will coordinate with the government at all times. However, the timeline for setting up the companies' local offices has not been finalized. 

Extremist Group Concerns Behind the CICC's Action 

The CICC had previously flagged the presence of a Nihilistic Violent Extremism (NVE) group allegedly recruiting and grooming teenagers on these online platforms.  The group is suspected of having links to the Sept. 18 school shooting at Banga National High School in South Cotabato, which killed three students. That incident came a month after a similar shooting at Ateneo de Zamboanga University left two students dead.  "Instances involving NVE are on the rise. The numbers are truly going up," Aguda said.  "We are all aware of this. We have been tasked with providing a solution," he told reporters.  "Sometimes, these solutions may not be popular, but we must do what is necessary to make progress in protecting the youth," the cabinet official said. 

The Apache Software Foundation has released Tomcat 11.0.26, an Apache Tomcat Update that resolves 12 security vulnerabilities. They include the WebSocket message-smuggling bug CVE-2026-87022 and the HTTP/2 header mix-up tracked as CVE-2026-86350.   The fixes, disclosed on September 23, 2026, cover WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation. Four flaws are rated Important, three Moderate, and five Low. 

Apache Tomcat Update-Who Needs It

Most Tomcat 11 deployments are exposed. Many of the issues affect versions 11.0.0-M1 through 11.0.25, while narrower flaws start at 11.0.0-M5, 11.0.0-M14, 11.0.19 or 11.0.22. Apache does not issue binary patches for individual vulnerabilities and instead directs users to install a release containing the fixes. That makes 11.0.26 the practical minimum for remediation. 

How CVE-2026-87022 Enables WebSocket Smuggling 

CVE-2026-87022 comes from improper handling of a length parameter when per-message-deflate compression is enabled. An attacker can exploit the discrepancy to smuggle WebSocket messages. Every release from 11.0.0-M1 through 11.0.25 is affected, and the correction is in commit 4fef25fe. 

CVE-2026-86350 and Other HTTP/2 Defects 

CVE-2026-86350 is the higher-priority HTTP/2 issue. It is a regression introduced during the fix for CVE-2026-41293. Inconsistent request interpretation can cause headers to be attached to the wrong request in versions 11.0.22 through 11.0.25.  Two related HTTP/2 bugs were also fixed. CVE-2026-78437 allows a malformed request to make another user's request fail. CVE-2026-77762 is a race condition that can inject trailer fields into a recycled pooled request. 

Denial-of-Service and Authorization Risks 

Several fixes address availability. CVE-2026-78383 can pin an AJP processing thread when a request body is absent. CVE-2026-77791 permits denial of service through a busy wait while a WebSocket close message is being sent. CVE-2026-79677 is a concurrency bug that can cause asynchronous WebSocket write timeouts to be lost, leaving operations free to consume resources indefinitely.  The release also closes CVE-2026-76183, an Important-rated WebSocket authorization bypass caused by request paths being parsed as endpoint templates. CVE-2026-75973 could reuse the first application's realm across multiple applications that rely on Jakarta Authentication's default SimpleAuthConfigProvider.   CVE-2026-77756 could disrupt another user's request because Tomcat honored Transfer-Encoding in HTTP/1.0 traffic behind a reverse proxy. 

Certificate Validation Repairs 

Two fixes concern certificate checking. CVE-2026-86248 completes an earlier, incomplete OCSP fix. That gap could let CLIENT_CERT authentication succeed with soft-fail disabled under the FFM implementation.   CVE-2026-73581 corrects OpenSSL and OpenSSL-FFM behavior that ignored certificate revocation lists when certificates were stored in a keystore. 

Rolling Out the Apache Tomcat Update Safely 

Administrators are advised to take the following steps: 

• Inventory every Tomcat 11 instance. 
• Prioritize externally reachable WebSocket, HTTP/2 and AJP connectors. 
• Upgrade to 11.0.26 after testing application compatibility. 
• Verify downloaded artifacts using Apache's OpenPGP signatures or SHA-512 checksums. 
• Review reverse-proxy and authentication configurations. 
• Monitor for unusual connection exhaustion, cross-request header anomalies and authorization failures. 

Several of the bugs involve race conditions and shared connection state, so exploitation may succeed only intermittently. This makes controlled regression testing and sustained telemetry especially important after an emergency rollout across clusters.   After deployment, servers should be restarted, and the running version confirmed. Configuration-only workarounds do not provide the same coverage as this multi-component release. Upgrading is the only complete protection against CVE-2026-87022, CVE-2026-86350, and the other ten vulnerabilities. 

A Latvia cyberattack investigation has led to the arrest of a man born in 2003 over alleged cyberattacks against at least two Latvian companies. The State Police said the suspect accessed company databases, extracted personal data and attempted to demand payment in exchange for not disclosing the information. One of the attacks took place in February, while a second incident was detected in early September at TSC, a household appliance and smart device repair company that is part of the LMT group. Investigators linked the two cases based on similarities in the methods used.

Latvia Cyberattack Investigation Links Two Cases

According to the State Police, the attacker used an automated tool to scan websites for vulnerabilities. After identifying a vulnerability, the suspect allegedly gained access to a website database and exported information, including restricted-access data. The attacker also allegedly used virtual camouflage tools to hide the actual location from which the activity was carried out. After completing the attack, the person contacted the affected company through an anonymous email account and demanded payment to prevent the stolen information from being disclosed. The investigation into the earlier attack helped police identify similarities with the TSC cyberattack detected in September. The State Police worked with LMT Security Service and CERT.LV to analyse the incident and establish a possible connection between the two cases. On September 15, police detained the suspect and carried out additional procedural actions, including a search at an address in Riga. Investigators also obtained evidence and information concerning other alleged cyberattacks against companies in Latvia and abroad. Those investigations are continuing.

TSC Cyberattack Exposed Customer Repair Data

TSC disclosed the data breach earlier this month after unidentified attackers exploited a vulnerability on its website and accessed a database containing information related to customer repair orders. The company said the affected customers included people who registered or modified repair orders through TSC websites, as well as customers who delivered devices for repair and later carried out additional activities online, such as making payments or changing repair orders. The information potentially accessed varied depending on what customers had provided. In most cases, it included names or company names, telephone numbers, email addresses and repair receipt numbers. In certain cases, the exposed information could also include device IMEI numbers, device access codes, bank account numbers, delivery or repair addresses and access codes for repair facilities. TSC said the incident did not affect data or content stored on devices submitted for repair.

Hacker Arrested as Investigation Continues

The State Police said there is reason to believe its prompt response prevented the unauthorized personal data from being passed to third parties. Police also said the suspect did not appear to target specific companies. Instead, automated tools were allegedly used to scan different websites and resources for vulnerabilities. The hacker arrested in the investigation has been recognized as a suspect in both criminal proceedings. Police cited provisions of Latvia’s Criminal Law covering unauthorized access to automated data processing systems for financial purposes, extortion and unlawful actions involving such systems. TSC temporarily suspended its website after discovering the incident and launched an investigation with cybersecurity experts. Its equipment repair services continued through contact-based customer service. TSC also said its IT systems operate separately from those of other LMT group companies, with no indication that LMT’s telecommunications network was compromised. The criminal investigation remains ongoing. The State Police reminded that the suspect is presumed innocent until guilt is established under the procedures prescribed by law.

Australian Prime Minister Anthony Albanese has demanded answers from OpenAI chief executive Sam Altman after an AI agent broke into an Australian government website. The OpenAI hack took place in June, but the Australian government only learned of it recently, a delay the Prime Minister has openly criticized.  Speaking from New York on Thursday (AEST), Albanese said the OpenAI agent "infiltrated" the Medicare Statistics Reporting Service portal, which is administered by Services Australia. The agent had been researching public medical spending when it found a way around the site's privacy protections, gaining access to both public and non-public files. 

How the OpenAI Hack Unfolded 

"No personal information is believed to have been accessed at this stage, but investigations are ongoing," Albanese said. "Evidence currently available is there is no broader compromise to the Services Australia network. Nonetheless, this situation is obviously unacceptable."  He described the site as a public-facing portal holding non-sensitive Medicare information, including data and statistics such as spending. The Australian Signals Directorate will help carry out a forensic examination of the breach and check whether any other government sites were affected. 

Anthony Albanese Slams Slow Disclosure 

Albanese said he had spoken directly with Altman and conveyed his "extreme concern" over the incident.  "I also expressed my disappointment that it took the company way too long to inform the government what had occurred and the nature of the way that that notification occurred, as well, was unacceptable," he said.  Acting Prime Minister Richard Marles told ABC TV that ministers were briefed at the end of last week and over the weekend. He said the past few days had been spent confirming the effect on the portal and its data, which he called "relatively minor.  "It's important to assure people of that, no personal information has been accessed here," Marles said. "There's no impact on the system, but that said, what we have seen is unauthorized access into an Australian government website and that is completely unacceptable and we have made that clear to OpenAI."  Marles said the "bigger picture" was the need for guardrails and safety measures as AI technology advances quickly. He pointed to the call made by the Prime Minister and other world leaders in New York that week, as well as concerns raised by tech company CEOs at the UN overnight. 

Australian Government Pushes for Global AI Safeguards 

Before news of the OpenAI hack broke, Australia joined more than 20 countries in signing a joint statement calling for stronger AI safeguards and continued human control. The statement was released on Tuesday, Australian time, ahead of the United Nations General Assembly, where AI measures are on the agenda.  "AI must remain under human direction, oversight, and control. It must be developed and used in line with international law," the statement said. It also warned that leading scientists and executives believe the pace of development could outstrip the ability to manage emerging risks.  Other signatories included Canadian Prime Minister Mark Carney, German Chancellor Friedrich Merz, Spanish PM Pedro Sanchez, and European Commission president Ursula von der Leyen. The statement remains open to further endorsements, which Albanese said he hoped to see.  "Other nations are putting forward their national interests," he said. "In our case, Australians do want to know that artificial intelligence won't be in control of us. We need to shape how it rolls out, rather than have artificial intelligence shape the way that our society functions."  Albanese said Australia played a central role in drafting the statement and that he had spoken directly with Finnish President Alexander Stubb, who issued it on behalf of the participating nations. He added that the issue had been discussed among leaders "just as it's been discussed around lounge rooms", and that AI "will have a massive impact on the way that our lives and our work is conducted."  The statement called for AI risks to be addressed without widening the gap between countries in accessing the technology's benefits. It urged AI companies to develop transparent safety protocols, asked governments to set common standards, and encouraged the UN to explore creating an international institution to establish AI standards.