CISA added five already-patched but actively exploited CVEs to its KEV catalog with a three-day fix deadline, FortiBleed operators began locking admins out of compromised Fortinet devices, and a batch of critical Cisco NX-OS flaws could hand attackers control of Nexus switches.
🔴 CRITICAL (2)
CISA adds five exploited vulnerabilities to KEV, federal fix deadline October 11 Confirmed
CISA added five older but actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on 8 October and gave federal agencies until 11 October to remediate: CVE-2015-5477 in ISC BIND, CVE-2016-3081 in Apache Struts, CVE-2023-22894 in Strapi, CVE-2021-3199 in ONLYOFFICE Docs and CVE-2015-3306 in ProFTPD. The additions mean CISA has evidence each is being exploited in the wild, even though fixes have long been available. Administrators running any of these products should confirm they are on a current, fixed version.
Sources CISA
FortiBleed attackers lock victims out of compromised Fortinet devices Confirmed
The FortiBleed campaign is now also removing access, not just stealing credentials. SecurityWeek reports attackers are creating new accounts and deleting existing ones and their passwords on compromised FortiGate firewalls and VPN gateways, locking out legitimate administrators. The campaign has already been tied to the compromise of tens of thousands of internet-facing Fortinet devices. Admins should watch for unexpected accounts and password removals, and reset credentials from a trusted path.
Sources SecurityWeek
🟠 HIGH (6)
CISA and FBI warn on China-linked hacking as FBI seizes Flax Typhoon tooling Confirmed
A joint advisory from CISA and international partners (AA26-281A, 8 October) says Chinese government-linked actors enabled by the Integrity Technology Group combine automated scanning, large-scale botnets and hands-on exploitation to steal sensitive data from organisations worldwide, including US critical infrastructure. Separately, the FBI said it seized seven domains used by the China-linked Flax Typhoon group to run the MicroScan and FishHub hacking tools, and reported that China-linked hackers ran a portal giving third parties access to stolen email from government, healthcare and religious organisations. Patch internet-facing systems and hunt for the tooling’s indicators.
Sources CISA|BleepingComputer|The Hacker News
Cisco patches critical NX-OS flaws that allow Nexus switch takeover Confirmed
Cisco released advisories for critical vulnerabilities in NX-OS, the data centre network operating system for Nexus switches. An October 7 batch (CVE-2026-76465, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501 and CVE-2026-76471) could let unauthenticated attackers run arbitrary code with root privileges on affected Nexus 3000 and 9000 switches. SecurityWeek counts a dozen critical flaws across Cisco’s October advisories, covering unauthorised access, information leaks and remote code execution. Cisco says it has no evidence of exploitation, but operators should upgrade affected switches promptly.
Sources BleepingComputer|SecurityWeek
Oracle Health data breach tally climbs to nearly 20 million Under investigation
The number of people affected by the Oracle Health (formerly Cerner) data breach has grown to nearly 20 million, far higher than the counts in earlier filings and patient notices. The breach concerns health data held in the vendor’s systems. Affected individuals should watch for identity fraud and medical-data phishing, and organisations that used the platform should track notifications and revisit their own exposure.
Sources SecurityWeek
Ransomware attack disrupts Japan's IDCF Cloud, hitting government clients Under investigation
IDC Frontier, a major Japanese cloud and digital infrastructure company, disclosed that its IDCF Cloud service was hit by a ransomware attack that caused an outage at a data centre cluster serving eastern Japan. Its customers include government and public-sector organisations, so hosted services may be affected. Customers should monitor the provider’s advisories and treat affected systems as potentially compromised.
Sources BleepingComputer
Tensorlake npm package compromised to spread Shai-Hulud credential-stealing worm Confirmed
The npm package tensorlake, a TypeScript SDK for Tensorlake applications and cloud services, was compromised in a ChainDrop / Shai-Hulud supply chain attack. Version 0.5.144 carried obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence and can execute remotely supplied code. Developers who installed it should remove the package and rotate any secrets exposed on affected machines.
Sources The Hacker News
16 malicious Firefox extensions pose as Rabby and OKX wallets to steal seed phrases Confirmed
Researchers found a cluster of 16 malicious Mozilla Firefox extensions that masquerade as crypto wallet portals and desktop utilities but intercept wallet recovery phrases and private keys during import and send them to attacker-controlled servers. Anyone who installed extensions claiming to be for Rabby, OKX or similar wallets should remove them and move funds to a freshly generated wallet.
Sources The Hacker News
🟡 MEDIUM (12)
FakeGit campaign returns with 17,610 malicious GitHub repositories Confirmed
The FakeGit campaign has reactivated, using more than 17,610 fake GitHub repositories to distribute the SmartLoader malware that installs the StealC information stealer. The repositories impersonate legitimate software, including gaming and cheat tools, to lure victims. Developers should verify repository provenance and avoid running unknown binaries pulled from GitHub.
Sources BleepingComputer
UAC-0099 targets Ukrainian government staff with ASHVEIN and refreshed MatchBoil malware Confirmed
The Russia-aligned actor UAC-0099 is running new campaigns against Ukrainian organisations. TrendAI, which tracks the cluster as Earth Sirrush, describes ASHVEIN, a .NET infostealer and remote access trojan that hides its commands inside HTML, used against government personnel, while DarkReading reports the group has refined its flagship MatchBoil dropper to be stealthier. Ukrainian and allied targets should treat HTML-smuggled loaders and fake document lures as active threats.
Sources The Hacker News|DarkReading
AI pentesting tool ARTEX used in data theft attacks on South Korean financial firms Confirmed
CrowdStrike Intelligence reports a targeted campaign against South Korean financial organisations between late September and early October 2026 that used an AI pen testing tool called ARTEX and resulted in data exfiltration. The activity shows attackers using AI tooling to speed up intrusion work. Financial-sector defenders in the region should review detection coverage for the reported techniques.
Sources The Hacker News|CrowdStrike
Talos details UAT-11985 AI-assisted AiTM phishing against Taiwan researchers Confirmed
Cisco Talos describes an APT spear-phishing campaign, tracked as UAT-11985, that targets people affiliated with Taiwan research organisations using legitimate public-event themes and impersonated academic and policy institutions, combined with real-time Google adversary-in-the-middle phishing. The report notes AI-assisted lures. Targets should treat event invitations that lead to Google login prompts with suspicion and enforce phishing-resistant MFA.
Sources Cisco Talos
Wazza phishkit targets banking, government and manufacturing in US, EU and Australia Confirmed
ANY.RUN has identified a new phishing kit called Wazza that targets banking, manufacturing and government organisations across the US, Europe and Australia. Unlike simple cloned login pages, Wazza builds filtering, session management and traffic controls into the delivery infrastructure to defeat analysis and bot detection. Email and web teams should look for the kit’s signatures in recent phishing traffic.
Sources The Hacker News
Ransomware recovery firm MonsterCloud charged over secret ransom payments Confirmed
The US Department of Justice charged Zohar Pinhasi, owner of ransomware remediation company MonsterCloud, with wire fraud, alleging he secretly paid attackers for decryptors while claiming to recover victim data with proprietary technology, billing victims more than 19 million dollars. SecurityWeek reports the scheme masked around 11 million dollars in markup. The case is a reminder to verify how recovery vendors actually operate.
Low-cost Android phones ship with residential proxy malware Confirmed
A campaign dubbed Midnight Mimosa has been found pre-installed in the firmware of low-cost Android smartphones, letting attackers silently install apps, commit ad fraud and turn the devices into residential proxies. Buyers of unbranded budget phones should treat them as untrusted, check for unknown apps and avoid using them for sensitive accounts.
Sources BleepingComputer
AgentCorruption flaw put AWS Bedrock environments at risk from a single prompt Confirmed
Researchers disclosed an AWS Bedrock AgentCore vulnerability, now patched, that could have let an attacker use a single crafted prompt through one AI chatbot to take over an organisation’s entire agent fleet. AWS has fixed the issue. Teams building agents on Bedrock should confirm they are on current versions and review agent permissions and isolation.
Sources DarkReading
CISA publishes a batch of industrial control system advisories Confirmed
CISA released a large batch of ICS advisories covering products from Hitachi Energy (REB500, Asset Suite, SOI, RTU500), Johnson Controls, Savannah, MikroTik, ABB, Red Lion, Lantronix, Baicells, VIVOTEK and others. Several are severe, including a buffer overflow in the Savannah lwIP SMTP client (CVE-2026-15340, CVSS 9.8) and a remote code execution flaw in MikroTik RouterOS before 7.24 (CVE-2026-84411, CVSS 9.8). Operators should apply the vendor mitigations in the advisories.
Uranium Finance hacker convicted over roughly 50 million dollar crypto theft Confirmed
A hacker who drained Uranium Finance has been convicted over the theft, with reporting putting the loss at roughly 50 million dollars and noting he spent proceeds on Pokemon and Magic trading cards. The case is a law-enforcement outcome rather than a new incident. Crypto teams can expect continued prosecutions driven by on-chain attribution.
Sources BleepingComputer|Decrypt
Japan sees rise in web data leaks amid mobile API abuse and Metabase attacks Under investigation
The Hacker News reports a sharp rise in web data leaks in Japan tied to mobile API abuse and attacks against Metabase business-intelligence instances. Exposed APIs and unpatched Metabase deployments are giving attackers access to corporate data. Japanese and regional organisations should audit internet-facing Metabase instances and mobile API authentication.
Sources The Hacker News
ASOS links its data breach to social engineering and credential theft Under investigation
UK retailer ASOS has linked its recent data breach to a social engineering attack and credential theft, following earlier rogue in-app notifications telling customers they had been hacked. ASOS says hackers accessed some personal data and is notifying affected customers. Customers should stay alert to phishing that references the incident.
Sources BleepingComputer
⚪ WATCH (9)
Pwn2Own Ireland 2026 wraps with repeated Galaxy S26 compromises Confirmed
The third day of Pwn2Own Ireland 2026 concluded with results published by the Zero Day Initiative, and BleepingComputer reports Samsung’s Galaxy S26 was hacked three more times during the contest. The exploits are research disclosures to vendors, not attacks in the wild, but they highlight mobile attack surface. Vendors will patch findings under the contest’s disclosure timelines.
Sources ZDI|BleepingComputer
Empire Market co-creator sentenced to 40 years over dark web marketplace Confirmed
The co-creator of the Empire Market dark web marketplace has been sentenced to 40 years in prison for facilitating around 430 million dollars in illegal transactions between 2018 and 2020. The sentence is a law-enforcement outcome. It reflects continued pressure on the cybercrime marketplace ecosystem.
Sources BleepingComputer
TP-Link faces US state lawsuits over ISP router flaws Under investigation
TP-Link is facing lawsuits filed by several US states and renewed scrutiny over vulnerabilities in routers supplied to ISPs, with SEC Consult publishing technical details of flaws named in the complaint. Many of the affected routers are deployed by ISPs to home users. Owners and ISPs should check firmware and vendor guidance.
Sources SecurityWeek
Google reports on indirect prompt injection in the wild and layered defences Confirmed
Google’s security teams published research on the real-world state of indirect prompt injection against AI agents and outlined layered defences used across its products, including agentic features in Chrome and Workspace. The work is defensive guidance rather than a single incident, but it confirms agents are being targeted. Teams deploying AI agents should treat untrusted content as a prompt-injection vector.
Microsoft urges organisations to start testing post-quantum certificate ecosystems Confirmed
Microsoft published guidance urging organisations to begin testing post-quantum authentication and certificate ecosystems now, ahead of the migration away from current public-key algorithms. The advice is forward-looking preparation. Teams responsible for PKI and identity should start inventory and pilot work.
Sources Microsoft Security Blog
Microsoft Teams to add third-party deepfake detection tools Confirmed
Microsoft is adding support for third-party deepfake detection tools in Teams, aimed at flagging synthetic audio and video in meetings. The feature addresses rising concern about AI impersonation in remote meetings. No specific incident prompted the announcement; organisations should pair it with verification processes for sensitive requests.
Sources BleepingComputer
US offers up to 10 million dollars for tips on alleged HAFNIUM hacker Confirmed
The US government is offering up to 10 million dollars for information on Zhang Yu, charged in connection with HAFNIUM intrusions attributed to China. HAFNIUM was linked to the 2021 Microsoft Exchange Server ProxyLogon exploitation. The notice is a law-enforcement step rather than a new technical threat.
Sources SecurityWeek|The Hacker News
Debate grows over 'bunker mode' as researchers weigh AI and quantum risk to crypto Unconfirmed report
Across crypto media, Ethereum researchers and others debated urging holders to move assets into cold storage or ‘bunker mode’ in response to concerns that AI advances could weaken current cryptography or that exposed keys are a quantum risk. The discussion is forward-looking and contested, not a report of an active break. Holders should keep keys offline and wallets current.
SANS ISC releases scripts for reconstructing AI agent activity Confirmed
SANS ISC published two scripts to help responders reconstruct the activity of AI agents during forensic review, reflecting the growing need to trace agent actions in incident response. The post is defensive tooling from a research source. Incident-response teams working with agentic systems may find the approach useful.
Sources SANS ISC
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.