Weekly recap: Week of 5 to 11 October 2026
Review the week's tracked stories, vulnerability changes, and unverified leak-site claims for the dates shown.
272 stories tracked from Monday to Sunday, Coordinated Universal Time (UTC): October 05 to October 11, 2026; -41 vs prior week; 5 Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) additions from Monday to Sunday, UTC: October 05 to October 11, 2026; 306 ransomware leak-site claims observed in tracked feeds (unverified) from Monday to Sunday, UTC: October 05 to October 11, 2026
Monday to Sunday, UTC. Permalink label: 2026-W41.
The 272 stories above are counted by publisher date (first-seen date where it is missing or unusable), and only for stories that have a summary and a why-it-matters line and are not thin or editorially excluded. The daily archive counts by the day the tracker first saw each story and does not require a summary or a why-it-matters line: its 7 day pages for these 7 days list 440 stories. The two figures use different dates and rules, so they are not expected to match.
Most covered
- breaches incidents11 sourcesAsos app delivers a data leak threat instead of fast fashionSource ↗
Asos customers received a notification claiming the retailer's Snowflake instance was compromised and threatening to leak data, with a link to a Telegram channel. The message's authenticity and delivery method remain unverified, though Asos's stock price dropped approximately 12 percent before recovering. This incident follows a 2024 campaign targeting Snowflake customers that affected major organizations and resulted in a guilty plea and multimillion-dollar ransom payments.
Grouped: the same event, confirmed by the daily automated review.
- vulnerabilities10 sourcesAtlassian warns of critical file access flaw in its datacenter productsSource ↗
Atlassian disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting multiple datacenter products including Bitbucket, Confluence, Jira, and Bamboo. The 9.3-rated flaw allows unauthenticated attackers to access specific files within the web application root directory if they know the exact filename and path. Patches are available, and Atlassian recommends immediate patching or temporary disconnection from the internet for instances that cannot be updated quickly.
Grouped: similar headlines and the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-21589).
- breaches incidents6 sourcesFBI confirms 'multiple' arrests related to ShinyHunters hackSource ↗
The FBI and law enforcement partners have arrested multiple suspects in connection with ShinyHunters, a data-theft-and-extortion group, including Saif al-Din Khader (alias Rey), detained in Jordan on September 29, and a 24-year-old arrested by Dutch National Police identified as Pepijn van der Stap. The arrests stem from investigations into major breaches including the August 2025 Jaguar Land Rover attack that disrupted manufacturing and exposed employee payroll data, as well as the September breach of the FBIJobs.gov portal. FBI leadership has publicly urged remaining members to cooperate, warning that seized infrastructure and witness cooperation will reveal their identities.
Grouped: the same names (DUTCH INSTITUTE, THE FBI, THE REGISTER).
- threat intel6 sourcesFBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen EmailsSource ↗
The Federal Bureau of Investigation and international partners disclosed that hackers affiliated with a Chinese firm compromised email systems at government, law enforcement, healthcare, and religious organizations across Southeast Asia. The company responsible, Integrity Technology Group, faces sanctions from the U.S. and UK. The attackers exploited website vulnerabilities using specialized scanning tools to gain initial access.
Grouped: the same event, confirmed by the daily automated review.
- threat intel5 sourcesPoeLLM malware has assembled a sweeping botnet, taking technical cues from a poemSource ↗
PoeLLM malware has compromised over 3,400 servers since April by targeting open-source artificial intelligence (AI) services, according to Lumen Technologies' Black Lotus Labs. The malware uses a poem posted on GitHub to dynamically generate command-and-control server addresses: it extracts four specific words based on their position in the verse and matches them to a hard-coded dictionary to calculate the IP address, allowing the threat actor to rotate infrastructure without updating the malware code. The botnet conducts exploit scanning and cryptocurrency mining while maintaining functionality for remote code execution and potential abuse of victim AI models, with evidence suggesting the operator is Italian-speaking.
Grouped: the same event, confirmed by the daily automated review.
- threat intel5 sourcesRealtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2Source ↗
Threat actors are exploiting a patched critical flaw in the Realtek Jungle software development kit (SDK) to deploy Cling botnet malware. Cling uses Simple Traversal of User Datagram Protocol (STUN) protocol behavior as a command-and-control channel rather than adopting novel propagation methods.
Grouped: the same event, confirmed by the daily automated review.
- threat intel5th October: Threat Intelligence ReportSource ↗
A threat intelligence bulletin covering the week of October 5 reported breaches at Arizona's state court system, Japanese car-sharing service Times Car, and Polish invoicing platform Fakturownia, exposing personal data and identity documents. Researchers tracked autonomous artificial intelligence (AI) agents conducting rudimentary hacking attempts, malicious Custom GPTs delivering remote access malware through ClickFix campaigns, and an AI-enabled threat actor automating cloud reconnaissance using compromised Azure principals. Critical vulnerabilities were patched in Citrix NetScaler, Cisco Catalyst SD-WAN Manager, Apple CoreGraphics, and GitLab AI Gateway, with active exploitation confirmed in at least two cases.
- vulnerabilitiesDeath By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)Source ↗
PaperCut, print management software used widely by schools, hospitals, and government agencies, contained multiple pre-authentication remote code execution (RCE) vulnerabilities that were exploited in the wild. Security researchers discovered that initial patches introduced bypass vulnerabilities, requiring multiple rounds of updates: a chain combining authentication bypass (WT-2026-0143) with a new post-auth RCE in the scan-to-fax functionality (CVE-2026-82077) enabled unauthenticated system compromise on patched versions through October 10, 2026.
- vulnerabilitiesOctober 2026 Patch Tuesday forecast: Time for an Office cleanupSource ↗
September 2026 Patch Tuesday addressed 973 CVEs across Microsoft products, setting a record volume during what is being termed the Patch Apocalypse. Only two CVEs, CVE-2026-85880 and CVE-2026-81963, were marked as known exploited, with none publicly disclosed. The October forecast suggests continued focus on Microsoft Office patches.
- vulnerabilitiesMaking sure the checks get printedSource ↗
Cisco Talos released research on malware authors embedding natural-language instructions into code to evade artificial intelligence (AI)-assisted analysis, a technique classified as A3: AI-Analysis Evasion that succeeds about 35 percent of the time and is being adopted across malware families, including MANTLEMAZE which pairs these evasions with serious threats like vulnerable driver abuse. The newsletter also highlights several security developments including CVE-2026-88779, a memory overflow vulnerability affecting Citrix NetScaler that can lead to denial of service attacks, alongside other incidents such as a breach of 8 million Danish citizens' records and the Warlock ransomware targeting organizations in Spain and Portugal.
Most active ransomware groups (leak-site claims, unverified)
| The Gentlemen | 72 claims | +3 vs prior week |
|---|---|---|
| Qilin | 23 claims | +9 vs prior week |
| Nightspire | 22 claims | +20 vs prior week |
| N0n | 18 claims | +14 vs prior week |
| Safepay | 12 claims | 0 vs prior week |
| Byod | 10 claims | +10 vs prior week |
| INC Ransom | 10 claims | 0 vs prior week |
| Umbra | 10 claims | +10 vs prior week |
| Panzer | 9 claims | +5 vs prior week |
| LockBit | 8 claims | +4 vs prior week |
Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).
Takedowns and arrests
- FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal HackArrest · The Hacker News
The FBI arrested another suspected ShinyHunters member in connection with the breach of the FBI's jobs portal announced in September. ShinyHunters claimed responsibility for stealing sensitive data on nearly all FBI agents and job applicants. The suspect has not been publicly named and no formal charges have been disclosed.
- Illinois Woman Sentenced to 31 Months in Prison for Distributing and Conspiring to Create and Distribute Sexual Torture and Mutilation Videos of Baby MonkeysSentencing · U.S. Department of Justice
Amanda Leigh Fourez, of Catlin, Illinois, was sentenced to 31 months in prison and three years of supervised release in connection with her involvement with online groups dedicated to creating and distributing videos depicting acts of extreme violence and sexual abuse against monkeys in violation of the federal Animal Crushing statute.
- US Disrupts Chinese State-Sponsored Hacking ToolsDisruption · SecurityWeek
US authorities disrupted hacking tools including MicroScan and FishHub that were used by Chinese state-sponsored advanced persistent threats (APTs), notably Flax Typhoon, to scan and compromise US and foreign critical infrastructure networks. The operation targeted tooling employed in reconnaissance and exploitation activities against high-value targets.
- Venezuelan Cartel's Malware Honcho Nabbed for ATM JackpottingArrest · Dark Reading
A cybercriminal linked to Venezuela's Tren de Aragua cartel has been arrested; he is believed to be the first malware developer added to the FBI's 10 Most Wanted Fugitives list. The individual allegedly supplied ATM jackpotting malware that generated revenue for the cartel's operations.
- Crypto thief who splurged on gold grills sentenced in LondonSentencing · The Record
A 25-year-old individual received a two and a half year prison sentence in London for participating in a SIM-swapping scheme that stole approximately $260,000 in cryptocurrency. SIM-swapping attacks exploit mobile carrier processes to redirect authentication codes to attacker-controlled devices, enabling account takeovers and theft.
- Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China-State Sponsored HackersSeizure · U.S. Department of Justice
Today the Justice Department and FBI announced court-authorized seizures to deny malicious cyber actors access to two hacking tools, “Microscan” and “FishHub,” used to scan and, in some cases, hack, U.S. and foreign critical infrastructure systems and other networks.
- Ukrainian-Russian Dual Citizen Pleads Guilty to Running International Money Laundering Organization for CybercriminalsGuilty Plea · U.S. Department of Justice
CHARLOTTE, N.C. – Oleg Korniev, 42, a dual citizen of Ukraine and Russia, pleaded guilty today to running a sophisticated international money laundering organization that laundered millions of dollars stolen from United States victims by cybercriminals around the world. In total, this international criminal organization recruited over 15,000 U.S.-based money mules to launder at least $10 million stolen by hackers from over 750 U.S. bank accounts. “Money mules play crucial roles in cybercrime, so the Justice Department pursues mules and their recruiters wherever they operate and however long it
- Brookfield Man Sentenced to 84 Months for Money Laundering ConspiracySentencing · Guilty Plea · U.S. Department of Justice
Brad D. Schimel, First Assistant United States Attorney for the Eastern District of Wisconsin, announced that on October 6, 2026, United States District Judge Brett H. Ludwig sentenced Ankurkumar Patel (age 44) of Brookfield, Wisconsin, to 84 months imprisonment. On June 15, 2026, Patel pled guilty to one count of money laundering conspiracy for laundering over $1 million stolen from elderly victims in multiple states who fell prey to a “Phantom Hacker Scam.” Phantom Hacker Scams are a type of fraud that primarily targets elderly victims. A participant in the scheme, who is often located overs
- Nigerian national sentenced for role in email scamSentencing · U.S. Department of Justice
A 35-year-old Houston resident will serve federal prison time for illegally transmitting proceeds from an email scam
- Netherlands Police reports cyber enforcement: takedown (2026-10-08)Takedown · Netherlands Police
- Owner of Empire cybercrime market gets 40 years in prisonSentencing · BleepingComputer
The co-creator of Empire Market, a major dark web marketplace, received a 40-year prison sentence for operating the platform during 2018 to 2020. The marketplace facilitated approximately $430 million in illegal transactions before its shutdown.
- FBI, French authorities seize deepfake CSAM-for-sale websitesSeizure · CyberScoop
The FBI and French authorities seized two websites, NudeLeaksTeens and NLTVIDS, that sold child sexual abuse material (CSAM) and artificial intelligence (AI) generated deepfake content. A 25-year-old French resident was arrested as the primary administrator. The sites used cryptocurrency payments and hosted collections of material stolen from victims' social media accounts, some compiled by individuals already serving lengthy prison sentences for sexual exploitation crimes.
10 more qualifying actions on the full feed.
CISA KEV additions
- CVE-2021-3199ONLYOFFICE Docsdue
- CVE-2016-3081Apache Strutsdue
- CVE-2015-3306ProFTPD ProFTPDdue
- CVE-2015-5477ISC BINDdue
- CVE-2023-22894Strapi Strapidue
Vulnerabilities on the move, to (the 7 days before this recap was generated)
- CVE-2026-50751Check Point Security GatewayEPSS exploit likelihood up 79 percentage points (0.85 now)
- CVE-2026-73570Synacor Zimbra Collaboration Suite (ZCS)EPSS exploit likelihood up 60 percentage points (0.72 now)
- CVE-2021-3199ONLYOFFICE DocsAdded to CISA KEV 2026-10-08; Added to VulnCheck KEV 2026-10-08; Added to ENISA EUVD 2026-10-08; EPSS exploit likelihood up 11 percentage points (0.19 now)
- CVE-2016-3081Apache StrutsAdded to CISA KEV 2026-10-08; Added to ENISA EUVD 2026-10-08
- CVE-2026-66066rails Active StorageEPSS exploit likelihood up 26 percentage points (0.28 now)
Ransomware leak-site claims (20 of 306 shown, unverified)
- claimBigIDUnverified claim. Claimed by The Gentlemen.
- claimConfluentUnverified claim. Claimed by The Gentlemen.
- claimMoneyGramUnverified claim. Claimed by The Gentlemen.
- claimPlacer AIUnverified claim. Claimed by The Gentlemen.
- claimKFCUnverified claim. Claimed by The Gentlemen.
- claimRoyal Thai Air ForceUnverified claim. Claimed by The Gentlemen.
- claimSmart ValueUnverified claim. Claimed by The Gentlemen.
- claimKooltronicUnverified claim. Claimed by The Gentlemen.
- claimCNESTENUnverified claim. Claimed by Qilin.
- claimFriendship Christian SchoolUnverified claim. Claimed by Qilin.
- claimConfipetrolUnverified claim. Claimed by Qilin.
- claimGlenhardie Country ClubUnverified claim. Claimed by Qilin.
- claimLD ConstructoraUnverified claim. Claimed by Qilin.
- claimACI Proyectos SASUnverified claim. Claimed by Qilin.
- claimSecretaría de Modernización e Innovación del MunicipioUnverified claim. Claimed by Qilin.
- claimVadeto GroupUnverified claim. Claimed by Qilin.
- claimFondy Food PantryUnverified claim. Claimed by Nightspire.
- claimThe Bernard Osher FoundationUnverified claim. Claimed by Nightspire.
- claimPMG Project Management GroupUnverified claim. Claimed by Nightspire.
- claimMäntelhaus Kaiser GmbH & Co. KGUnverified claim. Claimed by Nightspire.
Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).