Norway’s Datatilsynet fined Xandr $9.6M (NOK 92 million) for unlawfully processing and sharing Grindr users’ sensitive data, imposing the authority’s largest penalty to date. The ruling covers July 2018 to April 2020 and centers on the sharing of sexual orientation information without valid consent. Xandr has three weeks to appeal the decision.

Yandex cloud services are disrupted after drone attacks damaged three data centers, leaving customers unable to access cloud files and degrading several hosted services. The outage affects a broad slice of Yandex’s cloud stack, including Yandex Disk and core infrastructure services, with no reliable restoration timeline yet. Yandex told customers to rely on alternative disaster recovery options while teams work to stabilize operations.

Ledger confirmed that devices sold through CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The compromised units were distributed through a Southeast Asian reseller, creating direct theft risk for affected buyers. Ledger is reaching out to impacted users while the investigation continues.

The Coopérative U supermarket network confirmed a cyber-attack that affected several stores from October 11, disrupting refrigeration facilities and putting fresh-product storage at risk. The incident created direct operational and financial impact, including reported merchandise losses at affected locations. The attack was linked to outdated Danfoss refrigeration control software, and the alleged abuse of forced defrost cycles could have driven temperatures as high as 50 °C (122°F). Recovery efforts were underway with refrigeration specialists while the scope of the compromise was assessed.

Leaked internal files and chat logs show Luna Moth / Silent Ransom Group (SIG) running a specialized data-extortion operation with split roles, scripted social engineering, and coordinated remote access, raising the scale and reliability of its extortion workflow. The files, surfaced in early October 2026 and analyzed on October 9, 2026, indicate that one operator handles the victim-facing trust manipulation while another controls the session behind the scenes. That structure turns the group into a repeatable criminal service model rather than a loose ransomware crew.

AvisLoader is a newly identified Windows loader that uses a ClickFix lure and Tox-based command-and-control to deliver commands and payloads, increasing the difficulty of disruption and tracking. Varonis Threat Labs found it on an exposed staging server with supporting tools and a Command Center. The recovered components point to shortcut persistence, UAC bypass tooling, and a process-hiding DLL. The operator setup also supports staged file delivery and client tasking over Tox.

Ahold Delhaize confirmed a cybersecurity incident that forced some systems offline, disrupting parts of its store and corporate environment. The company said it is working to assess and mitigate the issue while keeping stores open. The disruption affected Stop & Shop employee access to schedules and pay stubs and hit websites, apps, and customer service platforms for several banners in the Netherlands and Belgium.

The Ahold Delhaize network issue took some systems offline, disrupting websites, apps, customer service platforms, and employee access across several brands and regions. Customers at Albert Heijn, Etos, Gall & Gall, and Delhaize could not use key online services, while Stop & Shop employees had trouble reaching schedules and pay stubs. The company said stores stayed open and teams were working to assess and mitigate the issue.

GitLab CI/CD Regular Expression Compiler flaw CVE-2026-97229 is now patched, and unpatched GitLab CE/EE servers face unauthenticated remote code execution risk. The maximum-severity bug is an integer overflow in regular expression parsing and compilation for pipeline configuration files. GitLab says self-managed users on 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2 should upgrade immediately.

GitLab released security fixes for GitLab CE/EE after disclosing CVE-2026-97229, and self-managed installations were told to upgrade immediately to stop possible unauthenticated code execution on targeted servers. The patch covers affected builds before 19.2.8, 19.3.4, and 19.4.2.

The FBIjobs.gov breach exposed a third-party managed jobs site and allegedly led to 2-3TB of data being extracted. Attackers reportedly used an Oracle PeopleSoft vulnerability to compromise the site and then pivoted into AWS GovCloud systems. The intrusion is linked to ShinyHunters and may have exposed names, addresses, telephone numbers, dates of birth, Social Security numbers, and emergency contact details for thousands of FBI employees.

The FBI arrested and charged Edward Dubrovsky in the ShinyHunters case, escalating the cybercrime prosecution tied to the FBIjobs.gov breach. Court documents identified Dubrovsky as the suspect after the bureau said agents had made another arrest in the investigation. The charges connect the case to alleged extortion-related conduct and a broader effort to dismantle the network.

Attackers exploited Oracle PeopleSoft on the FBI jobs platform, used that foothold to reach AWS GovCloud, and reportedly stole personnel and applicant data linked to the FBI. Public reporting tied the intrusion to ShinyHunters, and later analysis connected the same access path to CVE-2026-35273, a PeopleSoft flaw that was also mass-exploited against other organizations. The story then moved from breach claims to response and accountability. The FBI said the theft stemmed from a security failure on a third-party PeopleSoft platform after a contractor failed to apply a patch, removed the contractor, and continued mitigation. Authorities have also made arrests in investigations connected to the jobs-site intrusion, while the exact exfiltrated volume, full system scope, and final number of affected people remain unresolved in available material.

Daiichi Kosho disclosed that a contractor malware incident at Nippon Columbia Group (NCG) may have exposed more than 8.7 million customer and employee records. The exposed dataset includes 93,000 employees and 8,631,000 customers across brands such as BIG ECHO and Karaoke CLUB DAM. The company says its own systems were not breached and that data theft is unconfirmed, but it is investigating whether the information was leaked online. The exposed fields include names, dates of birth, email addresses, and telephone numbers.

Nippon Columbia Group (NCG) suffered a malware infection on an employee computer, forcing isolation of the affected system and an investigation into possible downstream exposure. The incident mattered because NCG handles customer personal information for Daiichi Kosho, a major Japanese entertainment company. Daiichi Kosho says its own systems were not breached and that no data theft or leak has been confirmed.

Confirmed exfiltration from four Ukrainian organizations exposed more than 628,000 records tied to Ukrainian individuals, creating a large-scale data-leak event. The stolen material came from a broader access operation that also targeted WordPress sites, e-commerce platforms, and Ukrainian critical infrastructure. The scope indicates a substantial compromise of personal records and a continuing risk of further data removal.

The CyberXero campaign is running dual AI-augmented access pipelines that are stealing access at scale from WordPress and e-commerce sites while also targeting Ukrainian energy and critical infrastructure. The operation combines Cobalt Strike with Claude Code and has been active since at least July 2026, increasing the risk of broader compromise and follow-on monetization. Researchers linked the activity to confirmed exfiltration from four Ukrainian organizations and more than 628,000 records tied to Ukrainian individuals. The same intrusion stack also showed automated scanning, web-shell deployment, and exploitation of exposed services.

Edward Dubrovsky was arrested in Pennsylvania in a cybercrime case tied to extortion allegations and the ShinyHunters investigation. Court records show he appeared in the Eastern District of Pennsylvania before being transferred to the Eastern District of Texas, where the charges were filed. The docket lists conspiracy and extortion-related counts connected to threats to impair the confidentiality of information to extort money.

CrowdStrike linked a suspected China-based threat actor to a South Korean financial-sector intrusion campaign that used ARTEX and Claude AI tooling. The actor targeted multiple Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank, exposing clients’ personal data and credit card information and causing system outages in some cases. Researchers also found Claude Code session histories, ARTEX configuration files, and Claude memory files in open directories, along with the likely use of DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 for additional sessions. The exposure extends the incident from access and tooling analysis into confirmed data leak impact, while South Korea’s government issued an emergency response and warned of phishing and loan-scam follow-on risk.

A Chinese-speaking hacker used ARTEX AI and Claude agents in attacks on South Korean banks earlier this month, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. CrowdStrike said the attacker left Claude Code session histories, ARTEX configuration files, and Claude memory files in open directories, and the same tooling also exposed résumé-based identification, contact, and Telegram details. The attack set caused system outages in some cases and exposed clients' personal data and credit card information. After confirming real-world abuse, the ARTEX developer made the project closed-source and stopped updates.

AI SPERA is introducing AITEM for Criminal IP, extending the platform from visibility-focused ASM to AI-powered threat exposure management and faster response to exposed risk. The capability is meant to prioritize and investigate exposure across external assets, OSINT, dark web data, internal infrastructure, Shadow AI, leaked data, and emerging vulnerabilities. By combining threat intelligence with real-world exploitability and attacker activity, the update aims to help security teams turn discovery into action.

A malvertising campaign is abusing Google Ads and Bing redirect chains to push fake Claude installers that try to trigger malicious command execution on macOS users. The operation uses multi-layer cloaking and a compromised WordPress site to hide the lure from scanners. The final page copies Anthropic's legitimate install flow but swaps the clipboard command for a script that fetches payload data from lake-90[.]com and executes it through zsh. Researchers track the associated toolkit as AcSig, and the ultimate payload remains unknown.

Researchers identified a Chinese-speaking DarkSword exploitation-as-a-service operation with an agent/reseller model, signaling a more organized criminal distribution ecosystem for iOS exploit-kit abuse. The platform’s control plane and recovered victim artifacts show the operation was already collecting crypto-wallet recovery phrases and scaling access across multiple hosts. That structure increases the reach and monetization efficiency of DarkSword/Coruna activity.

The P7 DarkSword variant now adds keychain theft and crypto-wallet theft while also enabling two-way C2 with attacker infrastructure, increasing the risk of stolen credentials and wallet abuse on compromised iPhones. The change makes the exploit kit more capable of harvesting high-value data and managing infected devices remotely.

Organizations are being urged to enforce read-only and scoped credentials at AI agent tool calls so agents cannot overreach through prompt injection, mistaken assumptions, or credential misuse. The guidance points to gateways, hooks, sandboxes, and endpoint enforcement as practical controls for blocking out-of-policy actions. It also warns that the right control depends on where the agent runs and whether the platform can actually see the request.

AnyDesk released version 8.0.3 for AnyDesk Linux, closing a pre-authentication RCE path before the exploit became public. The June fix was treated as a generic bug fix in the changelog, with no CVE and no formal security advisory attached. Administrators should move affected Linux systems to 8.0.3 or later because the underlying flaw could expose systems to root access over direct connections.

A working exploit is now public for an AnyDesk Linux pre-authentication remote code execution flaw, exposing systems to root access before connection approval. AnyDesk fixed the issue in version 8.0.3 in June, but the flaw still had no CVE as of October 9. The published code targets direct TCP connections on port 7070 and shows that the bug can be weaponized even before a session is accepted. Relay-based exploitation remains unresolved.

AhsayCBS post-exploitation activity is combining web shells and XMRig cryptominers after compromise. Huntress observed the activity on October 7 and said it targeted at least five organizations. Attackers chained CVE-2026-105133 for authentication bypass and CVE-2026-105134 for code execution, then dropped JSP webshells, downloaded XMRig as edge.exe, and used MicrosoftEdgeUpdateSvc plus Taskgmr.ps1 to hide mining activity.

AhsayCBS exploitation of CVE-2026-105133 and CVE-2026-105134 is enabling authentication bypass, code execution, and post-compromise activity on exposed backup management systems. Huntress observed the wave on October 7 and said it targeted at least five organizations. Attackers chained the flaws to gain access, then deployed JSP webshells and the XMRig miner disguised as edge.exe. Huntress also said Ahsay 10.3.4 is affected, extending the exposure beyond the originally fixed version.

CVE-2026-105133 and CVE-2026-105134 in AhsayCBS are being actively exploited, enabling attackers to bypass authentication and run arbitrary commands on exposed systems. Huntress observed the activity on October 7, 2026 and said it affected at least five organizations. Post-exploitation activity included JSP webshells, XMRig miners disguised as edge.exe, a MicrosoftEdgeUpdateSvc service running msedge.exe, and Taskgmr.ps1 used to hide mining activity.