CVE-2026-61500 in Rejetto HTTP File Server (HFS) exposes 3.0.0 through 3.2.0 to session forgery, letting attackers recover a signing key from Math.random() and seize administrator access. A public Python PoC appeared in late September 2026, and VulnCheck later reported active exploitation attempts. The flaw can escalate to remote code execution through the server_code configuration feature. A fix is available in HFS 3.2.1.

Italy's GPDP fined IQVIA and ordered compliance after finding GDPR violations in health-data processing that could expose and de-anonymize roughly one million patients. The authority said the company's Italian division used detailed records and unique codes that made reidentification possible over time. It also said the processing lacked an adequate legal basis and patient notice, with a 120-day deadline to fix the practices.

A weak authorization flaw in Microsoft Exchange Server (CVE-2026-96940) lets an authenticated attacker elevate privileges and read other users' mailboxes within the same organization. Microsoft rated the issue 8.8 CVSS and released out-of-band security updates. The flaw affects on-premises Exchange Server deployments, while Exchange Online already has a service-side fix.

Denmark's Central Population Register (CPR) disclosed a data breach that exposed personal records for about 8.8 million registered people. The exposed data included names, physical addresses, dates of birth, marital status, and unique CPR numbers. The access abuse involved a private Danish company and brute-forcing CPR numbers to pull matching records. The breach happened in September 2026, was recognized on October 2, and the registry has since blocked the access while police investigate.

The ClingSTUN Linux proxy backdoor is turning unpatched internet-facing IoT devices into remotely controlled proxy nodes, expanding covert infrastructure for abuse. The malware was tracked across three periods with different download servers and an expanding set of entry points. Its earliest observed wave relied on CVE-2022-36553 in Hytec Inter routers. Later activity added more flaws and used public STUN servers to keep infected systems reachable.

The Cling malware activity now includes STUN-based back-connect proxying that uses public STUN servers to keep infected systems reachable as remotely controlled proxy nodes. FortiGuard Labs said the campaign, published October 5, progressed through multiple waves of exploitation against internet-facing IoT devices, including CVE-2022-36553, CVE-2025-34035, and CVE-2024-23625, before expanding to a list of 24 vulnerabilities in the third period. The malware also copies itself, modifies boot scripts for persistence, hides behind process information from init, and supports remote command execution. FortiGuard further noted that the STUN traffic can resemble normal VoIP and WebRTC activity, making the proxy nodes harder to spot.

A confirmed data breach at Shinhan Bank and related cyber incidents at KB Kookmin Bank and Hana Bank exposed risk across South Korea's banking sector. Authorities launched on-site investigations and coordinated incident information with KISA after receiving reports. Local reporting said Shinhan may have leaked details on 25,000 customers, while Kookmin may have exposed credit card information for 119,000 clients. The response now centers on containment, customer protection, and tighter checks on externally accessible systems.

BPFDoor, BPF Rekoobe, and AVERAT Linux backdoors were tracked against telecom and network-edge appliances in South Korea and Taiwan, raising the risk of stealthy compromise on devices that handle core communications traffic. The tooling hides by making sessions look like SMTP on TCP port 25 and by posing as legitimate services. It also adds deeper access features such as file transfer, shell sessions, and proxy/port-forwarding channels.

tenfold Community Edition added shared content governance and event auditing, giving organizations under 150 users stronger visibility into Microsoft 365 access and identity activity. The update brings access reviews for shared files and helps teams catch oversharing, stale access, login spikes, and new admin accounts earlier. The free tier now carries more of the controls normally needed to monitor and reduce identity risk.

Citrix released emergency NetScaler updates for CVE-2026-88779, closing an actively exploited flaw across NetScaler ADC, NetScaler Gateway, and affected FIPS deployments. The vendor shipped 14.1-73.41 and 13.1-64.28, and told customers to install the updates immediately. Global Deny Lists were also provided as a supplementary block list for known malicious IPs.

Citrix disclosed CVE-2026-88779, a memory buffer flaw in NetScaler ADC and NetScaler Gateway that is being used in zero-day attacks. The issue affects SAML authentication paths and can cause denial of service on unmitigated deployments. Citrix said researchers are also investigating whether the flaw can be pushed to remote code execution. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.

The US Senate passed the bipartisan Health Care Cybersecurity and Resilience Act, moving the healthcare cybersecurity bill to the US House. The measure would create a federal resilience framework for healthcare institutions with grants, training, and tighter HHS/CISA coordination. It also aims to strengthen defenses for rural providers and require a cybersecurity incident response plan. The action targets a sector facing repeated ransomware and breach pressure.

Apple is tightening Full Disk Access in macOS, requiring an explicit user action before apps can gain broad access to files, mail, messages, browsing history, and other private data. The mitigation reduces the risk that AI agents or other apps can quietly bypass privacy protections and read or write sensitive system content. Apple said the change is meant to make users clearly understand the risk before granting that level of access, and the rollout date is still unknown.

CVE-2026-100754 exposed OpenAI's ChatGPT app for Mac to unauthorized takeover, putting stored chat logs and other app data at risk. The flaw could let an attacker take over the AI assistant and reach data stored by the app. The vulnerability broadened the risk for Mac users who relied on the app to hold sensitive conversations and related content.

Meta's Muse assistant for Mac has a now-patched flaw that let an unprivileged local process redirect dictation traffic, capture dictated audio and prompts, inject trusted prompts, and abuse the app's access. Security researcher Patrick Wardle also tied the issue to the undocumented endo_voyager_dictation_endpoint setting, which could be changed by a program running as the logged-in user. The exposure sits within the broader risk Apple highlighted for Full Disk Access on macOS, where apps with elevated privacy permissions can reach files, mail, messages, and browsing history. Apple said it plans to tighten FDA controls so that this kind of access is granted only with explicit user action.

Google has suspended its Open Source Vulnerability Rewards Program (OSS VRP) until 2027, disrupting a vulnerability-reporting channel for its open-source projects. The pause follows a significant rise in automated submissions that were mostly invalid, reducing the program’s usefulness for researchers. Google says existing reports and supply-chain reports are not affected, and the program will be reformatted before a Q1 2027 update.

UK schools are seeing fewer cyber incidents and faster recovery, with the share reporting an incident falling from 34% in 2023-24 to 27% in 2025-26. At the same time, 66% of schools can now recover immediately, up from 55%, indicating a sector-wide resilience gain that reduces disruption to teaching and administration.

Frontline Education confirmed a data breach after attackers used a third-party software vulnerability to gain unauthorized access to its environment and steal employee records. The compromise affected school district employee information, including Social Security numbers, and was identified on August 14, 2026. Frontline said it remediated the flaw and notified impacted districts.

Google temporarily suspended OSS VRP product vulnerability submissions, pausing part of its open-source bug bounty intake after a surge of AI-generated automated reports overwhelmed the program. The change leaves supply chain reports and outstanding reports open, limiting the interruption to product vulnerability submissions. Google said it will readjust the OSS VRP and provide an update in Q1 2027.

TA419 is a China-nexus espionage campaign that used credential phishing against AI policy experts at U.S. think tanks, universities, and legal sector organizations, with additional targeting of defense contractors and Japan-linked institutions. The lures impersonated economists, AI policymakers, Lynne Parker, Heidi Crebo-Rediker, and an Anthropic employee, including a February 2026 message with the subject “Request for Feedback on Military Integration of Claude.” Recipients who responded were pushed through shortened URLs and multi-stage redirects to a spoofed OneDrive sign-in page. The page used Frameless BitB and an adversary-in-the-middle (AitM) proxy to relay Microsoft 365 logins, capture passwords, MFA codes, and session cookies, and keep the sign-in appearing successful. Proofpoint says the activity has run since at least April 2025 and likely supports Chinese intelligence collection on U.S. AI policy and export-control issues.

Jordanian authorities reportedly detained Rey — identified as Saif al-Din Khader — in Jordan on September 29, 2026, and he is said to be cooperating with the FBI to identify other ShinyHunters members. The reported cooperation could help investigators map the group’s devices and digital communications and accelerate further arrests. The case sits inside a broader ShinyHunters crackdown that Reuters says includes pressure on the group after recent actions and disruptions tied to its online infrastructure.

MI5 issued a Security Service Espionage Alert warning U.K. academic institutions about CGTRI/CAGT and the risk that research collaborations could support MSS espionage. The alert says more than 100 U.K.-linked academics have contributed to CGTRI-funded projects spanning AI, cybersecurity, covert communications, and steganography. MI5 urged universities to review collaborations and trace funding sources, while warning that continued cooperation could create National Security Act 2023 exposure.

The Technical University of Denmark (DTU) disclosed a compromised-credentials intrusion into DTUBasen, exposing personal data tied to up to 200,000 users. The accessed records span more than two decades and may include CPR numbers, names, addresses, profile photos, and next-of-kin details. DTU warned the stolen data could fuel identity fraud and more convincing phishing.

The Technical University of Denmark (DTU) disclosed a data leak affecting information tied to up to 200,000 users, creating risk of identity fraud and more convincing phishing. Attackers used compromised credentials to access DTUBasen, DTU's identity and access management (IAM) system, and download a large amount of data. The exposed material may include CPR numbers, names, addresses, profile photos, and work-related details.

The Warlock ransomware campaign is using SharePoint vulnerabilities to break into a water utility, telecom provider, regional government body, and university across Europe, Africa, and Latin America. The group emerged in June 2025 and has been active over the past two months, with ToolShell zero-days helping open the door. In a July 22 intrusion, attackers disabled protection on at least 40 hosts and then launched ransomware on at least 33 hosts. Continued exploitation of SharePoint keeps exposed on-premises deployments at risk of follow-on intrusion and extortion.

Warlock ransomware was launched on at least 33 hosts after protection was disabled, compressing the final stage of the intrusion into a rapid network-wide rollout. The deployment followed an AV/EDR-killing tool that turned off defenses on compromised machines. The payload was staged in SYSVOL, enabling broad execution across the environment.

Antino is being deployed as a Windows backdoor that gives operators host reconnaissance, command execution, file transfer, and persistence while routing C2 through Microsoft 365 dead drops, increasing stealth against defenders.

A UAT-11587 spear-phishing campaign is expanding across Asia and Syria, delivering the Antino backdoor to government and policy organizations and increasing the risk of espionage and persistent access. The operation first surfaced in September 2025 and later broadened to targets in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria. It uses tailored lures, spoofed trusted senders, and a fake Gmail attachment preview to push victims into a multi-stage infection chain. Antino then abuses Microsoft 365, especially Outlook and OneDrive, for command-and-control and file transfer.

GitLab issued immediate update guidance for GitLab Self-Managed customers running Self-Hosted AI Gateway after fixing CVE-2026-90970, a flaw that could allow arbitrary command execution on unpatched instances. The company released 19.2.4, 19.3.2, and 19.4.1 and told affected users to upgrade immediately. GitLab-hosted AI Gateway users are already protected and do not need action.

GitLab has fixed CVE-2026-90970, a critical improper neutralization flaw in GitLab AI Gateway that could let authenticated users with Duo Agent Platform access escape the prompt template sandbox and run arbitrary commands on vulnerable self-hosted instances. The issue affects GitLab Self-Hosted AI Gateway deployments, while GitLab-hosted AI Gateway users are already protected. GitLab released 19.2.4, 19.3.2, and 19.4.1 and told customers to update immediately.