← All threat briefs

Cybersecurity Brief - 2026-10-04

SECURITY // 2026-10-04

Cybersecurity Brief — 2026-10-04

  • ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members — Jordanian authorities detained Saif al-Din Khader (alias 'Rey'), a suspected ShinyHunters member, on September 29. He is reportedly cooperating with the FBI to identify other group members, following the group's claimed breach of FBI systems using an alleged Oracle PeopleSoft zero-day. Dutch police previously arrested another suspect (Pepijn van der Stap) in September. (Source: The Hacker News, BleepingComputer)
  • China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing — China-nexus espionage group TA419 is running credential-phishing campaigns against U.S. AI policy experts at think tanks, universities, and legal firms. The group uses adversary-in-the-middle (AitM) phishing via Microsoft infrastructure, impersonating prominent economists, AI policymakers, and an Anthropic employee to lure targets. (Source: The Hacker News)
  • MI5 Says China's MSS Funded Research Involving 100+ U.K.-Linked Academics — MI5 issued a Security Service Espionage Alert warning that over 100 U.K.-linked academics have assisted China's Ministry of State Security (MSS) via the China General Technology Research Institute (CGTRI). The institute funds research designed to advance Chinese intelligence collection. MI5 urges vigilance around academic partnerships with opaque funding sources. (Source: The Hacker News)
  • Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware — China-linked threat actor Warlock continues weaponizing Microsoft SharePoint vulnerabilities (old and new) against critical infrastructure, government, and education targets in Portuguese- and Spanish-speaking countries. Symantec and Carbon Black observed the group disabling security tools before deploying ransomware. (Source: The Hacker News)
  • The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations — The Hacker News publishes its 2026 cybersecurity landscape report covering how cloud expansion, AI, distributed systems, and complex digital environments are reshaping security toward continuous visibility, control, and scaled risk response across core segments. (Source: The Hacker News)
  • Google Gemini could soon get full access to your Mac's files, apps and the web — Google is testing a hidden 'Additional sandbox options' setting in the Gemini Desktop app that would grant the AI broad macOS access—reading, creating, modifying, or deleting files anywhere, interacting with Mail/Safari/Messages, and acting without per-action prompts. The feature mirrors Anthropic's computer-use model; Apple may restrict such agent access. (Source: BleepingComputer)
  • Danish university DTU breach exposes data of up to 200,000 people — The Technical University of Denmark (DTU) disclosed a breach of its identity and access management system (DTUBasen) via compromised credentials, exposing up to 200,000 current and former users' data including Danish civil registration numbers (CPR), names, addresses, employment details, and next-of-kin information. DTU cannot determine exactly what was downloaded. (Source: BleepingComputer)
  • Muse Creates Detailed Profiles of All Your Friends and Family — Meta's AI agent Muse, downloaded by millions, builds hourly 'pages' profiling every person in a user's life—family, partners, friends, colleagues, collaborators, and follows—by compiling data from connected accounts (bank, messages, health). Researchers extracted Muse's system prompts revealing this design; Meta says the files were intentionally accessible for transparency. (Source: Wired Security)
  • Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows — Anthropic's AI model Mythos discovered a new critical auth-bypass/RCE flaw in Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500. Within a day of disclosure, VulnCheck detected active exploitation from China-hosted IPs targeting U.S. and Japanese hosts. HFS v3.2.1+ patches the flaw; HFS was on CISA's KEV catalog in 2024. (Source: The Register Security)