← All threat briefs

Cybersecurity Brief — 2026-10-10

SECURITY // 2026-10-10

Cybersecurity Brief — 2026-10-10

Supply Chain & Software Integrity

  • GhostAction campaign compromises 500+ GitHub maintainer accounts, plants malicious workflows in tens of thousands of repos. Attackers used leaked PATs from infostealer logs to hijack accounts including Takashi Kitao (pyxel, 18.4k stars) and Henry Wu (athenadriver), injecting security-audit.yml workflows that exfiltrated 3,325+ secrets (PyPI, npm, DockerHub, AWS, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab tokens) to 193.32.204.199. Socket identified 817 affected repos across 327 users since Oct 7. (Source: The Hacker News)

  • FakeGit campaign reactivates with 17,610 malicious GitHub repositories distributing SmartLoader/StealC. The campaign uses fake repos mimicking popular projects to deliver the StealC infostealer via SmartLoader. (Source: Bleeping Computer)

  • Shai-Hulud worm (ChainDrop variant) compromises Tensorlake AI SDK npm package (v0.5.144, ~12k weekly downloads). Malicious release steals crypto wallets, browser passwords, GitHub Actions secrets, cloud credentials, and service-account tokens, exfiltrating to C2. Detected within minutes of publish; impact scope still unknown. (Source: The Register)

Vulnerabilities & Exploitation

  • Flax Typhoon (Integrity Technology Group) exploits 5 older flaws added to CISA KEV; federal agencies have until Oct 11 to patch. CVEs: CVE-2015-3306 (ProFTPD, 10.0), CVE-2021-3199 (ONLYOFFICE, 9.8), CVE-2023-22894 (Strapi, 7.2), CVE-2016-3081 (Apache Struts, 8.1), CVE-2015-5477 (ISC BIND, 7.5). Joint advisory from 7 nations (AU, CA, JP, NZ, ES, UK, US) details scanning, XSS, password spraying, VPN persistence, and email exfiltration. (Source: The Hacker News, SecurityWeek, Bleeping Computer)

  • Citrix NetScaler ADC/Gateway critical RCE (CVE-2026-107406, CVSS 9.5) in SAML IdP/SP configurations. Memory overflow allows RCE or DoS. Affected: 14.1-73.37 through 14.1-73.41, 13.1-64.23 through 13.1-64.28, and earlier. Patch: 14.1-73.46+ and 13.1-64.29+. No wild exploitation reported. (Source: The Hacker News, Bleeping Computer, SecurityWeek, The Register)

  • AhsayCBS backup utility flaws (CVE-2026-105133 auth bypass, CVE-2026-105134 command injection, CVSS 9.3) exploited since Oct 7. Attackers chain both to deploy web shells and XMRig miners disguised as edge.exe, plus an AI-assisted PowerShell script (Taskgmr.ps1) that kills Task Manager if open >1hr overnight. Five orgs confirmed hit; patch in v10.3.4 but Huntress reports gaps. (Source: The Hacker News, Bleeping Computer, SecurityWeek)

  • AnyDesk Linux pre-auth RCE exploit (AnyPwn) published for heap overflow in session protocol (port 7070). Patched silently in v8.0.3 (June) with no CVE or advisory; changelog called it "fixed a bug that could lead to a crash." Exploit targets v8.0.2 specifically; relay-server path also reachable. (Source: The Hacker News)

  • SonicWall SMA1000 max-severity flaw (CVE-2026-102255) now exploited in attacks, patched Oct 6. Three-day patch-to-exploit window. (Source: Bleeping Computer)

  • Cisco Nexus NX-OS: 5 critical CVEs allowing root RCE on data center switches. (Source: Bleeping Computer)

  • GoBalance (Go rewrite of Onionbalance) leaks .onion master keys via truncated 32-byte signatures. Single published descriptor recovers long-term private key; Dread forum taken over Oct 5–7. Original Onionbalance/Tor unaffected. (Source: The Hacker News)

  • P7 DarkSword iOS exploit kit variant adds crypto-wallet/keychain theft and bidirectional C2. Reduced footprint; used by Turkish vendor PARS Defense (fake Snapchat) and Russia-aligned Star Blizzard (fake invites); Chinese actor targeting iOS with Apple ID decoys. iVerify observed LLM-assisted attempts to update for iOS 26.x. (Source: The Hacker News)

  • Three teams pop fully patched Google Pixel 10 at Pwn2Own Ireland (Oct 8); $562,500 total payout. Ikotas Labs ($300k, chained bugs, collision), Xint ($150k, single bug collision), Valsamaras team ($112.5k, two bugs: one collision + one zero-day). All remote via browser/radio. (Source: The Hacker News, Bleeping Computer, SecurityWeek)

  • NVIDIA GPU monitoring high-severity bug (CVE-2026-47483) could crash exposed GPU telemetry servers. Fix released. (Source: The Register)

Threat Actors & Operations

  • FBI arrests third ShinyHunters suspect (Canadian citizen in Pennsylvania), following Netherlands (Sep 15) and Jordan (Sep 29) arrests. Suspect reportedly co-founded Canadian ransomware negotiation firm Cypfer (Edward Dubrovsky); arrested at Cyber Risk Summit. FBI Director Patel vows to "disrupt what's left of ShinyHunters." (Source: The Hacker News, Krebs on Security, Bleeping Computer, Dark Reading)

  • ShinyHunters extorted Boeing spin-off before arrests; teen leader "Rey" (Saif al-Din Khader) detained in Jordan, cooperating with FBI. (Source: Krebs on Security)

  • FBI/DoJ seize 7 domains disrupting Flax Typhoon tools (MicroScan, FishHub) used for critical infrastructure scanning/intrusion. Domains: c0cc.cc, 98aiblog.com, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net. Botnet (Raptor Train/Mirai variant) had 1.2M infected devices (385k US) as of Jun 2024; controlled via Sparrow C2 app. (Source: The Hacker News, Bleeping Computer, SecurityWeek, The Register)

  • FBI + 6 nations: Integrity Technology Group ran portal selling third-party access to stolen emails from gov, law enforcement, healthcare, religious orgs in SE Asia, Africa, NA. Hacking since at least Jan 2021; 1,300+ exploit scripts, M365/Exchange password spraying, mailbox collection tools. US/UK sanctioned Integrity Tech Jan 2025. (Source: The Hacker News)

  • Germany arrests alleged core Qilin ransomware member (Russian national) after extradition from Japan. (Source: Bleeping Computer)

  • Ukrainian-Russian dual citizen pleads guilty to running 15,000-mule money laundering network for cybercriminals. (Source: Bleeping Computer)

  • Russian UAC-0099 refines MatchBoil dropper in campaigns against Ukrainian orgs. (Source: Dark Reading)

  • Venezuelan Tren de Aragua cartel malware operator (first cybercriminal on FBI 10 Most Wanted) arrested for ATM jackpotting. (Source: Dark Reading)

AI & Emerging Threats

  • Anthropic launches OSS Scanner: free opt-in AI vulnerability scanning for open source. Uses Claude (including Mythos) for periodic scans; 116 projects enrolled via PR+YAML config. Model-generated reports, no human triage. Informed by Project Glasswing. (Source: The Hacker News, SecurityWeek, Dark Reading)

  • AWS Bedrock AgentCore "AgentCorruption" flaw: single prompt could hijack entire AI agent fleet. Tokens in metadata, weak VM isolation, expansive permissions. Patched. (Source: Dark Reading, The Register)

  • ClickFix evolves: attackers abuse Google Ads + Bing search redirects to push fake Claude installers. Payloads hidden via DNS TXT records and browser cache pre-fetching. (Source: Bleeping Computer, Dark Reading)

  • OpenAI fires 3 safety researchers over "violated clear policies on handling sensitive information." (Source: SecurityWeek)

  • Australian govt considers mandatory AI incident reporting after agentic attack on Medicare systems. (Source: Dark Reading)

  • AWS releases Strands Box: open-source AI agent sandbox to prevent "YOLO mode" autonomous agent disasters. (Source: The Register)

Infrastructure & Identity

  • ccTLD hijacks (.gh Ghana, .sl Sierra Leone, .as American Samoa) used to mint fraudulent HTTPS certs for Google and other orgs. Attackers modified authoritative DNS records; Chrome blocked suspect certs. CAs not at fault per Google. (Source: The Register, SecurityWeek)

  • TP-Link sued by 4 more US states (FL, IA, MT, NE) — total 5 — over router security claims and China ties. Allegations: misleading "HomeShield covers all security scenarios" marketing, EOL devices (Archer AX21) still sold by ISPs, overstated separation from TP-Link Technologies (China). 21 AGs petition FCC on new model approvals. (Source: The Hacker News, The Register)

  • Low-cost Android phones ship with "Midnight Mimosa" firmware malware (150+ countries). Embedded in firmware: silent app install, ad fraud, residential proxy botnet. (Source: Bleeping Computer, SecurityWeek)

  • Ransomware hits Japan's IDCF Cloud (IDC Frontier), disrupting govt-client data center in eastern Japan. (Source: Bleeping Computer)

  • Microsoft: unsupported Windows versions will lose security updates after next year's Update certificate rotation. (Source: Bleeping Computer)

  • FortiBleed (Fortinet SSL-VPN) still actively exploited; FBI confirms tens of thousands more victims, more ransomware groups involved. (Source: The Register)

  • PoeLLM malware infects 3,000+ servers via AI-generated poetry C2 channel. (Source: The Register)

Policy & Industry

  • UK and Germany sign cyber defense pact: info-sharing and coordinated disruption vs Russian threats; light on agency/funding specifics. (Source: The Register)

  • US soldier sentenced to 70 months for AT&T/Verizon extortions (100M+ call/text records stolen in 2024). (Source: Krebs on Security)

  • Data broker Radaris loses domains in privacy fight. (Source: Krebs on Security)

  • Critical healthcare systems not quantum-ready: study of 2.5M devices across 50 orgs shows long road to post-quantum crypto. (Source: Dark Reading)

  • Cybersecurity M&A boom: 117 deals in latest quarter; non-traditional buyers entering. (Source: Dark Reading)

  • Executive family security training urged: weakest family link becomes entry point. (Source: Dark Reading)

Compiled from The Hacker News, Dark Reading, Krebs on Security, Bleeping Computer, SecurityWeek, The Register, Wired Security (Oct 8–10, 2026). Deduplicated across sources.