Stay updated with the latest cybersecurity news. This roundup covers critical vulnerabilities, active exploitation, ransomware disruption, and significant data breaches from October 1–3, 2026.
1. ShinyHunters suspect detained in Jordan and reportedly cooperating with the FBI
Published: 2026-10-03
Jordanian authorities detained Saif al-Din Khader, a suspected ShinyHunters member known online as “Rey,” and sources told Reuters he is helping the FBI locate other members of the extortion group. The detention follows ShinyHunters’ claim that it breached FBI systems via an alleged Oracle PeopleSoft zero-day and stole employee data — a claim the FBI is investigating and has not publicly confirmed. The bureau said it has already worked with partners on multiple arrests tied to the incident.
2. Technical University of Denmark breach may expose data on up to 200,000 people
Published: 2026-10-02
DTU said attackers reached its identity and access management system, DTUBasen, and downloaded a large volume of records dating back to 2003. The system holds data on about 40,000 active users and 160,000 former users, including current and former staff, students, guests, and partners. Exposed fields can include Danish CPR numbers, names, home addresses, work emails, job titles, and next-of-kin contact details. The university has notified the Danish Data Protection Agency.
3. Fortinet FortiMail zero-day under active exploitation, with patches still pending
Published: 2026-10-01
CISA added CVE-2026-104286 (CVSS 9.8) to its Known Exploited Vulnerabilities catalog. The path-traversal and NULL-byte flaw lets an unauthenticated attacker write arbitrary files on FortiMail via crafted HTTP or HTTPS requests, and Fortinet says exploitation can lead to code or command execution. Affected branches include 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1. Fixed builds (7.4.9, 7.6.7, 8.0.2) were still in development as of early October. Federal agencies were ordered to mitigate by October 4, 2026.
4. Cisco Catalyst SD-WAN Manager authentication bypass exploited in the wild
Published: 2026-09-30
CVE-2026-76504 (CVSS 9.8) is an improper URI-encoding flaw in Catalyst SD-WAN Manager’s API authentication. An unauthenticated remote attacker can send a crafted HTTP request and reach the API as the admin user. Cisco’s PSIRT said it became aware of active exploitation in September 2026. There is no workaround; Cisco has shipped fixes and a temporary Live Protect shield. CISA added the bug to the KEV catalog on October 1.
5. Warlock still using SharePoint flaws against critical infrastructure
Published: 2026-10-03
Symantec and Carbon Black say the China-linked group Warlock (also tracked as Storm-2603, Gold Salem, and Longlegs) is still weaponizing Microsoft SharePoint vulnerabilities, including activity tied to the 2025 ToolShell campaign. In the past two months the group hit at least four organizations — a water utility, a telecom provider, a regional government body, and a university — in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. Intrusions have included disabling security tools and deploying ransomware.
6. Police seize KillSec leak site; 16-year-old suspected as main operator
Published: 2026-10-01
Europol and German authorities announced Operation KillSwitch. On September 30, investigators took over KillSec’s leak site, secured at least 110 TB of stolen data, and made three provisional arrests, with eight searches in Greece, Romania, Spain, and the United Kingdom. Investigators identified a 16-year-old as the suspected administrator and main operator. The probe covers roughly 1,000 suspected attacks worldwide. Roles described by police remain allegations, not court findings.
7. GitLab patches critical AI Gateway command-execution flaw
Published: 2026-10-02
GitLab fixed CVE-2026-90970 (CVSS 9.9) in its self-hosted AI Gateway. Under certain conditions, an authenticated user with Duo Agent Platform access can escape the prompt-template sandbox with a crafted flow configuration and run arbitrary commands on the gateway. Affected versions run from 18.1.6 before 19.2.4, plus 19.3 before 19.3.2 and 19.4 before 19.4.1. Fixes are in AI Gateway 19.2.4, 19.3.2, and 19.4.1. GitLab-hosted gateways are not in scope; self-hosted customers should upgrade immediately.
8. Frontline Education breach exposes school-district employee data, including SSNs
Published: 2026-10-02
Frontline Education is notifying school districts after attackers exploited a vulnerability in third-party software and accessed part of its environment. The company says its security team found the issue on August 14, 2026, then remediated it and notified law enforcement. Exposed data in notifications seen by reporters includes Social Security numbers, email addresses, and physical addresses. At least one district was told 1,210 employees were affected. Frontline will notify individuals unless a district opts out by October 16.
9. Pentagon personnel-records breach exposed data on about 3 million people
Published: 2026-09-29
The Defense Manpower Data Center said a file-sharing vulnerability let a small number of unauthorized users access unencrypted personnel files between October 2025 and July 16, 2026, when the flaw was found and patched. A Defense official told reporters the exposure covers about 2.76 million living people and 294,000 deceased people. Records included Social Security numbers and military or civilian job details — a combination that raises identity-theft and social-engineering risk well beyond a typical PII leak. The product and CVE were not named.
Stay Vigilant
The pattern this week is familiar and sharper: unauthenticated edge-device bugs (FortiMail, Cisco SD-WAN, Citrix NetScaler) are being exploited before patches are universal, SharePoint remains a ransomware on-ramp, and education and government identity stores are still high-value targets. If you run FortiMail, Catalyst SD-WAN Manager, self-hosted GitLab AI Gateway, or on-prem SharePoint, treat those as patch-or-isolate items today, then hunt for the published indicators rather than waiting on a vendor “no evidence of impact” note