Back Securityaffairs.Co

Security Affairs newsletter Round 599 by Pierluigi Paganini

Securityaffairs.Co •Pierluigi Paganini • October 11, 2026

Security Affairs Round 599 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs , including international press.

International Press –

ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say

Iranian accused of hacking American universities extradited from Montenegro

Hackers access data of 8.8 million people in Denmark in ‘extremely serious’ breach

ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

Apprehended Venezuelan Tren de Aragua Leader on FBI’s 10 Most Wanted Fugitives List Appears in Nebraska Court Following Homeland Security Task Force Investigation

Behind the Connect Button: The Fake AI Ads Campaign

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia

Known Cybersecurity Expert and Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients

Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure via TLS Certificates

Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China-State Hackers

Germany arrests alleged core Qilin ransomware member after extradition

Co-Creator of Dark Web Marketplace Sentenced to 40 Years in Federal Prison

Can you really make more than $200M in six months without encrypting victims? It seems Silent Ransom Group can. (1)

Friend of suspected FBI data thief says he warned ‘crazy’ teen not to hack bureau

ShinyHunters Extorted Boeing Spin-off Prior to Arrests

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

MALFEX – A malicious npm postinstall no advisory has caught for fourteen months

Canto incognito: tracking the PoeLLM malware

Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight

The phone was compromised before the user turned it on: the rise of Midnight Mimosa

New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS

OpenAI “rogue” agent activities found on Wikimedia projects

Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers

FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts

You Won’t Hear These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)

Pwn2Own Ireland 2026 – Day Three Results & Master of Pwn

Chrome’s Response to Recent ccTLD Registry Hijacks

Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000

Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

Intelligence and Information Warfare

MI5 issues Espionage Alert – CGTRI 中国通用技术研究院

Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles

Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS

The Silent Electronic Battleground Shaping the Future of Warfare

UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER

US Offers $10 Million Reward for Chinese Hacker Accused of State-Backed Cyberattacks

The Ministry of Foreign Affairs has fended off fresh attempts at cyber-attacks on its website and national infrastructure

Investigating unintended model actions in our evaluations and internal use

Ukraine takes aim at Russia’s AI data infrastructure

South Korea probes bank breaches amid suspected AI-powered attacks

Accenture contractor removed from FBI following damaging data breach, sources say

Introducing the Anthropic Cyber Mission

Updates to Full Disk Access in macOS

Launching an opt-in vulnerability-finding service for open-source software

Quantum computing and cryptocurrencies

Follow me on Twitter: @securityaffairs and and Mastodon

( SecurityAffairs – hacking, )

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. Since its disclosure on May 13, 2026, the vulnerability has been actively exploited, leading to unauthorized access to corporate networks across various sectors, including education, healthcare, and finance. Reports indicate that over 600 organizations have been affected by ransomware attacks linked to this vulnerability. Security experts recommend immediate patching and monitoring for signs of compromise, as attackers may have already established access before remediation. The situation is compounded by the rise of ransomware-as-a-service (RaaS) operations, which have increased the scale and impact of these attacks. 37 sources 73

Extracted Entities

Security Affairs newsletter Round 599 by Pierluigi Paganini

The full story

Extracted Entities

Attack Types (2)

Campaigns (2)

Companies (1)

Countries (9)

CVEs (1)

Industries (3)

Malware (2)

MITRE ATT&CK (2)

Platforms (4)

Ransomware Groups (2)

Tools (1)