The Monday letter
Once a week, on Monday morning: what moved in the breach and advisory registers, what to patch first, and the week’s articles.
What you get
- Deal with these first: the week’s exploited flaws and massive breaches, with what to do.
- The week’s articles, one line each.
- Data breaches logged in the register, and the security updates to apply.
One email a week, never more. To follow day by day, there is the morning bulletin and its RSS feed; the letter has one too: lettre.xml.
Your data
Only your email address is requested. It is used solely to send the letter, entrusted to our mailing provider Brevo (France), and removed from the list as soon as you unsubscribe — a link at the bottom of every letter. Details in the privacy policy.
The latest letter
The InYourGeek week, October 5, 2026 to October 11, 2026
| 61data breaches | 123security advisories | 6to patch urgently |
This week: 61 data breaches, 123 advisories, 14 articles, including 6 urgent updates (exploited).
Deal with these first
- Apache Struts — Exploited · apply the vendor’s patch
- Angel One — Critical · 6.8M accounts
Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason. - Citrix NetScaler — Exploited · apply the vendor’s patch
- Fédération belge de taekwondo (Taekwondo.be) et Coachbelgium.be — Critical · 53,580 accounts
Change that password — and everywhere you reused it. That is how a leak spreads to your other accounts. - ISC BIND — Exploited · apply the vendor’s patch
This week’s articles
Daiichi Kosho: 8.7 million records exposed at a third-party provider
Malware found in early October on a Nippon Columbia workstation has exposed more than 8.7 million customer and employee records belonging to Daiichi Kosho. The Japanese karaoke giant was not attacked itself: the data had been entrusted to a service provider.
 |
Cloudflare reportedly buys Deno, and the runtime gets one year to live |
 |
South Korean banks: attacker relied on ARTEX AI and Claude agents |
 |
An Anthropic AI model sent Philadelphia police a fake murder tip |
 |
SonicWall SMA1000: max-severity flaw CVE-2026-102255 already targeted |
 |
Anthropic launches OSS Scanner: free AI security audits for open source |
 |
ASOS confirms customer data breach caused by stolen employee credentials |
Exploited flaws: patch now (6)
- Apache Struts (Software) — Exploited · Remote code execution
- Citrix NetScaler (Network) — Exploited · Denial of service
- ISC BIND (Software) — Exploited · Denial of service
- ONLYOFFICE Docs (Software) — Exploited · Path traversal
- ProFTPD (Software) — Exploited · Authentication bypass
- Strapi (Software) — Exploited · Remote code execution
This week’s breaches (61)
- Angel One — 6.8M accounts · confirmed · banking · ID document · birth date · address
- Fédération belge de taekwondo (Taekwondo.be) et Coachbelgium.be — 53,580 accounts · reported · banking · ID document · health · birth date
- Shinhan Bank — 25,000 accounts · confirmed · ID document · name · phone · other
- France Bourse — reported · password · address · name · phone
- Ministère de l'Éducation nationale — reported · password · hashed password · email · logs
- Quitt.ch — reported · SSN · banking · birth date · address
- TrainMe (groupe Decathlon) — reported · health · address · birth date · name
- Association des scouts de France — reported · ID document · health · address · birth date
- Les Métaux Précieux — reported · ID document · banking · address · name
- Peggy Sage — reported · ID document · banking · health · name
And 51 more in the breach register
Security updates
123 advisories logged, i.e. 79 updates to apply (73 besides exploited ones). Details, with the command to copy, are in each morning bulletin:
October 5, 2026 · October 6, 2026 · October 7, 2026 · October 8, 2026 · October 9, 2026 · October 10, 2026 · October 11, 2026