The Monday letter · the tech and security week in one email
Buy me a coffeeFlaws, leaks, attacks and regulation. The one section where we do not joke.
45 articles
On Monday 19 October, for just under two hours, the GitHub repo of OVHcloud's command-line client handed out booby-trapped binaries that hoovered up secrets stored on disk. If you ran one, treat your credentials as burned.
ConnectWise has cut partner and customer access to Cloud Backup after unauthorized access to application identities. Customer Microsoft 365 tenants have been compromised in a supply-chain attack.
Online advertising was used to install the Candiru spyware on devices belonging to Al Jazeera Media Network, with no click required. Simply displaying the ad was enough, so the usual caution of readers offers no protection.
Burger King Japan says a server holding data on 11.18 million customers of its official app was accessed without authorization. Anyone who has used the app should be wary of messages that impersonate the chain.
Microsoft and Japan's National Police Agency announced on 14 October 2026 that they had taken down a phishing ecosystem behind more than a billion messages aimed at 75,000 organisations in 150 countries. Those unpaid-toll and stuck-parcel texts you got over the past few months may well have come from there.
On 13 October 2026, Ivanti told customers to patch a zero-day in its Connect Secure VPN gateway immediately, saying it is already being exploited. It reportedly lets an unauthenticated attacker run commands remotely on the box that guards the front door of the network.
On 10 October, Ledger confirmed that a hardware implant had been fitted to at least one wallet sold by CryptoBilis, an authorised reseller based in Malaysia. Analysts put the losses at close to $90 million, across several hundred wallets.
On the night of 11 to 12 October, attackers remotely altered the refrigeration controls of several hundred French supermarkets, causing stock losses. Danfoss, which makes the controllers, says the affected devices were obsolete or had not been updated.
Two AhsayCBS vulnerabilities, one critical and one medium, are reportedly being exploited since 7 October to plant webshells and cryptominers. No patch appears to work, not even in the latest release of this backup platform popular with IT service providers.
Malware found in early October on a Nippon Columbia workstation has exposed more than 8.7 million customer and employee records belonging to Daiichi Kosho. The Japanese karaoke giant was not attacked itself: the data had been entrusted to a service provider.
According to CrowdStrike, the attacks on several South Korean banks in early October were carried out with ARTEX AI, an agentic penetration testing suite, and Claude agents. The case shows how audit tools and mainstream coding agents are now used in real intrusions.
Three days after SonicWall patched it, the maximum-severity flaw in its SMA1000 gateways is already drawing exploitation attempts. These boxes guard the internal networks of big companies and government agencies, and their previous flaws fed ransomware gangs.
ASOS has confirmed that customer names and contact details were accessed after an employee's login credentials were stolen through social engineering. This data can't be used to pay in your name, but it can help fraudsters write convincing scam messages.
Atlassian patched a critical flaw, CVE-2026-21589, that lets attackers read protected files on eight self-hosted products without logging in. The first exploitation attempts came two hours after a proof of concept went public.
Attackers took control of the .gh, .sl and .as country-code domains and used them to obtain unauthorised TLS certificates for Google and other major services. The certificate authorities followed the rules; it was DNS that gave way.
Denmark's central population registry (CPR) has reported a breach affecting around 8.8 million registered people. The exposed names, addresses and identification numbers could be used for targeted, convincing scams.
An alleged ShinyHunters member known as 'Rey' has reportedly been arrested in Jordan and is said to be helping the FBI identify his accomplices. If confirmed, it hits one of the most prolific extortion crews of recent years, behind data thefts at a long list of organizations.
Attackers used compromised credentials to break into the Technical University of Denmark's identity management system and downloaded a large amount of data. Anyone who has been through the university since 2003 may be affected, including employees' relatives.
Since 2 October, LDLC has been telling its customers that unauthorised access to one of its systems may have exposed their full contact details. It is the retailer's fourth incident of this kind since 2021, and that data is enough to make a phishing attempt convincing.
Fortinet issued an advisory on Thursday 1 October 2026 for CVE-2026-104286, a critical FortiMail admin interface flaw already exploited as a zero-day. No fix exists for the 7.4, 7.6 and 8.0 branches: only workarounds protect exposed appliances.
An international police operation seized the servers of ransomware gang KillSec on 30 September 2026 and took three people into provisional custody. The person suspected of running the group is 16 years old.
ANSSI published its report on the DGFiP intrusion on 30 September 2026, a breach that exposed data on 678,000 taxpayers and businesses. Its conclusion: no sophisticated attack, only accumulated weaknesses.
The Japanese car-sharing service confirmed on 28 September 2026 that data belonging to 6.6 million current and former members was stolen. Identity documents are among the exposed information.
On 27 September, Citrix confirmed two remote code execution flaws scored 9.5 in NetScaler ADC and Gateway, both already exploited before the fix shipped. An exposed appliance was reachable for days while no patch existed at all.
Two third-party actions pulled after the Mini Shai-Hulud campaign were restored on 16 September without cleaning their tags. For nine days, any workflow calling them re-ran May's payload.
On 25 September 2026, secure file transfer vendor Kiteworks advised customers worldwide to power down for six hours on Saturday. Nothing has actually been breached: the advice rests on intelligence passed on by federal authorities.
Researchers produced valid RSA signatures without ever computing the private key, a route cryptography believed was closed. It hits only a minority use of RSA, but it drops all three common key sizes below the NIST floor.
A payment-data theft campaign driven by open-source AI agent frameworks has hit more than a hundred online stores since July 2026. Over 600,000 card numbers were reportedly exfiltrated, for a few dozen dollars of compute per victim.
A joint advisory from Japanese, US, Australian and German authorities credits North Korean group WaterPlum with 30,000 compromised devices and $10.7M in cryptocurrency moved to North Korea. The way in is still a fake job offer sent to a developer.
Gyazo has confirmed the theft of some 23.62 million user records after a server flaw was exploited on 11 September 2026. The service is suspended, and 490 million image metadata records are also affected.
On 16 September 2026, the FBI and the American, British and Dutch cyber agencies described CHOSEN BRICK, Windows spyware used against dissidents, activists and journalists. The stolen data sometimes ends up published online.
An automated scanning campaign is targeting Vite development servers reachable from the internet to extract AWS and Azure credentials. The files being requested are the ones nobody expects to expose: `.env`, cloud keys, Terraform state.
Revolut handed ID documents, verification selfies and transaction histories to a scammer posing as a government agency. Nothing was hacked: the attack came through the channel used for lawful data requests.
The Dutch NCSC expects two critical Check Point VPN flaws to be exploited shortly, even though no public attack code has been reported. Patches have been available since 9 September 2026.
Anthropic has detailed eight months of malicious use of its model, including an automated chain that combed 1.8 million Android applications for hard-coded secrets. Initial access now happens in series.
A report published on 11 September 2026 attributes the wave of malicious packages that hit RubyGems in May to OpenAI's internal agents. The repository shut registrations for four days without knowing where the flood came from.
A web page carrying a WebGPU shader freezes the display on M-series Macs and sends them into a reboot, in all three browsers tested. Apple reproduced the bug, then closed the report on 26 August with no fix.
A likely Russian-speaking actor had hundreds of AI agents build and run a global exploitation campaign. The toll: 440 PaperCut servers compromised across 48 countries, half of them in education.
On 8 September 2026, Microsoft shipped the largest batch of security fixes in its history, including two vulnerabilities already under attack. The sheer volume changes how teams must prioritise deployment.
On 7 September 2026, a developer published the private keys of two 512-bit roots that shipped with Netscape 4.51 in 1999, factored in 61 hours on a desktop PC. Compute always catches up with a key size — the only question is when.
A dark web service offered more than 153 million driver's license scans for sale, a database traced back to identity verification vendor IDScan. Several lawsuits have been filed, and the FBI is investigating.
An NVD entry published on 4 September 2026 documents a sandbox escape in Chromium that is already being exploited. Because the engine is shared by nearly every browser and every Electron application, the scope reaches far past Chrome.
A critical Elementor Pro vulnerability, fixed on 19 August 2026, has been exploited since that same day to drop a webshell on WordPress sites. Wordfence says it blocked close to 200,000 attempts.
On 31 August, part of the traffic to Coder's registry was diverted to attacker-controlled servers handing out booby-trapped Terraform modules. Those modules went straight for the keys and tokens held by infrastructure teams.
France's CNIL has fined Hôpital privé de la Loire €500,000, a year after the data of 524,867 patients was exfiltrated. The ruling describes basic failures: no VPN, no two-factor authentication, no monitoring of access.
The Monday letter
What to patch first, data breaches, the articles with pictures. Free, no ads, one-click unsubscribe.
