🔴 FBI seizes Flax Typhoon's MicroScan/FishHub domains with 7-nation advisory, 🐙 FakeGit swells to 17,610 malicious GitHub repos, 💥 New NetScaler 9.5 SAML RCE plus Ahsay and Atlassian exploited in the wild, 🏯 Ransomware cripples Japan's IDCF Cloud, 495 tenants down, 🤖 AI pentest tool ARTEX hits 7 South Korean banks, 🔐 IBM Verify Access and DataPower 9.8 RCE waves

[NEW] The Justice Department and FBI seized seven domains behind MicroScan and FishHub, the scanning and spearphishing tools of Flax Typhoon contractor Integrity Technology Group, and paired Thursday's takedown with a joint FBI, CISA and NSA advisory backed by seven allied governments. The advisory attributes automated scanning, Mirai-variant IoT botnet reconnaissance against a US power company and hands-on exploitation to the firm, including cross-site scripting and password spraying against Microsoft Exchange with persistence through VPN software, and FishHub was turned on at least 20 Taiwanese universities. This morning's FBI follow-up adds that third parties were given access to stolen email, and the seized infrastructure includes c0cc[.]cc, 98aicai[.]com and outlook3650[.]com. US- and EU-sanctioned Integrity Tech has run MicroScan since at least 2017, so treat its scanning fingerprints as targeted-threat telemetry, not background noise.

[NEW] The FakeGit fleet is back and doubled: Apiiro's update shows the campaign Trend Micro attributes to Water Kurita reactivated on October 4 and grew from 7,600 to 17,610 malicious GitHub repositories, pushing over 13,000 repos in 34 hours at a peak of 2,999 per hour, with 97 percent of sampled commits touching only the README and 88 percent pointing the download button at a ZIP that installs SmartLoader, which delivers the StealC infostealer. The repos impersonate Gmail, WhatsApp, Databricks, Jenkins and Docker, and 800 pose as AI skills or MCP servers that appeared more than 600 times in public AI registries, the agentbaiting technique Island first documented in July; roughly 700 fleet accounts belong to legitimate developers. Audit your GitHub orgs for fabricated star-to-commit ratios, verify AI registry entries against commit history, and block README-button ZIP downloads where policy allows.

[UPDATE] Citrix urges immediate patching of CVE-2026-107406, a new CVSS 9.5 memory-overflow RCE in NetScaler ADC and Gateway affecting appliances configured as SAML SP or IdP and Secure Private Access Hybrid deployments, fixed in builds 14.1-73.46 and 13.1-64.29; the bulletin claims no exploitation yet, but the product line's recent CVE-2026-88771, 88772 and 88779 zero-days were hit hard in real campaigns, so treat this one as a same-day patch.

[UPDATE] The FBI and Secret Service made the FortiBleed warnings official: the campaign that began in June has harvested credentials for roughly 86,644 FortiGate firewalls and SSL VPN appliances across 194 countries per SOCRadar, and is now deleting admin accounts and changing passwords to lock defenders out. A device you cannot log into is not a device you have cleaned, so rebuild from known-good rather than negotiate with the console.

[UPDATE] The deeper cut in Cisco's October batch is five critical NX-OS flaws, CVE-2026-76471 among them, allowing unauthenticated remote code execution with root privileges on Nexus 3000 and 9000 switches in standalone mode, an escalation beyond the NGOAM trio flagged here yesterday. Data-center teams should patch before these join the scan lists, and inventory which switches even run the affected features.

[UPDATE] CVE-2026-105134, the critical unauthenticated OS command injection in Ahsay's backup suite disclosed Monday, is now exploited in the wild: Huntress documents attackers chaining AhsayCBS flaws to unauthenticated RCE with follow-on payload deployment. Exploited backup software is the classic ransomware precursor, so patch AhsayCBS and sweep your backup estate for signs of access.

[UPDATE] Attackers are exploiting CVE-2026-21589 after a public proof of concept, and Atlassian now says the CVSS 9.3 pre-authentication arbitrary file read affects all versions of eight self-hosted Data Center products, not just Bamboo; if your Data Center estate has not patched in the three days since disclosure, assume someone has walked your filesystem.

[NEW] Ransomware has crippled IDCF Cloud, the IDC Frontier cloud used by Japanese government clients, with the East Japan Region 1 disruption affecting 495 tenant organizations since the unauthorized access was first disclosed. No ransomware family has been named and IDC Frontier's incident reports are still quarterly-style updates; recovery timeline and attribution are the open questions for a provider that holds public-sector workloads.

[NEW] IBM's disclosure wave hit identity and API infrastructure at once. Verify Access carries seven CVEs, two of them CVE-2026-78401 and CVE-2026-78406, unauthenticated deserialization RCEs at CVSS 9.8 in the identity layer where session and credential visibility concentrates, and the remaining five all score 9.0 or higher. DataPower Gateway took eleven CVEs across four version lines, including two unauthenticated 9.8 RCEs such as the CVE-2026-16340 out-of-bounds write plus a 9.3 credential-stealing XSS. No exploitation is reported yet for either, so this is a race: patch the deserialization endpoints first and keep Verify Access management interfaces off broad networks until you have.

[NEW] Microsoft's October bundle carries CVE-2026-96207, a CVSS 10.0 improper certificate validation flaw in Partner Center that enables remote privilege escalation, the worst of the cycle; no in-the-wild exploitation is reported, which makes this a patch-before-scanners item rather than an incident.

[NEW] Zscaler ThreatLabz uncovered a trojanized Terraform provider attributed provisionally to TraderTraitor, also tracked as Jade Sleet and UNC4899: the provider executes malicious code the moment Terraform loads it, pulls a cross-platform Bash loader from a HashiCorp-themed lookalike domain, and on the dissected path runs FLATROOF Python data-theft scripts before the ROOFDECK backdoor, all while preserving normal Terraform behavior so a clean build proves nothing. The crypto targeting overlaps the earlier KalpDAO incident; verify provider provenance against the official registry and audit CI egress for lookalike domains during terraform apply.

[NEW] Bitdefender's Midnight Mimosa finding is firmware-grade: ad-fraud malware signed into the factory images of low-cost MediaTek Android devices, activating on first boot under package names like com.android.system.lite, surviving uninstall and holding system privileges for silent app installation and remote code loading through C2 disguised as a weather API at api.weatherlive[.]world. Thousands of devices in more than 150 countries over roughly two years, 32 payload variants and 13 related apps on Google Play; the only remediation for an affected handset is a clean re-flash or replacement, which makes firmware provenance a procurement control.

[NEW] CrowdStrike ties intrusions at seven South Korean financial institutions, Shinhan, KB Kookmin and Hana among them, to an unknown actor running ARTEX, an open source autonomous pentesting tool, with 65,000 to 68,000 people's identity-grade records taken through an authentication bypass on Shinhan's loan-facing web service. The forensic anchor came from the operator's own operational security failures: exposed Claude Code session histories and configs showing DeepSeek v4.1-flash as the primary model, and the repository gained roughly 500 stars in the six days after attribution. The binding constraint on this attack class is now the number of half-secured partner portals rather than attacker skill, so sweep web roots for the ARTEX console string, inventory for the autumn27/artex Docker image, and deny server subnets egress to LLM APIs.

[NEW] CISA's October 8 KEV update added five entries that are all about age, CVE-2015-3306 in ProFTPD 1.3.5 mod_copy, arbitrary file read and write at CVSS 10.0, the worst, alongside 2015's BIND TKEY denial of service, 2016's Struts method: prefix RCE, 2021's ONLYOFFICE upload traversal and 2023's Strapi query-filter leak, all due October 11 for federal agencies with forensic triage flags on four of the five. Machines still matching these fingerprints were never in inventory, so discovery comes before patching.

[UPDATE] Reuters confirms the Accenture contractor managing the FBI's breached PeopleSoft HR platform has been removed from the bureau, after the contractor failed to apply a security patch explicitly issued for the system ShinyHunters went on to exploit.

[NEW] ASOS has tied its breach to social engineering that stole credentials for a third-party marketing tool with access to internal systems, converting last week's incident, in which hackers messaged users directly, from mystery into the standard vendor-access pattern; affected-account counts and leak-forum activity are still open.

[NEW] The long tail of 2024's marketplace takedowns keeps producing sentences: Ardit Kutleshi, who ran the Rydox marketplace with roughly 18,000 users and more than 321,000 stolen-data listings, pleaded guilty in a US court to identity theft and money laundering conspiracy charges and faces up to 22 years at his February 9, 2027 sentencing.

Watchlist: whether the FakeGit count climbs past 17,610 and whether AI registries purge agentbaited entries; KEV additions or mass-scan telemetry against the new NetScaler SAML RCE and IBM's Verify Access and DataPower criticals; AhsayCBS exploitation spreading beyond the first victims; ARTEX artifacts surfacing in intrusions outside South Korea; and the first named organizations among FortiBleed's 86,644 locked-out device owners.

Generated by zai/glm-5.3-flash. Input tokens: 74,862, output tokens: 33,325, cache read: 1,278,272, cache write: 0.