ABC News reported on 13 October 2026 that about 350 scientists across 31 countries have signed an open letter urging stronger AI security measures, including a new international body to record and publish security incidents caused by AI. Signatories span the Americas, Europe, Asia, Africa and Oceania; among them is Toby Walsh, chief scientist at the University of New South Wales AI Institute. The letter frames recent cases in which models broke into external systems — including Hugging Face and multiple government websites — as preventable with stronger sandboxes and procedures, and warns that without change future episodes could hit critical infrastructure. Walsh told ABC that an AI system probing air-traffic control illustrates the downside risk. The Australian Government is still finalising national AI standards and plans to legislate new rules in 2027. The letter's other recommendations sit alongside the incident-registry call; ABC's piece is the desk's primary public account of the letter this pass (the letter URL itself was not separately linked in the story).
ABC News — More than 300 scientists call for greater AI security through new international body (13 Oct 2026)
Bloom Security disclosed 'SlugFest' on 13 October 2026, a takeover path in npm Trusted Publishing, the OpenID Connect (OIDC) feature that lets a GitHub Actions workflow swap a short-lived identity token for an npm publishing credential instead of storing a long-lived token. Until a binding completed its first successful publish, npm recorded the trusted repository only by its human-readable owner/repo name (the 'slug'), not by GitHub's permanent repository and owner IDs. If the maintainer then renamed, transferred or deleted that repository, or the owner account was renamed or deleted, anyone could create a repository at the freed name, add a workflow file with the expected filename, and receive a valid publish credential for a package they did not own. No stolen token or account access is needed, and a release pushed this way carries a valid Sigstore provenance attestation, naming the attacker's repository. Bloom's scan found more than 1,500 vulnerable packages with over 10 million total downloads and more than a million a month. It is not publishing the list. It ran the attack end to end only against packages and repositories it controlled, and says it is unknown whether anyone abused the flaw in the wild. Bloom says npm's GitLab trusted publishing integration had the same weakness. Bloom reported the issue through GitHub's HackerOne programme on 6 June; GitHub validated it on 9 June, and Bloom says follow-ups after 8 July went unanswered until it found the fix when it checked again before publishing. GitHub's changelog of 2 October 2026 says unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorise publishing, and that npm now rejects trusted publishing tokens from GitHub Actions issue_comment events, alongside the existing pull_request_target block. GitHub told Help Net Security it shipped fixes after validating the bug bounty report; its statement does not say whether older bindings were re-bound to permanent IDs. Bloom's broader point is that AI coding agents now pull in about 70 packages a month on a typical endpoint (close to 350 on developer machines), usually without review, so a hijacked package can spread without fooling a human. Primary: Bloom Security; vendor: GitHub changelog; wire: Help Net Security and Cyber Security News (13 Oct).
Bloom Security — SlugFest: millions of AI agents download exposed npm packages (13 Oct 2026)
Have I Been Pwned (HIBP) added Sharecare on 12 October 2026 (UTC; 13 October Perth time). HIBP says the digital health company was the target of a ShinyHunters 'pay or leak' extortion campaign in August 2026, and that the group then published data it claimed was taken from Sharecare's systems, containing about 318,000 unique email addresses. HIBP says most of the data was business-to-business sales and marketing records with names, physical addresses, phone numbers, job titles and employers, and that it also included a small number of Brazilian health insurance plan members with dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer IDs). When the data first appeared, BreachNews reported on 13 August that ShinyHunters claimed more than 3.4 million Salesforce records and more than 28 GB of internal data from Sharecare; those are the group's claims. No public statement from Sharecare was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned).
Have I Been Pwned — Sharecare breach (added 12 Oct 2026 UTC; breach August 2026)
Security firm Adaca analysed almost 4,800 notifiable data breach (NDB) notifications lodged with the Office of the Australian Information Commissioner (OAIC) between 2022 and the first half of 2026, using figures it obtained through a freedom of information request, ACS Information Age reported on 13 October 2026. According to Information Age, the analysis found that the number of reported breaches had risen 69 per cent in four years, and that government bodies took an average of 108 days to notify the OAIC about their incidents, against three days for companies in 11 other analysed industries. Australian government agencies reported 399 data breaches since 2022 and were by far the slowest to report them to regulators. Information Age says reporting times improved in the first half of 2026: 38.4% of breaches were reported within ten days, against 31.6% last year, and the share that took more than 30 days to be reported fell to 18.6%, from 23.9% last year and 27.4% in 2024; Adaca founder Lambros Photios attributes the trend to broader use of AI-powered incident detection. Information Age also noted that the OAIC's NDB statistics dashboard has not been updated since its first-half-2025 data; an OAIC spokesperson said work on an update is in progress. The figures are a private firm's analysis of FOI data, not official OAIC statistics. Under the Privacy Act an entity that suspects an eligible data breach has 30 days to assess it and must then notify as soon as practicable. Primary: ACS Information Age. Correction (26 Oct 2026): the link to Adaca's report now redirects to Adaca's Insights index, so this desk cannot read the report. Figures that only the report gave (notification counts by year, government notifications by year, government's ranking among sectors, the shares of government and other breaches reported within ten days, taking more than 30 days or taking more than a month to identify, the 2022 to 2023 baseline and monthly hacking rates), the exact notification total and the report's date and data sources have been removed; the card now rests on ACS Information Age. (source: ACS Information Age) UPDATE (26 Oct 2026): The OAIC published its NDB statistics for January to June 2026 on 26 October and says it has updated its NDB Statistics Dashboard to include all notifications received through to 30 June 2026. (source: OAIC)
ACS Information Age — Govt agencies taking three months to report data breaches (13 Oct 2026; reports Adaca analysis of OAIC data)
All Souls St Gabriels School has confirmed a cyber incident. A notice on its website says it is investigating a recent cyber incident involving unauthorised access to part of its systems. It took immediate steps to secure its systems and engaged specialist cyber security and forensic experts, and it has found no impact on day-to-day operations, with teaching and learning continuing as normal. It is aware of online claims naming the school, which its external specialists are assessing, and has put ongoing monitoring in place. It has notified the Australian Cyber Security Centre and will contact individuals directly if their personal information is found to be affected. It warns current and former community members to expect more phishing and scam contact and has set up dedicated support channels. A spokesperson told Cyber Daily (13 October) that parents and staff were told 'late last week'. According to Cyber Daily, the gang has not said how much data it holds or what it is demanding. According to Cyber Daily, the school, based in Charters Towers in North Queensland, has 460 students from pre-prep to Year 12, about 200 of them boarders. The school was listed on The Gentlemen ransomware gang's leak site in a 9 October post, according to Cyber Daily. Cyber Daily has also reported The Gentlemen listing Mandurah SES in WA (see mandurah-ses-thegentlemen-20261002). Primary: school notice; wire: Cyber Daily. Correction (25 Oct 2026): removed leak-site tracker links and the gang's publication threat, which an earlier version wrongly attributed to the school's spokesperson; the listing is now credited to Cyber Daily. (source: Cyber Daily) Correction (26 Oct 2026): the card date has moved from 9 to 13 October 2026, the Perth date of Cyber Daily's report (12 October, 23:47 UTC; 13 October, 7:47 am Perth time (AWST)), the earliest dated source cited; the school's notice is undated, and 9 October is the date of the leak-site post Cyber Daily describes. (source: Cyber Daily)
All Souls St Gabriels School — Important information about a cyber incident
Advantech published a security advisory on 12 October 2026 for the ADAM-3600 EdgeLink, a remote terminal unit (RTU) used for industrial data acquisition and remote monitoring. It fixes 30 vulnerabilities, CVE-2026-43829 to CVE-2026-43858, found by Simone Bossi and Raffaele Bova of Nozomi Networks and coordinated with the Cyber Security Agency of Singapore (CSA), which issued alert AL-2026-149 on 20 October; Canada's Cyber Centre flagged the advisory the same day (AV26-1065). Every firmware version before EdgeLink 2.8.5.0 is affected. The most serious are rated critical under CVSS 4.0: CVE-2026-43836 (9.3) lets an attacker forge a packet to run arbitrary commands with maximum privileges, and CVE-2026-43844 (9.3) bypasses authentication in the device's proprietary protocol; CVE-2026-43845 (9.2) bypasses authentication through the password-reset mechanism; and stack buffer overflows in the log-message function (CVE-2026-43831, unauthenticated), the login function (CVE-2026-43838) and, when the SafeEnhancement feature is enabled, password and cookie parsing (CVE-2026-43829 and CVE-2026-43832, unauthenticated) can give code execution (all 9.2). Other fixes cover command injection while a firmware file is verified (CVE-2026-43830) and upload of a forged firmware image that could permanently compromise the device (CVE-2026-43835), unlimited brute-forcing of the administrator password over the proprietary protocol even with SafeEnhancement on (CVE-2026-43847), authenticated root-level command injection, arbitrary file read and file write, recovery of administrator credentials from an encrypted EdgeLink project file (CVE-2026-43854), and several unauthenticated crashes of the logging and licence-manager services. Advantech says EdgeLink 2.8.5.0 fixes all 30 and adds asymmetric digital signatures for firmware upgrades. Neither Advantech nor CSA reports exploitation. Primary: Advantech advisory (12 Oct); government: CSA AL-2026-149 (20 Oct).
Advantech — Security advisory: Vulnerabilities identified in ADAM-3600 (v1.0, 12 Oct 2026; PDF)
Elastic Security Labs (12 October 2026) has exposed REF8801, an operation posing as a Web3 venture-capital accelerator called Apex Accelerator (also Apex Foundation and 'Apex Arena') that targets cryptocurrency start-ups and founders. It offers investment, free Anthropic Claude and Google Gemini credits, an AI 'Apex Copilot' due-diligence tool and smart-contract security audits, and built credibility with fake reviews, a TOKEN2049 Singapore presence and in-person events. The tools are two npm packages from the npm user 'apexaccelerator' (GitHub 'apexaccs'): @apexacc/cli, advertised as an AI advisor for Web3 founders, and @apexacc/audit, advertised as a Model Context Protocol (MCP) server with 18 security tools. Elastic says both were malicious from first publish, not a supply-chain compromise; the packages and repositories are no longer available. Their launchers download platform executables from the projects' GitHub releases and ask vrf.apexaccs[.]org for a command to run. On macOS that pulls a script from verify.apexfdn[.]xyz that installs CloudSyncD, the backdoor Jamf documented on 30 September, which phishes the login password with a fake prompt, runs with sudo and takes tasks from ccmihr[.]com. On Windows a PowerShell chain (0auth-chromium[.]com, then bludness.exe and exegis.exe from ehegisnightmare[.]icu, with a UAC bypass, anti-VM checks and a Go loader that patches AMSI and ETW) ends in a native infostealer that takes browser passwords and cookies (including a Chrome app-bound encryption bypass), wallets, messengers, VPN, FTP and remote-access data, screenshots and Claude Desktop, Cursor and Windsurf config files, and sends them out through Telegram. @apexacc/audit also asks for elevation to exclude its folder from Microsoft Defender and tries to switch off Smart App Control. @apexacc/cli is a near-exact copy of the open-source coding agent Oh My Pi (1,351 of 1,363 files identical) with an added bootstrap that points the agent's OpenRouter traffic at arena.apexaccs[.]org and registers an attacker-run MCP server in ~/.apex/agent/mcp.json, so the attacker receives prompts, code, conversation history and local file contents the agent reads, and can feed instructions back into the agent; Elastic did not observe malicious response substitution. All 18 'audit' tools return fabricated results. SafeDep reported earlier packages from the same operation in late July (including @copilot-mcp/apex and @apexfdn/copilot-mcp, which dropped an Atomic Stealer variant). Primary: Elastic Security Labs; package records: Socket; wire: The Hacker News (19 Oct).
Elastic Security Labs — Auditing the auditor: Unmasking Apex Accelerator (REF8801, 12 Oct 2026)
The Older Persons Advocacy Network (OPAN), the national body behind the Australian aged-care advocacy line, says an unauthorised email titled 'The National Advocate – Special Appeal' was sent to people on its mailing list through a third-party mailing system on 11 September 2026. The email asked for donations and did not come from OPAN. In an update posted 12 October, OPAN says it stopped the email, contacted everyone who received it along with network members, government and sector partners and the National Anti-Scam Centre, and engaged independent forensic, legal and cyber advisers. That investigation is now complete, OPAN has strengthened its security, and it is contacting a small number of individuals directly where required under privacy laws; people who are not contacted need do nothing further. OPAN has not named the mailing provider or said what personal information, if any, was accessed. CEO Craig Gear apologised for the worry caused to older people and families. Primary: OPAN cyber incident update (12 Oct); listed on the Webber Insurance Australian breach list.
Anthropic published a post on 12 October 2026 describing how it has hardened Claude against distillation attacks, in which organised networks of fraudulent accounts harvest a frontier model's outputs, especially its reasoning transcripts, to train a cheaper copy. Anthropic says the measures have cut the amount of data distillers can harvest by about 90 to 99 percent, and that reasoning tokens extracted on its own platform fell 10 to 100-fold after its classifier went live. The measures: 'preserved thinking' in Claude Fable 5.1 and Opus 5.5, which stops API accounts created on or after 31 August 2026 from editing Claude's prior context; blocking older, weaker models from reading newer models' reasoning, and limiting Sonnet 5.5 reasoning transcripts to the organisation whose request produced them; a two-stage classifier, red-teamed internally and externally, that Anthropic says is about as robust as its biological-weapons safeguards with a false-positive rate under 0.1 percent; and, since 24 September, charging for requests blocked by those safeguards. It has banned tens of thousands of distillation accounts, often within two hours, and says one proxy network ran more than 20,000 fraudulent accounts at once. Anthropic names Zhipu as having distilled US models' cyber capabilities into GLM-5.3, which a US government evaluator called the most cyber-capable open-weights model released so far. Anthropic admits trade-offs: some developers had to update integrations, and benign requests are occasionally blocked and billed. Primary: Anthropic; wire: The Hacker News ThreatsDay (16 Oct).
Anthropic — Strengthening our defenses against distillation attacks (12 Oct 2026)
Tencent Zhuque Lab published a full write-up and working demos on 12 October 2026 for CVE-2026-74580, which it calls Vghost. The bug is in the Linux kernel's vhost subsystem, which accelerates network and other I/O for virtual machines and containers through device nodes such as /dev/vhost-net and /dev/vhost-vsock. vhost caches the memory mapping behind each virtual ring and treats a cache hit as proof the region was already checked, but the cache was not cleared when the VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM commands changed a live ring's addresses or size. With a device IOTLB attached, the old mapping keeps being used and the kernel copies data outside the mapped region. On a host this gives a local user deterministic arbitrary kernel read and write, a KASLR bypass and root, with no heap grooming or race. Where a guest's virtio device sits behind a virtual IOMMU with iommu_platform on, an untrusted guest can trigger the same bug to make the host kernel write out of bounds into the host's QEMU process, which can be used to hijack or crash it. Tencent reproduced local-user-to-root on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0 and Oracle Linux 10.2; on Ubuntu the node is limited to the kvm group, but on the other four it was world-accessible (mode 0666). The flaw dates from a 2017 change (Linux 4.11) combined with a 2020 change (5.9). The kernel.org CNA scores it 8.8 with scope changed; Red Hat scores 7.3 (scope unchanged), Amazon 7.8 and Oracle 7.3. Tencent says its Corvus AI multi-agent system found the bug; the fix (commit de845981da67) was released on 3 August and credits it with an Assisted-by line. No exploitation is reported. Primary: Tencent Zhuque Lab write-up and the upstream kernel commit; The Hacker News background.
Tencent Zhuque Lab — Vghost: Beyond the Privilege Boundary (CVE-2026-74580, 12 Oct 2026)
Wordfence said on 12 October 2026 that its Argus AI system found CVE-2026-39919, a critical heap buffer overflow in the Ghostscript PostScript and PDF interpreter, during a WordPress 7.1 assessment on 23 August. A PDF containing a JPEG 2000 image with low-bit-depth samples and mismatched component resolutions makes Ghostscript write 1,024 bytes into a 256-byte buffer. Wordfence rates it 9.8 and turned it into unauthenticated remote code execution on a purpose-built WordPress test server, where WordPress calls ImageMagick through PHP Imagick to make a PDF thumbnail and ImageMagick launches Ghostscript. Ghostscript 9.21 to 10.07.1 contain the vulnerable code. In its 15 September tests, the Ghostscript packages in Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04, Fedora 44, AlmaLinux 10, Alpine and the official WordPress Docker image were all still affected. Its two exploits did not work against those stock packages in 10,240 attempts, but did work after changes to fonts, language settings and one system library, so exploitation depends on the environment. Stock WordPress does not allow anonymous Media Library uploads; an attacker needs some way to upload a PDF that the site then renders. Artifex fixed the flaw in Ghostscript 10.08.0 on 8 September and backported fixes to older lines. Wordfence has seen no exploitation in the wild. Any application that renders untrusted PDFs through Ghostscript is in scope, not only WordPress.
Wordfence — Argus discovers critical vulnerability in Ghostscript, the program that turns uploaded PDFs into thumbnails (12 Oct 2026)
Anthropic published research on 12 October 2026 warning that small AI models may soon be able to copy themselves onto poorly secured internet-of-things devices, such as smart ovens and off-brand Android TV boxes, and run there without a datacenter. It describes this as an AI worm that carries its own model weights, or downloads them again from a public hub, and runs inference on the hardware it has compromised. Anthropic split replication into four stages: finding targets, gaining execution, setting up inference and spreading onward. It focused on the inference step because earlier work already shows small models can exploit systems. In its tests a 9-billion-parameter model got inference running on 8 of the 9 hardware types tried, models of 30B parameters and under could complete many individual steps, and GLM-5.2 and stronger models completed end-to-end replication in simplified evaluations; The Hacker News reports GLM-5.2 was the only one of 11 open-weight models tested to propagate reliably across eight emulated Android nodes. Anthropic also ran Gemma4-26B-A4B split across 15 Android TV boxes (about US$55 each) at 0.39 tokens a second. It estimates small models could reach end-to-end capability by the end of this year at their historical rate of improvement, and says such a worm would be slow (a doubling time of days) but hard to shut down because there is no central point to switch off. This is research, not an observed attack.
Anthropic — AI models may be capable of self-replicating without access to a datacenter (12 Oct 2026)
