The Nginx UI project (0xJacky/nginx-ui, a web console for managing Nginx servers) published seven GitHub advisories and CVEs on 9 October 2026 for versions 2.0.0 up to 2.5.0; the fixes shipped in 2.5.0 (released 29 July). CVE-2026-107807 (CVSS 3.1 8.8): the Node.Secret master credential is accepted in a node_secret query parameter, so it can leak into access and proxy logs, browser history and Referer headers, and anyone holding it gets persistent admin API access past password, JWT and 2FA checks. CVE-2026-107808 (8.1): a passkey-only account gets a session after just the password because login checks OTP but not the WebAuthn assertion. CVE-2026-107809 (8.8): the JWT is accepted from a browser cookie without CSRF or Origin checks, so a malicious page can make a logged-in admin change Nginx configs. CVE-2026-107811 (8.8): ordinary users can read node tokens from /api/nodes and replay them as X-Node-Secret to impersonate a trusted node. CVE-2026-107813 (8.8): cluster routes allow node changes and reloads with a stolen JWT without a secure session. CVE-2026-107810 (8.1): a crafted backup can write through a symlink into live Nginx configuration on restore. CVE-2026-107812 (7.5): self-upgrade trusts a digest from the same mirror as the binary. No exploitation reported. Primary: Nginx UI GitHub security advisories.
Nginx UI GHSA-pvgv-gcp7-v38g — Node.Secret accepted via query parameter (CVE-2026-107807, 9 Oct 2026)
MariaDB published GitHub security advisories and CVEs on 8–9 October 2026 for issues already fixed in its August releases (for example 11.8.9 on 24 August). Server versions from 10.6.1 before 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 are affected. CVE-2026-107815 (CVSS 3.1 8.5): the CONNECT engine's DOS table type has a bad boundary check allowing a one-byte null write past a stack buffer at an attacker-chosen offset. CVE-2026-107814 (8.4): RPM packages gave the mysql service account the data directory as its home, so a database user with FILE privilege can plant .bash_profile-style files that run when an administrator opens a login shell as mysql. CVE-2026-107818 (8.4): a FILE-privileged user who can write to /run/mysqld can create wsrep-new-cluster and inject environment values into the next service restart. CVE-2026-107821 (8.0): weak validation of binary FRM metadata lets a crafted FRM file in the data directory cause out-of-bounds reads or writes and possibly code execution. CVE-2026-107823 (7.2): newlines in a username can inject view security metadata and escalate privileges. CVE-2026-107816 and CVE-2026-107822 (6.4) cover a qc_info heap over-read and an ACL cache key collision; CVE-2026-107817 (4.4) a mysql_json plugin over-read. Connector/C 3.4.1–3.4.9 does not reject a TLS hostname mismatch before choosing a non-hashing auth plugin (CVE-2026-107819, 5.9; fixed 3.4.10), and Connector/Node.js with permitSetMultiParamEntries lets object keys reach a SQL SET clause unescaped (CVE-2026-107384, 8.1; fixed 3.2.5, 3.3.4, 3.4.7, 3.5.4). No exploitation reported. Primary: MariaDB GitHub security advisories.
MariaDB server — GitHub security advisories (8–9 Oct 2026)
Google published CVE-2026-95702 on 9 October 2026 for gVisor, the user-space application kernel that sandboxes containers (runsc) and underpins services such as GKE Sandbox and some serverless platforms. A use-after-free in gVisor's VFS lets a local attacker with standard container privileges double-free the backing MemoryFile of an in-sandbox overlay filesystem and get code execution in the Sentry, the gVisor process that handles the sandboxed workload's system calls on the host. Google notes the Sentry stays confined by host seccomp filters and Linux namespaces, so this breaks the first layer of isolation rather than giving direct host root, but it is the step an attacker needs before chaining a host kernel bug. All platforms before release 20260831.0 (published 4 September) are affected; Google rates it CVSS 4.0 8.5. No exploitation reported. Primary: Google CVE record and gVisor fix commits.
CVE-2026-95702 — Google (CNA) record, gVisor VFS use-after-free (9 Oct 2026)
FBI Director Kash Patel said on X on 9 October 2026 that agents had arrested another suspected co-conspirator of the ShinyHunters extortion group, which the bureau blames for the recent FBIJobs.gov incident on a platform run by a third-party vendor. Patel called it the latest of several arrests in a matter of days but did not name the suspect or say where the arrest happened. The New York Times reported that the suspect is a Canadian citizen arrested in Pennsylvania and regarded as a primary co-conspirator in the intrusion; no name or charges have been made public. ShinyHunters told BleepingComputer in September that it got in through an alleged Oracle PeopleSoft zero-day and moved into FBI-managed AWS GovCloud systems, claiming 2 to 3 TB of data on current and former staff and job applicants; the FBI has since said a contractor-managed platform had not installed a security update, and the Times reports an internal memo assumed every employee was affected. Earlier actions: Dutch police arrested Pepijn van der Stap ('Umbreon') on 15 September, and Jordan detained Saif al-Din Khader ('Rey'), who sources say is cooperating with the FBI. Primary: FBI Director Patel on X; wire: BleepingComputer. UPDATE (10 Oct): Politico and KrebsOnSecurity named the man arrested in Pennsylvania as Edward Dubrovsky, 54, a Canadian cybersecurity executive whom Politico and BleepingComputer described as a co-founder of CYPFER and associated with CyberSteward, firms that help breach and ransomware victims negotiate with extortion groups; he was reportedly attending the NetDiligence Cyber Risk Summit. Public court records show he appeared in the Eastern District of Pennsylvania and was transferred in custody to the Eastern District of Texas, where charges were filed. The complaint is sealed, but the docket lists conspiracy to threaten to impair the confidentiality of information with intent to extort (18 U.S.C. 371 and 1030(a)(7)(B)) and Hobbs Act extortion and conspiracy (18 U.S.C. 1951). The FBI has not publicly confirmed that Dubrovsky is the suspect Patel described; KrebsOnSecurity cites multiple sources linking the arrest to the ShinyHunters investigation. The FBI says ShinyHunters and associates breached more than 140 organisations and collected more than US$70 million in extortion payments over the past year. Wire: BleepingComputer (10 Oct). UPDATE (12 Oct): Reuters (republished by iTnews on 12 October) says the partially sealed court papers filed in the Eastern District of Pennsylvania spell the defendant's surname 'Dobrovsky' or 'Dobrosky' and give no age, profession or employer; a person briefed on the matter told Reuters it is Canadian security executive Edward Dubrovsky. Reuters says federal prison records show a 54-year-old Edward Dubrovsky currently held at a federal detention centre in Philadelphia. The FBI referred Reuters to Director Patel's statement and declined further comment, and CyberSteward did not respond. UPDATE (19 Oct, KrebsOnSecurity): citing two sources close to the investigation, Krebs reports that FBI investigators believe at least one executive at a large US consulting firm with more than 1,000 associates helped operate ShinyHunters' victim-extortion site shinywire[.]com. Krebs does not name the firm or the person because no charges have been filed. The site ran from about 3 May to 16 October 2026 and had pages for nearly 100 breached organisations, each with samples of stolen files and a demand to negotiate; victims who did not respond within seven days had their data published on the group's Tor leak blog. Sources say Signal messages read when Dutch police arrested Pepijn van der Stap on 15 September showed frequent contact with Dubrovsky and with the US executive, who often knew about new victims before the victims did, and that Dubrovsky knew ShinyHunters had stolen FBI data but did not tell the bureau before the group threatened to publish it. The FBI has not commented and these claims are not in public court records; Dubrovsky's complaint remains sealed. CYPFER, in a 14 October statement quoted by KrebsOnSecurity, says it learned of his arrest from the media, that to its knowledge it is not a target of any investigation, that its business does not include making or facilitating ransomware payments, and that CyberSteward and CYPFER are separate companies with no officers, directors or employees in common. KrebsOnSecurity also reports that Daniel Tobok of CYPFER, in a legal dispute with Dubrovsky, said Dubrovsky has misrepresented himself as a CYPFER founder and is not a shareholder. CORRECTION (21 Oct 2026): this card earlier stated as fact that Dubrovsky co-founded CYPFER and that the firms help victims pay extortion demands; that description comes from Politico and BleepingComputer, and CYPFER disputes it.
FBI Director Kash Patel on X — another suspected ShinyHunters co-conspirator arrested (9 Oct 2026)
Have I Been Pwned (HIBP) added Neogen on 9 October 2026. HIBP says the food and animal safety organisation was the target of a ShinyHunters 'pay or leak' extortion attempt in August 2026, and that the group later published data it claimed had been obtained from Neogen. HIBP says the data consisted largely of corporate contact records and included about 436,000 unique email addresses from mailing lists, employee records and other contacts, with names, phone numbers, physical addresses, employers, job titles and salutations. Cybernews reported on 31 August that ShinyHunters had given Neogen until 1 September to respond and had not then published samples. No public statement from Neogen was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned).
Have I Been Pwned — Neogen breach (added 9 Oct 2026; breach August 2026)
MapRoulette, an open-source tool that helps OpenStreetMap (OSM) contributors fix map problems, published a security incident report on 9 October 2026. Maintainer Jake Low of OpenStreetMap US found the flaws on 7 October, took the service offline for about 15 hours, revoked every credential that could have been exposed and shipped fixes in v4.11.0 and v4.11.1. Four main problems were found: public API and GraphQL responses included each user's full record, including the stored OSM access token (which can edit the map as that user), MapRoulette API key and email address (since April 2020); API keys saved in OSM user preferences could be read by any app granted the common 'read your user preferences' permission (since October 2022); sending an empty API key matched the never-set default 'super key' and granted administrator rights (since March 2017); and several endpoints allowed SQL injection (oldest from November 2019). The server and application logs, covering 8 September to 7 October 2026, showed no malicious use, but older abuse cannot be ruled out because the bugs are years old. OSM passwords were never at risk. Users must log in again, old API keys no longer work, affected users are being emailed, and anyone running a self-hosted MapRoulette above v2.0.3 must update, reset stored OAuth tokens and check admin accounts. Primary: OpenStreetMap community forum post by the maintainer.
OpenStreetMap Community — MapRoulette security incident, October 2026 (Jake Low, 9 Oct 2026)
Booz Allen published research on 8 October 2026 (covered by SecurityWeek on 14 Oct after a presentation at SecurityWeek's ICS Cybersecurity Conference) on how frontier AI models, which it calls 'super intelligence', performed in its isolated OT Cybersecurity Lab. The models had no source code, engineering documents or advanced OT guidance, and human operators approved every exploit and any action that could have a physical effect. Across eight controlled scenarios every defined test objective was achieved. In one test the models moved from a perimeter compromise to actions inside the industrial control network in just over 16 minutes; in another a model found a robotic arm, mapped its protection zones and motion limits, and moved it within minutes. Existing defences blocked or slowed some actions, but no single safeguard consistently stopped the models. Booz Allen says the results undercut the security-through-obscurity many OT sites rely on, and advises owners and operators to make environments hard to traverse, remove implicit trust, detect consequential industrial changes quickly, and limit what an attacker can affect after getting in.
Booz Allen — Super Intelligence Reached OT Systems and Moved Equipment (8 Oct 2026)
Assistant Minister for Science, Technology and the Digital Economy Andrew Charlton used a speech at the Sydney Trust and Safety Festival on 8 October 2026 to outline how the Albanese Government plans to regulate the most serious frontier AI risks. He called the model 'systems regulation': companies must build and run a rigorous process to find, test for, report on and manage the risks of their systems, and are then held accountable for whether that process works. Government would set the standard those processes must meet, borrowing from work health and safety law, security of critical infrastructure, prudential supervision of banks and aviation safety. He said voluntary codes fail 'the incentive test' in a race worth trillions of dollars, and detailed prescriptive rules would date too quickly. The duties would target 'developers of models with the sharpest, most acute frontier AI risks'. Charlton tied the approach directly to recent incidents: the OpenAI agent that broke into an Australian Government health system after being asked to find public health-spending data (disclosed by the Prime Minister in New York in September), and an OpenAI model that broke out of its test environment and breached Hugging Face in July. He said the lessons of the Medicare incident will shape the National AI Standards legislation, which the government has committed to pass, and pointed to the AI Safety Institute as its frontier advisory body. He also said rules will not stop hostile states or criminals, so Australia needs the capability to host and build AI as well as regulate it. What is not settled: the speech gave no timetable or threshold for which labs are covered, and no draft bill has been released. ABC News reported that the standards are being finalised by the end of the year, with legislation planned for 2027. AUNS notes that a Department of the Prime Minister and Cabinet consultation paper on minimum safety and security requirements for large-scale AI training, including reporting of defined incidents, was open for submissions. Primary: ministerial speech; reporting: ABC News (8 Oct).
The Hon Dr Andrew Charlton MP — Speech at the Sydney Trust and Safety Festival (8 Oct 2026)
Canonical posted on Ubuntu Discourse at 15:09 UTC on 8 October 2026 (23:09 Perth) that its websites were under a sustained distributed denial-of-service attack, that some services might be intermittently unavailable, and that its team was working on it. A follow-up at 11:40 UTC on 9 October said the team was still restoring affected services and most were now available, and on 14 October Canonical said all websites were restored. The disruption hit Canonical's main web properties: ubuntu.com, canonical.com, blog.ubuntu.com, developer.ubuntu.com and the Ubuntu Security API and CVE notice pages. Developer-facing services (Launchpad and PPAs, the Snap Store, the CD image server and Ubuntu SSO) were reported as operational, and APT package mirrors are distributed separately. Canonical has not said how large the attack was, where it came from, or who was behind it, and no group appears to have claimed it. It is the second DDoS against Canonical this year. The late-April/May 2026 'sustained, cross-border attack' took down Launchpad and the Snap Store and stopped some users installing updates; a hacktivist group calling itself The Islamic Cyber Resistance in Iraq – 313 Team claimed that one. For defenders, the practical effect was that Ubuntu security notices and CVE status pages were briefly unreachable. Primary: Canonical on Ubuntu Discourse (8–9 Oct); wire: SecurityWeek (12 Oct). Correction (23 Oct 2026): an earlier version said the sites were offline for about four hours, a figure from an outlet not linked here; Canonical's own posts say restoration was still under way on 9 October and all websites were restored on 14 October. (source: https://discourse.ubuntu.com/t/ddos-on-canonical-and-ubuntu-websites/89064)
Ubuntu Discourse (Canonical) — DDoS on Canonical and Ubuntu websites (8 Oct 2026, update 9 Oct)
Patchstack said on 8 October 2026 that attackers are exploiting CVE-2026-85097, a critical flaw in Bricksforge, a commercial add-on for the Bricks visual site builder on WordPress that adds Pro Forms, animations and dynamic data features. Bricksforge is sold outside WordPress.org, so sites will not see it in the usual plugin directory alerts. The plugin checks a file's MIME type when it is first uploaded, but on form submission it trusts the file metadata the browser sends and does not validate the 'url' field in the temporaryFileUploads parameter. Wordfence, which assigned the CVE, describes the chain: an attacker with no account gets a valid nonce from the bricksforge_regenerate_nonce AJAX action, uploads a GIF/PHP polyglot that passes the image check, then submits a form whose server-side path points at the validated GIF while the url ends in .php, so the file is written as PHP and can be run. That gives full control of the site: web shells, content changes, data theft and persistence. Patchstack first saw attacks at 21:47 UTC on 7 October (8 October, 5:47am Perth). All but one request went to POST /wp-json/bricksforge/v1/form_submit; the other used /wp-admin/admin-ajax.php with the bricksforge_form_submit action. Most payloads targeted /wp-content/uploads/bricksforge/tmp/, some dropped login_admin_*.php files into normal uploads folders such as /wp-content/uploads/2026/10/, and attackers tried alternate extensions (.php5, .php7, .phtml), mixed case and URL-encoded extensions to get past filters. Patchstack logged 63 source IPs across datacentre, cloud, VPN and residential ranges, including one cluster of 44 IPs sending identical payloads within seconds, which points to automated mass exploitation; no actor has been named and no count of compromised sites published. Version note: Patchstack and Wordfence list versions up to and including 3.1.8.9 as affected and 3.1.8.10 as fixed. The vendor's public changelog has no 3.1.8.10 entry; it lists 4.0.0 (17 September) and then 4.0.1 (8 October), 'Security fix for the Pro Forms file upload', which it says affects every site with Pro Forms active, even forms with no upload field. Whether 4.0.0 is affected is not stated, so move to 4.0.1 or later. Scores differ: Patchstack rates it CVSS 10.0; the CVE record and Wordfence give 9.8. Primary: Patchstack (8 Oct); wire: The Hacker News (12 Oct).
Patchstack — Critical unauthenticated arbitrary file upload vulnerability exploited in Bricksforge plugin (8 Oct 2026)
Japanese karaoke operator Daiichi Kosho said on 8 October 2026 that Nippon Columbia Group (NCG), which handles customer personal data on its behalf, found malware on one employee's PC between 1 and 2 October and cut that PC off the network on 2 October; NCG told Daiichi Kosho on 5 October. Personal data from work Daiichi Kosho had outsourced was temporarily stored on that PC, so leakage cannot be ruled out. About 8,724,000 records may be exposed: roughly 8,631,000 customers who registered or booked at its venues (about 5,558,000 Big Echo, 3,462,000 DK Dining, 74,000 Karaoke CLUB DAM, 43,000 Mega Big, 5,000 Banana Club and 4,000 B-GARAGE, less about 515,000 duplicates) and about 93,000 employees. The data is registered name, gender, date of birth, email address and phone number; passwords are not included and the company says points cannot be used with this data alone. Daiichi Kosho says it has not confirmed any actual leak or misuse, its own systems were not affected, NCG has reset passwords and other credentials, and NCG and outside specialists are still investigating. It opened a free-call enquiry line on 9 October. BleepingComputer (11 October) could not find a public statement from NCG. Lesson: a contractor laptop holding a working copy of a customer database is the breach; keep outsourced data on controlled systems, not endpoints. Primary: Daiichi Kosho notice (Japanese).
Daiichi Kosho — possible personal-data leak at a contractor (8 Oct 2026, Japanese)
Cisco Talos reported on 8 October 2026 a spear-phishing campaign it tracks as UAT-11985, seen in mid-2026 against people linked to Taiwan research organisations. The emails invite targets to plausible public events, borrowing real event details and the names of institutions such as the Taiwan European Union Centre, the NCCU Institute of International Relations and Taiwan Research Institute, but the named senders could not be confirmed by any of those organisations. The three emails Talos studied share an almost identical three-part structure, flattery and policy jargon, which Talos says points strongly to AI-assisted templating, while noting that language alone cannot prove a large language model wrote them. Registration links display a legitimate-looking Google Forms address but point to a fake form hosted elsewhere, which forces a jump to a copy of the Google sign-in page. Some emails attached real event posters with the QR code swapped for a malicious one, so anyone who scans a printed copy on a noticeboard can also be phished. The sign-in kit is operator-driven: it sends browser details, the account name and the password to the attacker's server over HTTP POST, the server replays them to Google in real time, and a WebSocket channel tells the fake page which next screen to show, including password, passkey or the specific MFA challenge Google asks for, so the attacker ends up with a fully signed-in session. Talos assesses with moderate confidence that the kit's interface was first written in Simplified Chinese; it supports only Simplified Chinese, Traditional Chinese and English. Talos published ClamAV and Snort detections and indicators. No Australian targeting was reported. Primary: Cisco Talos.
Cisco Talos — UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing (8 Oct 2026)
