Microsoft said in its Windows message center on 8 October 2026 that certificates used to make trusted connections to Windows Update expire on 17 May 2027 and 19 June 2027, and that devices must hold the replacement certificates to keep receiving updates after those dates. Windows 11 25H2 and later need no action. Windows 11 24H2 and Windows Server 2025 need the September 2025 security update or later before 19 June 2027. Other supported Windows 11 releases, Windows Server 2022 and supported Windows 10 versions need the July 2026 security update or later before 19 June 2027. Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 need the July 2026 update or later before 17 May 2027. Any other (unsupported) Windows version must be upgraded, or it will lose access to Windows Update. Devices that get updates through Windows Server Update Services (WSUS) are not affected by this change. Microsoft advises identifying old or unsupported devices now and planning upgrades before the deadlines. Primary: Microsoft Windows message center; wire: BleepingComputer.
Microsoft Learn — Windows message center: Prepare for Windows Update certificate rotation in 2027 (8 Oct 2026)
Searchlight Cyber disclosed on 8 October 2026 a flaw in GoBalance, a Go rewrite of Tor's Onionbalance load balancer that ships with the EndGame anti-DDoS toolkit used by many dark-web sites. A Tor ed25519 private key is 64 bytes, but GoBalance passed only the first 32 bytes to the signer, dropping the half that keeps each signature's secret nonce hidden; the nonce becomes computable, so one published service descriptor is enough to recover the site's long-term master key and sign valid descriptors for its .onion address. Taking over the address lets an attacker redirect visitors to a copy of the site, but does not give access to its servers or data. Only sites whose master key is stored in Tor's own key format are exposed; keys written by GoBalance's setup tool use a safer format, and the original Onionbalance and Tor itself are not affected. Between 5 and 7 October both onion addresses of the Dread forum were hijacked and pointed at a rival site, Conclave; Searchlight says the second takeover is the stronger sign the flaw was used, while the first may have been a separate key leak. Dread has moved to a new address, and the Omega market said on 8 October that it also moved because of the bug. There was no official fix or CVE as of 9 October; a community patch has been published. For defenders and investigators, the lesson is that onion addresses seen in threat intelligence can change hands without the original operators. Primary: Searchlight Cyber; wire: The Hacker News.
Searchlight Cyber — Leaking the keys to the kingdom: how a single slip handed over a darknet empire (8 Oct 2026)
VirusTotal announced on 8 October 2026 that it now scans the public IPv4 space daily and records open, closed and recently closed ports with service names, software versions, banners, HTTP headers, SSH host keys, RDP fingerprints, JARM and inferred operating system, alongside its existing IP intelligence. The data appears in a new Ports tab and can be searched in the web UI and API with modifiers such as open_port, port_service_product[80] and fingerprint, combined with asn, country, ssl_subject, threat_actor and collection. VirusTotal's worked example started from an IP in its APT28 and Havoc C2 collections and used a shared SSH host key and an unusual certificate name to find two related hosts with no detections at all. VirusTotal warns that an open port on its own is a weak signal (a Cobalt Strike default-port search returned more than 1.5 million IPs), that reused cloud images share SSH keys across many unrelated hosts, and that old malware links do not prove current ownership or attribution. Primary: VirusTotal blog; wire: Cyber Security News.
VirusTotal blog — Internet scanning in VT (Oct 2026)
On 8 October 2026 Zscaler ThreatLabz said it had found another new installer for the Anatsa (TeaBot) Android banking trojan distributed through the Google Play Store, disguised as a PDF reader with more than 10,000 installs, and published the Play Store listing and indicators (installer and payload hashes, command-and-control addresses) in its alert. Anatsa uses a dropper model: the harmless-looking app is installed first, then downloads the banking payload, often presented as an app update, and overlays fake login screens to steal banking credentials. The install figure is for the dropper app, not confirmed infections; the alert does not name targeted banks or countries, or say whether Google has removed the listing. Earlier ThreatLabz analysis documented Anatsa using environment checks and malformed APK archives to avoid analysis. Primary: Zscaler ThreatLabz (X); wire: Cyber Security News.
Zscaler ThreatLabz on X — new Anatsa installer on Google Play disguised as a PDF reader (8 Oct 2026)
On 8 October 2026 Anthropic announced the Anthropic Cyber Mission, which it describes as a long-term effort to give defenders tools, research and funding, starting with critical infrastructure and open-source software. The Critical Infrastructure Defense Program puts frontier Claude models, on-site Anthropic engineers and threat research with trusted providers that secure operational technology (power, water, factories, transport). Founding partners: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation; Anthropic says it is starting with a small cohort. OSS Scanner is an opt-in service, modelled on Google's OSS-Fuzz, that periodically scans enrolled open-source projects free of charge. Each report includes a proof of concept, an explanation and a suggested fix where available; reports are model-generated and sent without human review, so some will be wrong (for example severity), and Anthropic says it expects a true-positive rate above 90%. Anthropic also cites funding for the Python Software Foundation, Alpha-Omega and OpenSSF (Linux Foundation) and the Apache Software Foundation, and says the Defender Advantage Fund keeps OSS Scanner free. It builds on the Project Glasswing lesson that finding bugs is now easy but verifying, prioritising and fixing them is slow. Distinct from the desk card on the expanded Cyber Verification Program tiers (anthropic-cvp-tiers-20261006). Primary: Anthropic; wire: Cyber Security News.
Anthropic — Introducing the Anthropic Cyber Mission (8 Oct 2026)
Bitdefender Labs (8 October 2026) describes Midnight Mimosa, malware preinstalled in the firmware of low-cost multi-brand Android phones built on MediaTek platforms so it is present before first boot and cannot be removed through normal uninstall. Platform-signed system packages (including com.android.system.lite, com.android.sys.prot, com.android.sys.gmsprot and related names) run as system, silently install and remove apps, grant permissions and load remote code. Cover apps (weather, app-lock, notes, OCR) drive ad and click fraud; the same framework can enrol devices as residential-proxy botnet nodes. Bitdefender observed thousands of devices across more than 150 countries over about two years, with the largest shares in Mexico, France and Italy, then the United States, Germany, Brazil and Spain. Model names associated with Doogee S200 X and Cubot KINGKONG X appear, as do phones impersonating major brands. Some affected firmware was signed with certificates bearing the name Shenzhen Zediel; Bitdefender does not claim that company knowingly planted the malware. Thirteen Google Play apps talking to the same C2 infrastructure were also found. Cleaning typically needs firmware replacement or ADB disable — unrealistic for most owners. Primary: Bitdefender Labs; wire: BleepingComputer.
Bitdefender Labs — The phone was compromised before the user turned it on: Midnight Mimosa (8 Oct 2026)
On 8 October 2026, CISA, FBI, NSA and international partners including Australia's ACSC published joint Cybersecurity Advisory AA26-281A on China-linked threat actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with government links that builds or acquires cyber tools, hosts infrastructure and compromises networks. Observed TTPs are consistent with activity tracked as Flax Typhoon, Ethereal Panda and Red Juliett (vendor names may not map 1:1). Actors combine automated scanning (including MicroScan with 1,300+ scripts), large IoT botnets, password spraying against Microsoft 365/Exchange, VPN persistence and hands-on exploitation to steal email and credentials, and have run a portal giving third parties access to stolen mail. Same day, the US Justice Department and FBI announced court-authorised seizures of seven domains used for MicroScan and FishHub spear-phishing/malware delivery; scanning targets cited in court papers include a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms and universities. Integrity Tech was previously sanctioned by the US (Jan 2025) and UK (Dec 2025); a 2024 FBI action disrupted its Raptor Train botnet. Mitigations in the advisory include disabling unused services/ports, sanitising web inputs, MFA everywhere, and timely patching of listed n-day flaws. Primary: CISA AA26-281A (ACSC co-author); DOJ seizure PR; wire: BleepingComputer / The Hacker News. UPDATE (11 Oct): Australia is not among the victim locations the advisory names (it lists US government, critical manufacturing, healthcare and IT organisations, plus victims in Southeast Asia, Africa and North America), but an ASD spokesperson told iTnews that "the vulnerabilities, tactics, techniques and procedures outlined in this advisory are applicable to Australian entities" and urged organisations to mitigate the threat. The other co-sealing agencies are from the UK, Canada, Japan, New Zealand and Spain. The advisory also notes that the FBI recovered an archived email database stolen from government, law enforcement, healthcare and religious organisations in Southeast Asia, with access in some cases restricted to IP addresses in Xiamen, China; about 20 Taiwanese universities were confirmed FishHub victims; and the actors used a tool called DC.exe to run DCSync against domain controllers. Watch for unexpected Active Directory replication and replace end-of-life edge products. Source: iTnews (12 Oct AEDT), quoting ASD.
CISA — AA26-281A: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools (8 Oct 2026; ACSC co-author)
IDC Frontier (IDCF), a SoftBank Group subsidiary that runs the IDCF Cloud IaaS platform, said a third-party ransomware attack caused a disruption in East Japan Region 1 from about 3:40am JST on 7 October 2026. Its third notice (8 Oct) says 495 corporate and municipal customers were affected. Impacted zones named: tesla, henry, pascal and joule. Effects included virtual servers stopping and not restarting. IDCF isolated East Japan Region 1, stopped the management console across regions while it checked safety, and is working with an external security firm to find and block the intrusion path. For the four named zones it says customer data is difficult to retrieve or restore and that recovery currently depends on customers' own backups; it is guiding those customers to rebuild in a separate environment. Other East Japan 1 zones and other regions had no confirmed unauthorised access at the time of the notice, but customers were told to take their own backups. IDCF has reported to regulators and the Tokyo Metropolitan Police. Wire coverage (BleepingComputer, NHK, Mainichi) notes knock-on outages including Nissui logistics shipping and Ibaraki prefectural and police websites; IDCF has not itself confirmed every downstream victim in the notice. Threat-actor social posts claiming encrypted databases and hypervisors are unverified by IDCF. Primary: IDC Frontier notice 20261008001; wire: BleepingComputer.
IDC Frontier — Notice 3: unauthorised access / disruption on part of IDCF Cloud (8 Oct 2026, Japanese)
Citrix Security Bulletin CTX697191 (published 8 October 2026) assigns CVE-2026-107406 to a memory-overflow flaw (CWE-119) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a SAML service provider or identity provider. CVSS v4.0 base 9.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L). Successful abuse can lead to remote code execution or denial of service. Exposure is version-specific: builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 (and matching FIPS/NDcPP ranges) are affected only as SAML IdP; older supported builds before those floors are affected as either SAML SP or IdP. Citrix urges upgrades to 14.1-73.46 or later, 13.1-64.29 or later, 14.1-73.46 FIPS or later, and 13.1-37.283 or later for 13.1-FIPS/NDcPP. Secure Private Access Hybrid deployments that use affected NetScaler instances also need the upgrade. Customer-managed appliances only; Citrix-managed cloud and Adaptive Authentication are updated by Citrix. Check config for add authentication samlAction (SP) or add authentication samlIdPProfile (IdP). Citrix said it was not aware of unmitigated exploits at publication. Distinct from earlier SAML DoS CVE-2026-88779 (desk card citrix-netscaler-saml-acsc-20261003). Primary: Citrix CTX697191; wire: Cyber Security News.
BleepingComputer reported on 8 October 2026 that Jonathan Spalletta, 36, of Maryland (online 'Jspalletta' and 'Cthulhon'), has been found guilty of computer fraud and money laundering over the April 2021 hacks of Uranium Finance, an automated market maker on BNB Chain. In the first attack on 8 April 2021 he drained about US$1.4 million by abusing a smart-contract flaw with zero-token withdrawals, then pressured Uranium into a sham 'bug bounty' of nearly US$386,000. About three weeks later he exploited a second coding error, where transaction checks used 1,000 instead of 10,000, to withdraw nearly 90% of the liquidity pools, about US$53.3 million in total, and Uranium closed. Prosecutors say he laundered the funds through Tornado Cash and decentralised exchanges and bought rare collectibles, including Magic: The Gathering packs and a Black Lotus card, a first-edition Pokémon base set and a Roman coin. Agents seized the collectibles in February 2025 and recovered about US$31 million in crypto. He surrendered on 30 March and faces up to 10 years for computer fraud and 20 years for money laundering. Source: BleepingComputer, quoting the US Attorney's office.
BleepingComputer — Uranium crypto exchange hacker convicted for stealing $53 million (8 Oct 2026)
A territory-wide technical network outage knocked out telecommunications and digital systems across key Northern Territory government departments and agencies on 8 October 2026, including Police, Health and Education. It began at about 3am NT time (4.30am Sydney) and was resolved about 12 hours later through what the government called undisclosed workarounds by the Department of Corporate and Digital Development (DCDD). NT Police, Fire and Emergency Services issued a public advisory that non-emergency communications, including police assistance lines and phone lines to local police stations, were affected, while triple zero (000) stayed up and all Territory hospitals kept providing patient care. Other agencies reported problems with phone lines, email and network-connected servers. DCDD says it is still investigating the root cause and how to prevent a repeat; the government has not said what caused the outage, and nothing published so far points to a cyber attack. Primary: NT Police, Fire and Emergency Services public advisory; wire: iTnews. UPDATE (23 Oct 2026): iTnews (8 Oct), citing ABC News (8 Oct), reported that the problem was linked to a gateway in the core network, and that three calls were missed during the outage, although checks found they were routine police follow-ups rather than emergencies, which qualifies the government's line that triple zero kept working throughout. DCDD's root-cause review is still open.
NT Police, Fire and Emergency Services — Public advisory: technical network outage affecting non-emergency communications (8 Oct 2026)
Microsoft has added two Teams meeting features to the Microsoft 365 Roadmap, BleepingComputer reported on 8 October 2026. The first lets organisations plug in certified third-party tools that analyse meeting audio and video for signs of synthetic or manipulated media and send detection signals into Teams, which will surface them in the meeting with related controls. The second, impersonation protection, warns users and shows risk indicators when Teams detects that a meeting organiser or participant may be pretending to be someone else. Both are in development, with a worldwide rollout and general availability planned for November. They follow other Teams anti-abuse changes: admins locking out external users through the Defender portal, blurring of QR codes from external senders, a meeting policy that blocks identified external bots, and reporting of suspicious guest invitations from November. The deepfake feature depends on buying a supported third-party provider; Microsoft has not named providers or prices. Source: BleepingComputer, citing Microsoft 365 Roadmap entries.
BleepingComputer — Microsoft Teams to get support for third-party deepfake detection tools (8 Oct 2026)
