CloudSEK published research on 5 October 2026 on a Russian-speaking affiliate of the Gentlemen ransomware group who calls himself Azazel. An exposed open directory and a misconfigured storage server revealed more than two dozen victim directories and about 6TB of stolen data from organisations in logistics, insurance, pharmaceuticals, AI, medical devices and government-adjacent services across six countries (CloudSEK does not name them), with one exfiltration still running during the investigation. Most victims were reached the same way: tokens, database credentials, API keys and SSH keys harvested from GitLab CI/CD variables and git history. One CI/CD token at a SaaS provider reached more than 150 databases, payment gateways and hundreds of repositories across more than a dozen client companies; at a platform hosting a government-linked financial registry, more than 120,000 records were taken before the attacker killed the live PostgreSQL process and deleted the production data. A separate intrusion at an AI company began with an AI medical imaging API that fetched user-supplied URLs without validation (server-side request forgery). CloudSEK found a reverse-shell handler registered as a tool in an AI coding assistant through the Model Context Protocol (MCP), and a script that used that MCP channel to confirm ransom notes had landed on six internal hosts, which it calls the first public report of MCP used this way as a criminal control channel. Azazel published victims on his own leak site, LEAKNED, and did not share proceeds with the Gentlemen operator. CloudSEK says it notified identified victims before publication. Primary: CloudSEK; wire: Cyber Security News.
CloudSEK — Caught in 4K: The Gentlemen Files (5 Oct 2026)
The US Attorney's Office for the District of New Jersey announced on 5 October 2026 that Daniel Rhyne, 59, of Kansas City, Missouri, was sentenced on 28 September to 32 months in prison. He had pleaded guilty on 1 April 2026 to extortion involving a threat to damage a protected computer and to intentionally damaging a protected computer. Rhyne was a core infrastructure engineer at a US industrial company headquartered in New Jersey. In November 2023 he used unauthorised remote desktop sessions and scheduled tasks on the domain controller to delete network administrator accounts, change passwords on other accounts and shut down servers, then on 25 November 2023 emailed staff threatening to keep shutting down servers unless he was paid about 20 bitcoin (then about US$750,000). BleepingComputer, citing the criminal complaint, reports the tasks deleted 13 domain admin accounts, reset 301 domain user passwords, and locked staff out of 254 servers and 3,284 workstations, and that the ransom email claimed backups had been deleted. Investigators traced searches for the commands he used to a hidden virtual machine and his work laptop. Primary: BleepingComputer (6 Oct) and the DOJ District of New Jersey releases.
BleepingComputer — Engineer sentenced for locking over 3,000 devices on employer network (6 Oct 2026)
Microsoft Threat Intelligence updated its CaptiveCrunch report on 5 October 2026 to say Storm-2945, which it assesses as an operational sub-cluster of Russia's Midnight Blizzard (attributed by the US and UK to the SVR), resumed the campaign on 29 September 2026. Microsoft first reported it on 31 July: since early May 2026 the group has manipulated DNS and HTTP traffic on guest Wi-Fi networks served by captive portals, mainly in hospitality, redirecting travellers to phishing pages that imitate Microsoft services, device-code phishing aimed at Microsoft Entra ID, and fake browser or operating-system updates using ClickFix-style instructions. Payloads include Go-based Windows remote access trojans such as CornFlake that steal credentials and session tokens, log keystrokes, collect files, record audio and video and give a remote shell; some landing pages also told Android users to install an APK. Microsoft says it has seen widespread compromise of such networks in several countries, and ReliaQuest has seen it at conference centres and other shared venues, with the aim of reaching corporate travellers' accounts. The update says the return fits Black Lotus Labs reporting that several hospitality managed service providers are implicated, that continued access to those providers likely allowed the fast redeployment, and that infostealer deliveries now use a Rust variant of CornFlake consistent with AI-assisted malware development. Microsoft added fresh infrastructure indicators and hunting queries and credits Google Threat Intelligence Group. Primary: Microsoft Security Blog; wire: Cybersecurity News (6 Oct).
Microsoft Security Blog — CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft (31 Jul 2026, updated 5 Oct 2026)
A group calling itself BYOD posted data to its dark web leak site that it says came from Trump Mobile, the US mobile service owned by T1 Mobile under a brand licensed from the Trump Organization. Straight Arrow News reported that the leak exposed personal data for 3,615 customers. Straight Arrow News reported on 5 October 2026 that its analysis of the data found first and last names, email addresses, phone numbers, home addresses and order details. Straight Arrow says one customer it called confirmed he had paid Trump Mobile a $100 deposit, several other people it contacted confirmed their exposed personal data was accurate but denied being customers, and a Trump Organization employee listed in the data confirmed he had previously used Trump Mobile. Straight Arrow says its review found no member of the Trump family among the customers, but the data includes Trump Organization CIO Eric Brunnett. Trump Mobile did not immediately respond to Straight Arrow's request for comment. UPDATE 22 Oct 2026: cut the group's unverified claims about how it got in and about continuing access; this card now keeps only what Straight Arrow News says it verified (source: Straight Arrow News, 5 Oct 2026). Correction (23 Oct 2026): the 3,615-customer figure was attributed to the BYOD group; it is Straight Arrow News's own reporting. (source: https://san.com/cc/trump-mobiles-latest-problem-hackers-just-released-customer-information/)
Straight Arrow News — Trump Mobile's latest problem: hackers just released customer information (5 Oct 2026)
Atlassian published a security advisory on 5 October 2026 for CVE-2026-21589, an arbitrary file access flaw (recorded as path traversal) in Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. An attacker with no login can read specific files inside the web application root directory, but must already know each file's exact name and path; the flaw does not let them list directory contents. Atlassian says some configurations hold sensitive files there, which raises the risk. Atlassian rates it Critical, 9.3 under CVSS v4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H), as its own internal assessment. All versions before the listed fixes are affected, which can include end-of-life versions. Affected Atlassian Cloud products are already patched and Atlassian says its investigation found no evidence of exploitation there; Bitbucket Cloud is not affected. For self-hosted instances Atlassian says it cannot confirm whether any have been hit, and tells customers to search access logs for requests where .. sits directly next to /, \ or :: (after URL-decoding up to twice). It offers three temporary blocking rules (a WAF or proxy regex, a Tomcat RewriteValve rule, and a file change; Crucible and Fisheye only get the first) and says they are not a replacement for patching. Primary: Atlassian security advisory. UPDATE (watchTowr Labs, 6 Oct 2026): watchTowr published a technical analysis, a Python proof of concept and a detection artefact generator. It traces the bug to the shared atlassian-plugins-webresource library, which turns :: back into / in web-resource download paths, so a request such as /download/resources/<plugin-key>/images/..::..::WEB-INF::web.xml walks out of a plugin's resource folder. watchTowr showed working routes on Jira, Confluence and Bitbucket. Reads stay inside the Tomcat web application, but that includes WEB-INF. On Jira set up to use Crowd as described in Atlassian's documentation, WEB-INF/classes/crowd.properties holds the Crowd application name and password; watchTowr used those to call the Crowd REST API, list users, create a new user and add it to jira-administrators. With public exploit code out, expect scanning and exploitation to follow quickly. UPDATE (7 Oct 2026): exploitation attempts have started. Previdian says its honeypot network saw attempts within two hours of watchTowr's write-up and exploit code going public, 15 attempts from three IP addresses in Japan and the US (38.60.157[.]86, 146.70.187[.]234 and 159.26.119[.]225), and a Nuclei scanning template is now out, so it expects activity to climb over the coming days. watchTowr has also released a free scanner to check whether an instance is vulnerable. Sources: BleepingComputer and The Hacker News (7 Oct). CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on 15 October 2026 with an 18 October due date for US federal agencies (source: CISA KEV catalog). Correction (24 Oct 2026): The CVE record for CVE-2026-21589 (Atlassian, updated 19 October) now lists the same fixed versions as Atlassian's advisory for all eight Data Center products and no longer lists Server editions, so the earlier note that it differed for Crowd and Bamboo and listed Server editions with no fix has been removed. (source: CVE record CVE-2026-21589) Correction (25 Oct 2026): removed an 8 October attempt count credited to a wire report we cannot read. (source: Previdian) UPDATE (26 Oct 2026): as of 26 October 2026 (Perth), Previdian's page for CVE-2026-21589 (daily telemetry updated 25 October) says its sensors have recorded 658 exploitation attempts from 78 unique attacker IP addresses in 22 countries, first observed on 6 October and last observed on 25 October. (source: Previdian)
Google published the Android Security Bulletin for October 2026 on 5 October 2026. It lists 25 vulnerabilities, all fixed at a single security patch level, 2026-10-01: 7 rated Critical and 18 High. Google says the most severe is a Critical flaw in the System component that could lead to local escalation of privilege with no additional execution privileges and no user interaction. The Critical System entries are CVE-2026-55269, CVE-2026-55280, CVE-2026-58835 and CVE-2026-58880 (privilege escalation, Android 16, 16 QPR2 and 17) plus CVE-2026-49933 and CVE-2026-55265 (denial of service); the CVE records published on 6 October place CVE-2026-58880, CVE-2026-58835 and CVE-2026-55269 in Bluetooth stack code (a race condition, a heap buffer overflow and an input-validation flaw). The Framework section's Critical entry, CVE-2026-58865, is a remote denial of service needing no privileges or user interaction. The High-rated set includes CVE-2026-49878, a System remote code execution bug in the Wi-Fi module, and five Framework privilege escalations. Wi-Fi (CVE-2026-45524, CVE-2026-49878) and Telephony (CVE-2026-58859) fixes also ship as Google Play system updates. The bulletin does not flag any of these as exploited, and Google says AOSP source patches follow within 48 hours. Chipset fixes from MediaTek's own October bulletin (desk card mediatek-october-2026-bulletin-20261005) arrive separately through device makers. The Pixel bulletin for October was not yet published when this card was checked. Primary: Android Security Bulletin, October 2026.
Android Security Bulletin — October 2026 (published 5 Oct 2026)
Nine CVE records for vLLM, the open-source LLM inference and serving engine, were published on 5 October 2026 from its GitHub advisories; all are Medium or Low (top CVSS 3.1 score 6.5). The higher-impact ones let one request take down service for every user of a deployment: CVE-2026-105756 (GHSA-2823-qmq8-rwvj), where a malformed cache_salt kills EngineCore on LMCache-MP deployments; CVE-2026-105757 (GHSA-85xf-c7hm-whqw), where structured-output request errors escape the request boundary and terminate the shared engine; CVE-2026-105754, where the scale-out disaggregated multimodal transport trusts caller-supplied features; and CVE-2026-105753, a multimodal IPC cache desync (fixed in 0.28.0). Several are reachable without authentication: CVE-2026-105758 and CVE-2026-105760 let request-supplied video frame and fps values exhaust CPU and memory (Qwen2-VL/Qwen3-VL samplers via /tokenize, and the GLMGA backend), and CVE-2026-105759 lets arbitrary HTTP method tokens grow Prometheus label sets in the Rust frontend until memory runs out. Two weaken tenant isolation: CVE-2026-105752 drops cache_salt on Harmony tool continuations so a tenant can test whether another tenant's prefix was cached (prefix caching is on by default), and CVE-2026-105755 lets a reused X-Request-Id overwrite cached query embeddings on /score and /rerank. The advisories do not report exploitation. Primary: vLLM GitHub security advisories.
Twenty, the open-source CRM, published GitHub advisory GHSA-mq5c-qp77-2cv3 (CVE-2026-105763, CVSS 3.1 9.6; CVE record published 5 October 2026). From 1.20.10 until 2.7.0, the connectedAccounts query on the /metadata GraphQL endpoint returned the connection parameters of every connected account in a workspace, including plaintext IMAP, SMTP and CalDAV passwords, because the field was not hidden and the lookup did not check the caller's identity or account visibility. An ordinary workspace member could take other members' mail and calendar credentials, read their mail or calendars, and potentially use them to reset third-party accounts. Workspaces that connect only Google or Microsoft accounts through OAuth were not affected. The advisory does not report exploitation. Primary: Twenty GitHub security advisory.
CVE records published 5 October 2026 cover Langflow GitHub advisories on its Model Context Protocol (MCP) support. GHSA-w794-rj3p-xv45 (CVE-2026-105697, CVSS 3.1 9.9) and GHSA-7w94-79vh-5mr2 (CVE-2026-105740, 9.9) describe the same core flaw: when a user adds an MCP server with the stdio transport, or builds a flow with the MCP Tools component, Langflow launched the supplied command and arguments with no allowlist, wrapped in bash -c, so the command runs on the Langflow host as the Langflow process user as soon as Langflow connects to that server, even if the UI then says the server failed to start. The advisory notes that with the default LANGFLOW_AUTO_LOGIN=true, the auto-login endpoint hands out a token without credentials, so an exposed instance on the default setting can be exploited without an account; with auto-login off, any authenticated non-admin user can do it. The fix came in two steps: 1.9.0 added a command allowlist and argument/environment checks to the Add MCP Server API, and 1.10.3 applied the same policy at the point where the process is spawned (covering configs embedded in flows and tweaks) and removed the bash wrapper. A third advisory, GHSA-4f6c-2vvp-gw82 (CVE-2026-105741, 7.1), lets an authenticated user bypass the local-only check on the MCP config install endpoint by sending X-Forwarded-For: 127.0.0.1 and write an MCP client config file on the server (1.5.0 to before 1.10.3). The advisories themselves do not report exploitation. Primary: Langflow GitHub security advisories; CVE records 5 Oct. UPDATE 15 October: honeypot operator Previdian says its sensors have recorded 1,423 exploitation attempts against CVE-2026-105740 since 19 September 2026 from 27 attacker IP addresses in 15 countries, rising from 11 October (333 attempts that day) and still running on 15 October (66 by the time The Hacker News reported it). Previdian rates the exploitation as confirmed. Wire: The Hacker News.
Langflow GHSA-w794-rj3p-xv45 — OS command injection via MCP stdio server configuration (CVE-2026-105697)
Ten CVE records for Docling, the open-source document conversion library widely used to feed PDFs and office files into RAG and other generative AI pipelines, were published on 5 October 2026 from its GitHub advisories. The most serious, CVE-2026-105744 (GHSA-x3q2-h9hx-4r4j, CVSS 3.1 7.5), affects callers that opt into the Tectonic engine for TikZ in LaTeX input (2.94.0 to before 2.132.0): crafted input can read files the converter can access and create or overwrite writable files, and turning on the shell-escape option also allows shell commands; the default configuration is not affected. CVE-2026-105751 (GHSA-4xhp-xg4w-8ppm, CVSS 4.0 6.9) lets an OpenDocument file's draw:image reference read local files that decode as images into the converted output (2.107.0 to before 2.120.3). Others cover an SSRF guard that can be bypassed with DNS rebinding or mixed address records when remote fetching is enabled (CVE-2026-105743), enable_local_fetch not enforced in HTML browser-rendering mode (CVE-2026-105750), plugin entry points imported before the allow_external_plugins check (CVE-2026-105745), configured HTTP headers sent to every remote image host (CVE-2026-105742), local images embedded via crafted DoclingDocument JSON (CVE-2026-105748), CPU or memory exhaustion from oversized tables or archives (CVE-2026-105747, CVE-2026-105749), and a KServe OCR remote-services setting not enforced (CVE-2026-105746). The advisories do not report exploitation. Primary: Docling GitHub security advisories.
Docling GHSA-x3q2-h9hx-4r4j — file read/write via untrusted TikZ with opt-in Tectonic engine (CVE-2026-105744)
Two CVE records for Dify, the open-source LLM app development platform from LangGenius, were published on 5 October 2026 from its GitHub advisories. GHSA-8235-vv5j-mmvg (CVE-2026-105762, CVSS 3.1 8.3): before 1.13.0, the /console/api/remote-files/upload endpoint took an attacker-supplied URL without authentication and made the Dify server fetch it, so a remote attacker could use the server to send requests to internal services or cloud metadata endpoints and as a network pivot. GHSA-ccrj-frp2-c945 (CVE-2026-105761, 7.1): before 1.16.0, the PUT endpoint for an app's MCP server looked up the server by a client-supplied ID without checking that it belonged to that app and tenant, so an authenticated workspace member could change another app's MCP server status and settings, potentially redirecting data or disabling the service. The advisories do not report exploitation. Primary: Dify GitHub security advisories; CVE records 5 Oct.
Dify GHSA-8235-vv5j-mmvg — Unauthenticated SSRF in /console/api/remote-files/upload (CVE-2026-105762)
OpenAI said on 5 October 2026 how it will meet the EU AI Act requirement that generated text be machine-identifiable. Over the coming weeks it will add an invisible watermark, called textGrain, to eligible ChatGPT and Codex text output for users in the European Union across all plans; it is not a global default at launch. From 5 October, API customers anywhere can opt in to watermarked output for selected models, but it stays off by default in the API. textGrain nudges how the model samples between possible words so a keyed statistical pattern runs through a passage; it adds no hidden characters or odd spacing, and detection needs the passage plus OpenAI's secret key. Access to the detector starts with approved researchers and expert organisations only. OpenAI is candid about limits: in its 400-token tests, replacing 10% of words with synonyms cut detection from about 92% to 66%, and 25% replacement cut it to 17%; short, translated or heavily edited text may not be detected, and maths answers watermark poorly. A detected watermark does not identify the user, account or prompt, does not measure human contribution, and the absence of one does not prove human authorship. OpenAI says it plans to open-source textGrain. Primary: OpenAI post and technical report; wire: BleepingComputer 5 Oct.
OpenAI — Our approach to EU text provenance rules (5 Oct 2026)
