BleepingComputer (3 October 2026), citing TestingCatalog on X, reports Google is testing desktop-control capability in the Gemini Desktop macOS app, including a hidden “Additional sandbox options” setting. Wire description: when enabled, Gemini could read/create/modify/delete files outside explicitly connected folders, open apps, browse the web, and act through Mail/Safari/Messages without asking permission every time; UI copy says expanded access may allow actions without prior permission depending on settings. Feature is not live and Google has not publicly confirmed the rollout. Wire says Gemini would still prompt before purchases, money transfers, creating accounts, accepting legal terms, or modifying sensitive personal information. Context: Apple’s 2 Oct Full Disk Access hardening for AI-agent risk (desk apple-macos-fda-ai-agents-20261002). Wire-primary until Google publishes Gemini Desktop / computer-use docs. Primary: BleepingComputer 3 Oct.
BleepingComputer — Gemini Desktop Mac full-access sandbox options under test (3 Oct 2026)
Update 16 Oct: the guest-to-host escape Vercel's CEO confirmed on 3 October now has a CVE and a public write-up. Researcher Paulos Yibelo of pwn.ai published 'PwnEscape' on 15 October and the Linux kernel CNA assigned CVE-2026-99999, rated 9.3 Critical (CVSS 3.1, local attack vector, scope changed); NVD had received but not yet analysed it. The bug is not in KVM or Firecracker but in the host kernel's IPv4 networking code: checksum metadata supplied by a guest could point into the IPv4 header, so skb_checksum_help could rewrite the header after the kernel had already validated it. Vercel's own findings post (14 Oct) says the host-memory leak was demonstrated against its production Sandbox: each packet a guest sent could carry back about 32 bytes of host memory, repeatably. Crashing the host with two crafted packets and getting root on the host were shown only on the researcher's own machines built to match Vercel's; he stresses this is not a claim of root in any provider's production. Vercel says no report showed anyone reading customer files, secrets or app data, and called it the challenge's only Critical finding. Because most clouds isolate tenants on the same Linux host networking layer, the exposure is broad for anyone running untrusted guests. The fix is a single commit (6785011f8b16) by Red Hat's Michael S. Tsirkin, which its author calls a defence-in-depth check; fuller input validation is still being worked on. An attacker must already run code inside a guest; it is not reachable from the open internet, and there is no known in-the-wild use or CISA KEV listing. pwn.ai says the research used its Omega-Pwn harness with an AI model as the main reasoning engine. Earlier wire-only reporting (Rauch X post 3 Oct, Tech Insider and CSN 4 Oct) said Vercel paid US$50,000. UPDATE (20 Oct): Red Hat rates CVE-2026-99999 Important, CVSS 3.1 8.8 (it scores privileges required as low, unlike the CNA's 9.3), lists every tracked RHEL stream from 6 to 10 (kernel and kernel-rt), RHEL for NVIDIA and OpenShift 4 CoreOS as affected with fixes still in progress, and says no acceptable mitigation exists. WA's Cyber Security Unit issued advisory 20261019001 on 19 October and has seen no exploitation on WA Government networks. Primary: pwn.ai write-up and kernel commit; vendor: Vercel; wire: The Hacker News (16 Oct).
pwn.ai — PwnEscape: guest-to-host KVM escape (CVE-2026-99999) (15 Oct 2026); fix: Linux commit 6785011f8b16
Reuters (3 October 2026; Jana Winter / Raphael Satter / AJ Vicens) reports Jordanian authorities detained Saif al-Din Khader — alleged ShinyHunters / Scattered Lapsus$ Hunters handle “Rey” (also “Hikki-Chan”) — this week; two of three sources said custody began Tuesday (~30 Sep). Two sources say he is cooperating with the FBI and international partners to locate other group members, including walking investigators through devices and digital communications. Reuters could not determine detention circumstances or current whereabouts; attempts to reach Khader/family unsuccessful. FBI declined to comment on any specific arrest abroad but said it “continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects.” Context: group’s claimed FBI PeopleSoft / AWS GovCloud intrusion (desk shinyhunters-fbi-peoplesoft-20260922); Dutch detention of Pepijn van der Stap / Umbreon (desk shinyhunters-dutch-arrest-20260928). BleepingComputer (3 Oct) amplifies: temporary DLS/messaging disruption mid-week then a new leak site online Thursday; main ShinyHunters channel stopped answering media. Krebs (Nov 2025) had previously identified Khader as Rey and quoted him claiming prior law-enforcement contact — treat as background, not confirmation of this week’s custody terms. Distinct LE action from the Dutch arrest card. Primary: Reuters exclusive 3 Oct (StreetInsider/syndicate mirror); wire: BleepingComputer 3 Oct. Related desk card (not a source): shinyhunters-dutch-arrest-20260928.
Reuters (via StreetInsider) — ShinyHunters Rey / Saif al-Din Khader detained in Jordan; FBI cooperation (3 Oct 2026)
Citrix Security Bulletin CTX697174 (published 3 Oct 2026; desk re-verified 5 Oct) assigns CVE-2026-88779 to the NetScaler SAML authentication crash/DoS tracked separately from CVE-2026-88771/88772. Description: memory overflow (CWE-119) leading to denial of service when NetScaler ADC or Gateway is configured as a SAML SP or SAML IdP. CVSSv4 base 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). Affected: NetScaler ADC/Gateway 14.1 before 14.1-73.41; 13.1 before 13.1-64.28; ADC FIPS before 14.1-73.41 FIPS; ADC FIPS/NDcPP before 13.1-37.282. Patch to: 14.1-73.41+, 13.1-64.28+, 14.1-73.41 FIPS+, 13.1-37.282+. CISA added CVE-2026-88779 to KEV on 4 Oct 2026 (due 7 Oct; forensic triage Yes; BOD 26-04). ASD's ACSC Critical alert (last updated 3 Oct) already flagged the SAML issue as separate from 88771/88772 and reported impacts to Australian organisations — confirm whether SAML Gateway/AAA config is present, apply CTX697174 builds, preserve ns.log/core/support bundle if crashed, and report to ASD's ACSC if impacted. Wire context (Cryptika/Heise 3 Oct): nsaaad crashes and pitboss reboots under crafted SAML traffic after 14.1-73.37 / 13.1-64.23. Distinct desk card citrix-netscaler-unpatched-rce-20260926 covers 88771/88772. UPDATE 5 Oct (SecurityWeek wire): researcher Kevin Beaumont, who calls the bug “PitScaler 2”, reports exploitation attempts against already-patched honeypots and says one honeypot ran a downloaded malware binary. Admins on Reddit shared logs showing SAML authentication requests with shell commands hidden in the username field that try to fetch and run a script; one admin who obtained the script says it tries to plant web shells, survive reboots and upload the appliance configuration and backups, but there is no proof it ran. SecurityWeek notes some indication the flaw may be usable beyond DoS; Citrix still says it has seen availability impact only and no data-integrity impact. Citrix credits Bishop Fox and watchTowr, and watchTowr says it reproduced the issue within hours of seeing honeypot activity (The Hacker News, 5 Oct).
Citrix Security Bulletin CTX697174 — CVE-2026-88779 NetScaler SAML memory-overflow DoS (3 Oct 2026)
OFX Group Limited, the Sydney-based ASX-listed money transfer and financial operations company, first advised the market on 2 October 2026 that it was investigating a cybersecurity incident involving unauthorised access to data, including data relating to some clients, and that it had notified the Australian Cyber Security Centre, the OAIC and other global regulators. Its 15 October 2026 update says the investigation has confirmed that the databases supporting its client platforms were not accessed; based on the investigation to date, OFX has not identified any unauthorised access to client accounts or funds, or any financial loss to clients arising from the incident; and services and systems have continued to operate normally. Analysis of the data found some personal information in the affected files; the files did not contain copies of identity documents, and none of the accessed data can be used to make a payment on the OFX platform. OFX says it has implemented containment actions and additional monitoring of client accounts, is communicating with affected clients and individuals (including recommended protective steps), and is arranging specialist identity and cyber support services where available. The investigation remains ongoing; OFX does not anticipate further market updates unless material developments require continuous disclosure. UPDATE 15–16 October: OFX's incident page (last updated 15 October) says it is moving into a 'next phase' of communications in which affected clients and individuals are told exactly what information about them was accessed, and it has set up incident phone lines in each region (Australia 1800 524 924) plus questions@ofx.com for account enquiries. BeyondMachines (16 October), reporting on those notifications, says the unauthorised access happened on 28 September and that the files exposed names and usernames, contact information, dates of birth, occupation details, answers to secret questions, details of selected transfers and payment recipients, some customer communications, IP addresses and device information, and social media URLs. OFX has not said how many people are affected; BeyondMachines says the New Zealand Privacy Commissioner was also notified. OFX warns the data could be used for scams and impersonation, and says its staff will never ask for passwords, one-time codes or security details. Primary: OFX ASX announcement 15 Oct 2026 and OFX incident page; earlier: OFX ASX announcement 2 Oct 2026. Correction (23 Oct 2026): the headline stated the exposed-data list as OFX's own; it comes from BeyondMachines' reporting on OFX's notifications. Removed 'identified and contained the next day', which only an unreadable source carried. (source: https://beyondmachines.net/event_details/ofx-group-confirms-unauthorized-access-to-client-and-applicant-personal-information-b-g-n-3-l)
OFX Group — Update on cybersecurity incident (ASX, 15 Oct 2026)
IBM, which now acts as CVE numbering authority for Langflow OSS, published security bulletin 7290694 on 2 October 2026 covering 25 vulnerabilities in Langflow 1.0.0 through 1.12.2, the open-source visual builder for AI agents and workflows. The CVE records went public on 6 and 7 October. The two worst, CVE-2026-104334 (code injection) and CVE-2026-93674 (OS command injection), are rated 9.8 by IBM and need no login. Most of the rest need an authenticated user, which in Langflow usually means anyone who can build flows: several sandbox escapes and code-security-scanner bypasses that run code on the server (CVE-2026-97676, 97678, 97673, 97655, 97679, 88962, all 8.8), an OS command injection (CVE-2026-97674, 8.1), path traversal that writes files anywhere the service account can and reads configuration, secrets or database files (CVE-2026-97677, 8.1; CVE-2026-103360, 8.1), cross-user access to cached component results (CVE-2026-97680, 8.3), poorly protected stored credentials (CVE-2026-101331, 7.7), authorization bypasses (CVE-2026-93678, 7.6) and a ZIP extraction denial of service (CVE-2026-93679, 4.3). IBM lists no workarounds. This is a separate set from the Langflow MCP stdio flaws already on the desk (fixed in 1.10.3), so a 1.10.3 install is still exposed. IBM does not report exploitation, but earlier Langflow code-injection flaws were exploited within days of disclosure. Primary: IBM security bulletin and CVE records.
IBM — Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (2 Oct 2026)
Rapid7 published research on 2 October 2026 on Linux backdoors aimed at telecom and network-edge systems in South Korea and Taiwan that disguise themselves as the email security products in use locally. Against South Korean systems, a new BPFDoor variant impersonates the PID file of SpamSniper, a Korean anti-spam product, rotates through ten Linux daemon names, and in some builds names itself ora_ppmond to look like an Oracle database process; Rapid7 says operators now wrap the BPFDoor magic packet inside ordinary HTTPS POST requests so that SSL offloading at telecom edge proxies delivers the trigger past deep packet inspection, after which a TinyShell session gives shell, upload and download. A BPF backdoor built on Rekoobe watches traffic on port 25 and also uses SpamSniper component names. In Taiwan, a dropper planted in the add-on package directory of ShareTech appliances, keyed off the string "ShareTech", installs AVERAT, a previously unreported modular implant that uses SMTP on TCP port 25 for command and control, checking in every 600 to 699 seconds (about 10 to 11.7 minutes), with commands for file transfer, process control, up to 10 concurrent shells, proxying and loading extra modules; the payloads run from memory after their files are deleted. Rapid7 says the C2 infrastructure resembles an operational relay box network and treats attribution as ongoing; BPFDoor has previously been linked to the China-nexus group Red Menshen. Primary: Rapid7; wire: The Hacker News (7 Oct). Correction (27 Oct 2026): AVERAT's check-in interval is now given as Rapid7 states it, every 600 to 699 seconds; the card had said 10 to 11.5 minutes. (source: Rapid7)
Rapid7 — SMTP is the key: BPFDoor and AVERAT hitting the network edge (2 Oct 2026)
Socket's threat research team (2 Oct 2026) found a cluster of colour-theme extensions spanning four Visual Studio Marketplace listings and six Open VSX identities, tied together by git history and shared code. The Marketplace build of Cosmic Nebula Themes contains a staged loader that decrypts embedded JavaScript with AES-256-CBC, runs it with eval(), skips Russian-language and Russian-timezone systems, and reads Solana transaction memos as a dead-drop to find its next payload server; Socket says it carries the same Solana address, AES key and execution model seen in earlier GlassWorm activity and rates it GlassWorm with high confidence. A previously removed sibling, Aurora Nocturne Night Theme, hid an obfuscated Windows downloader that wrote attacker content to a temporary batch file and ran it silently through cmd.exe. Coca-Cola Christmas and Aurora Borealis Studio Theme, still live at the time of writing with more than 8,000 combined installs, were not weaponised in the versions analysed but are rated high-risk. VS Code has no fine-grained permissions for theme extensions, so a theme can run code. Wire: Cyber Security News 5 Oct.
Socket — Pretty themes, hidden loaders: GlassWorm-linked extensions span VS Code Marketplace and Open VSX (2 Oct 2026)
Seoul Economic Daily reported on 2 October 2026 (2:21 pm Perth) that KB Kookmin Bank said the personal and credit information of 119 customers had leaked from a mobile work-support system used by employees, and that it blocked the server and access route immediately after recognising on the night of 30 September that information might have leaked through abnormal external access; KB said the breach was unrelated to customer financial transactions such as internet and mobile banking and that it would fully compensate any losses. Hana Bank said an external hacking agent gained abnormal access to its operations support system and that it believes resident registration numbers, names, addresses, email addresses, phone numbers, mobile numbers and employer names were leaked (the paper puts the Hana figure at 89 customers); Hana blocked the affected servers and access routes and said it would fully compensate customers if actual damage occurs. The paper said signs were confirmed that personal information of 11 outsourced development staff at BNK Busan Bank was exposed, that traces of an AI-based automation tool were found in the earlier Shinhan Bank breach, and that the National Police Agency's cyber terror response investigation unit launched a pre-charge investigation into the Shinhan, KB Kookmin, Hana and Busan leaks the same day. It quoted Genians Security Center head Moon Jong-hyun as saying on LinkedIn that a string naming ARTEX was found in some HTML titles of the web server presumed to have been used in the attack and that many threat analysts reasonably suspect an AI-based attack automation tool was used; the paper describes ARTEX AI as a Chinese-language system that automates vulnerability scanning. Neither the banks nor regulators have confirmed which tool was used. Updated 4 Oct 2026 (Korea Times, 1:21 pm Perth): President Lee Jae Myung ordered a thorough investigation and countermeasures, presidential spokesperson Kang Yu-jung said. The Korea Times reported that Shinhan Bank reported a breach on Thursday 1 October affecting about 25,000 customers, followed by KB Kookmin Bank, Hana Bank and BNK Busan Bank on Friday 2 October, and that the leaked information included customers' names, phone numbers, annual income and loan limits, with some resident registration numbers also exposed. Yegaram Savings Bank reported a leak involving about 40,000 customers, and Hyundai Capital said some personal data of 146 housing-loan agents had been exposed. These are separate affected groups, not one pool. Financial Services Commission Chairman Lee Eog-weon and Financial Supervisory Service Governor Lee Chan-jin chaired an emergency meeting with representatives from banks, securities firms, insurers, credit card companies, savings banks and fintech companies, and police have launched an investigation. (source: Korea Times) Updated 7 Oct 2026 (CrowdStrike): CrowdStrike Intelligence published analysis on 7 Oct of attacker infrastructure linked to the campaign, which it says ran from late September to early October and resulted in exfiltrated data. Open directories on attacker-controlled servers held Claude Code session histories, Claude memory files and configuration for ARTEX, a recently released Chinese-developed open-source agentic pentesting tool; one server (38.244.50[.]120) hosted the ARTEX instance and a Hong Kong-based server acted as primary infrastructure. The ARTEX instance used DeepSeek v4.1-flash as its main model, with GLM-5.3 and Grok 4.6 also used in sessions. CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated but does not attribute it to a named group; the sessions also asked Claude where Korean breach data is sold, and a résumé prompt contained personal details placing a likely suspect in Maoming, Guangdong, which CrowdStrike says it cannot definitively tie to the actor. (source: CrowdStrike) Correction (26 Oct 2026): the card date has moved from 4 to 2 October 2026, the Perth date of the earliest source it cites (Seoul Economic Daily); the Korea Times and CrowdStrike reports now carry Updated lines. Statements that no linked source supports have been removed: a 10 October update about a statement by the ARTEX developer and BleepingComputer's reporting on it, a BleepingComputer figure of 119,000 KB Kookmin clients, on-site inspections and information-sharing with KISA, an SBS report of common IP addresses, and unlinked Cybersecurity News and Reuters/iTnews wire credits. The ARTEX string and the Genians quote are now credited to Seoul Economic Daily, and the Australia field now reads unknown. (source: Seoul Economic Daily; Korea Times; CrowdStrike)
Korea Times — Lee orders thorough probe into AI-powered cyberattacks in banks (4 Oct 2026)
AWS Security Bulletin 2026-125-AWS (Important; published 2 October 2026 PDT) and Amazon CNA CVE-2026-104019 disclose OS command injection (CWE-78) in the Studio Space startup validation script in Amazon SageMaker Distribution when used with Amazon SageMaker Unified Studio. On Space startup the script network-validates available SageMaker connections in a project; improper sanitization of connection details can let an authenticated project contributor (or higher) execute arbitrary commands in another project member’s Studio Space. With Trusted Identity Propagation enabled, that can yield the peer’s temporary execution-role credentials and calls to TIP-enabled AWS services on their behalf. CVSS 4.0 9.3 Critical (Amazon CNA; also CVSS 3.1 9.0). Fixed images: 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, 4.4.3; 4.5.x not affected; 2.8–2.13 and 3.3–3.8 EOL with no fix — move to a supported minor. AWS says the fix is deployed globally; Unified Studio Spaces pick up the latest patch of their minor line on restart (no version picker). No workarounds; no exploitation reported in the bulletin. Primary: AWS 2026-125-AWS; also GHSA-w64x-664p-7w66.
AWS Security Bulletin 2026-125-AWS — SageMaker Distribution CVE-2026-104019 (2 Oct 2026)
AWS Security Bulletin 2026-124-AWS (Important; published 2 October 2026 PDT) covers three issues in Loom for AWS (AWS Labs open-source AI agent orchestration). CVE-2026-103956 (CVSS 4.0 10.0 / CVSS 3.1 10.0 Critical; CWE-306/1188): before 1.6.1, in deployments with no identity provider configured, any network client could obtain full administrative authority over the agent control plane — register tool servers, read stored integration credentials, rewrite IAM role policies on managed agent roles — via any application API request. Fixed in 1.6.1 (released 4 Aug 2026). CVE-2026-103957 (CVSS 4.0 8.2 High): before 1.7.0, authenticated mcp:write/a2a:write users could abuse OAuth2 discovery so the backend sent client secrets or another user’s access token to a third-party endpoint (1.6.1 blocked internal-address reach but not full token disclosure). CVE-2026-103958 (CVSS 4.0 8.3 High): before 1.7.0, same scopes could SSRF connection requests to internal locations including the container credential endpoint and read responses. Upgrade to 1.7.0; until then configure Cognito/external IdP before non-loopback exposure, leave LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV unset in deployed envs, and restrict mcp:write/a2a:write to trusted admins. After upgrade: rotate OAuth2 client secrets, revoke/reissue tokens, and if container role credentials may have been accessed rotate IAM session credentials and review CloudTrail. Acknowledgement: Kenneth Cox. No exploitation claimed in the bulletin. Primary: AWS 2026-124-AWS.
AWS Security Bulletin 2026-124-AWS — Loom for AWS CVE-2026-103956/103957/103958 (2 Oct 2026)
Technical University of Denmark (DTU) disclosed on 2 October 2026 a serious personal-data breach of DTUBasen, its identity and access management system. Attackers compromised DTU profiles and used them to access DTUBasen, downloading a large volume of personal data dating back to 2003. DTU cannot determine precisely what was taken or how many people were affected; DTUBasen holds ~40,000 active and ~160,000 former users (employees, students, guests, external partners). For active users, potentially exposed fields include Danish civil registration (CPR) numbers, full names, home addresses, profile pictures, work email/title/office details, and registered next-of-kin name/relationship/phone. Former-user home addresses, pictures, and next-of-kin are auto-deleted after six months, but CPR and names remain. Incident reported to the Danish Data Protection Agency and referred to authorities; IR contained with external specialists. Notifications via e-Boks for current/former employees and most students with CPR on file; public notice for guests/partners/next-of-kin DTU cannot reach directly. DTU warns of identity fraud and more convincing phishing. Primary: DTU English disclosure 2 Oct; wire: BleepingComputer 3 Oct.
DTU — Cyberattack on DTU: Notification of a personal data breach (2 Oct 2026)
