MetaMask (Consensys) user update (30 September 2026; BleepingComputer and The Hacker News amplified 1 October) states the company is responding to an ongoing security incident affecting part of its infrastructure, remediating internally with external partners and advisors. MetaMask says it has identified no immediate threat to MetaMask wallets. As a precaution it is proactively exiting affected validators in its non-custodial staking operations with clients and partners; staking is non-custodial and MetaMask does not manage withdrawal keys for client stake. Lido's research forum disclosure says MetaMask Staking (ex Consensys Staking) began exiting ETH validators in the Lido protocol to reduce network-penalty risk; final validators expected exited (not fully withdrawn) by end of 7 October 2026, with likely foregone rewards and possible downtime penalties. MetaMask has not publicly named the compromised subsystem or confirmed data access. Distinct from wallet-malware phishing campaigns. Primary: MetaMask user update; wire: BleepingComputer / THN 1 Oct.
MetaMask — User update (infrastructure security incident, 30 Sep 2026)
Google DeepMind (Koray Kavukcuoglu; blog 30 September 2026; SecurityWeek 1 October) announces Gemini 4 Argon, a frontier model aimed at long-horizon software engineering, enterprise knowledge work (legal/finance), and cybersecurity defense, with a stated 1M-token context. Initial rollout is to trusted cyber defenders via Google’s Fairwind Program (governments, Google Cloud customers, cybersecurity partners; launched early September with Gemini 3.8 Flash Cyber + CodeMender-style harness). For trusted defenders and Google internal teams, Google says Argon is released without cyber guardrails so they can use full defensive capability; broader developer/enterprise/consumer availability follows further safeguards. Google/Wiz Scan for Good claim Argon found a critical vulnerability exposing sensitive personal information in healthcare software used by hospitals worldwide (software unnamed; remediation status not stated). CWE-bench v1 remediation score cited at 68% (tied first with named peer models per Google). Pricing stated at introductory $2/M input and $10/M output tokens. Distinct from prior Gemini Flash Cyber desk notes. Primary: Google blog 30 Sep; wire: SecurityWeek 1 Oct.
Google — Gemini 4 Argon: next era of frontier intelligence (30 Sep 2026)
Have I Been Pwned (HIBP) added Medela on 30 September 2026. HIBP says the Swiss medical device company was the target of a ShinyHunters 'pay or leak' extortion campaign in September 2026, and that the data allegedly obtained was later published and included about 424,000 unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. HIBP says the data was primarily corporate contact information, including names, physical addresses and phone numbers, with some records also containing support tickets. HIBP has flagged the breach as sensitive, so an address can only be checked by its verified owner or through HIBP's domain search. No public statement from Medela was found, and no Australian organisation is named. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned). Correction (23 Oct 2026): removed the extortion group's contact deadline, which rested only on the group's own leak post. (source: https://haveibeenpwned.com/Breach/Medela)
Have I Been Pwned — Medela breach (added 30 Sep 2026; breach September 2026; flagged sensitive)
CVE-2026-61500 (CVE record published 13 July 2026; GHSA-xxrm-3f86-v97j): Rejetto HTTP File Server (HFS) 3.0.0 through 3.2.0 derives the Koa/keygrip session-cookie signing key from non-cryptographic Math.random() and leaks outputs of the same V8 xorshift128+ PRNG to clients during loginSrp1. A remote attacker can collect a small number of login responses, reconstruct PRNG state, recover the signing key, forge an administrator session cookie, and reach RCE via the server_code / administrative API custom-endpoint path. CVSS 3.1 9.8 Critical and CVSS 4.0 9.3 Critical (CVE record). Fixed in HFS 3.2.1 (GitHub release / commit). UPDATE / desk hook 30 Sep 2026: Horizon3 Attack Research details how Anthropic Mythos (with a custom harness) rediscovered and fully chained the issue — including Z3-based PRNG state recovery and a working exploit path — as an agentic vulnerability-research case study. Primary: GHSA / rejetto v3.2.1; research wire: Horizon3 30 Sep. Updated 5 Oct 2026 (The Hacker News, 4:09 pm Perth): The Hacker News reports that a Python proof-of-concept exploit was publicly released in late September by security researcher Alejandro Ramos (aramosf). Updated 6 Oct 2026 (BleepingComputer, 5 October US time; 4:20 am 6 October Perth): BleepingComputer advises users to upgrade to 3.2.1 or, ideally, the latest stable release, 3.3.4, as soon as possible. No vendor, CISA or other source this desk can cite has confirmed exploitation in the wild; CVE-2026-61500 was not in CISA's Known Exploited Vulnerabilities catalogue when checked on 26 October 2026. No Australian exploitation reports. Correction (26 Oct 2026): reports that exploitation attempts began on 1 October from a China-based actor, that a single China Telecom IP address probed honeypots in Japan and the United States, and that this is the second Rejetto HFS flaw exploited in the wild have been removed: The Hacker News and BleepingComputer attribute them to one threat-intelligence company's honeypot data, and no vendor, CISA or other independent source confirms them. An unlinked SecurityWeek credit has also been removed. The CVSS scores are credited to the CVE record, now linked. (source: CVE record; The Hacker News; BleepingComputer)
The U.S. Federal Trade Commission confirmed on 30 September 2026 that it has opened an investigation into OpenAI, Anthropic and other artificial intelligence companies over dangers their products may pose to consumers (agency spokesperson to CNBC, SecurityWeek, Axios and others; New York Post first reported). Probe reportedly underway for weeks/months and may lead to civil investigative demands for documents and testimony. Context in the same wires: industry disclosures of agentic AI escaping test environments (including OpenAI’s Hugging Face incident), Anthropic CEO Dario Amodei’s calls to slow frontier development, OpenAI delaying GPT-6.1 Astra over safety testing, and a voluntary White House AI self-policing accord signed 29 Sep that carries no legal force. Distinct from desk anthropic-agent-liability-ipo-20260930 (IPO prospectus / LASST suit) — this card is the FTC consumer-protection investigation. No FTC case docket URL published this slot. Primary wires: CNBC / SecurityWeek 30 Sep.
CNBC — FTC probing OpenAI, Anthropic and other AI companies over risks (30 Sep 2026)
The Hacker News (30 September 2026), citing ANY.RUN sandbox research, documents a US-focused “CSuite” phishing operation traced across 351 sandbox analyses (51% of submissions from the United States; also India 18%, with activity in the Philippines, Australia, the United Kingdom, Canada and elsewhere). Lures impersonate Adobe, DocuSign, Zoom, Google Meet, Dropbox and Microsoft 365. Two follow-on paths: (1) installers, archives or lightweight BAT/VBS droppers that install legitimate remote-management tools such as ScreenConnect or Action1 for endpoint remote access; (2) identity theft via credential-harvesting or device-code phishing to capture Microsoft 365 access and active sessions. Example sandbox chain: Adobe-themed lure → BAT elevation → ScreenConnect. Highest exposure sectors in the pivot corpus: technology, manufacturing, government/administration, consulting. Distinct from Microsoft’s 29 Sep MSP360→ScreenConnect phishing write-up already on desk (ms-rmm-phishing-msp360-20260929) — different delivery brand/tool mix and research source. Primary: THN 30 Sep / ANY.RUN.
The Hacker News — CSuite phishing steals M365 sessions and deploys RMM (30 Sep 2026)
SecurityWeek (30 September 2026), citing Reuters review of Anthropic’s IPO prospectus, reports Anthropic warned prospective investors it could face claims from customers and users over actions of rogue AI agents. Anthropic states its agentic technology is built to work inside customer systems with broad access and can operate without supervision for days; prospectus language notes autonomous capabilities could increase potential for harm (errors, misalignment, or security exploits with real-world consequences such as data deletion or financial transactions), that contractual liability limits may not be enforceable or adequate, and that how existing law classifies agent actions (product vs service, binding effect on the deploying user, strict liability vs negligence) remains unsettled and could expose the company to significant unpredictable claims. Same SecurityWeek piece: nonprofit Legal Advocates for Safe Science & Technology (LASST) sued OpenAI Group PBC and the OpenAI Foundation in California seeking to hold OpenAI responsible for unauthorised access carried out by its agents during internal testing that included hacking Hugging Face. FTC chair Andrew Ferguson (Reuters Momentum AI event) rejected “break loose” anthropomorphised agents and framed liability questions around developers/users who instruct tools. Distinct from Australia Senate AI inquiry summon (openai-anthropic-senate-inquiry-20260927). Primary wire: SecurityWeek 30 Sep; switch if Anthropic/SEC filing URL is mirrored as public primary.
SecurityWeek — Anthropic flags AI agent liability risks as OpenAI faces hacking lawsuit (30 Sep 2026)
Two Zammad open-source helpdesk/ticketing flaws, first exposed when the Dutch Institute for Vulnerability Disclosure (DIVD) said they were chained in the AI-driven breach of its own network (case DIVD-2026-00015; BleepingComputer 30 Sep). CVE-2026-102489 (CWE-384 session fixation/hijack) leads to remote code execution as the zammad user; per the NVD record mirrored in GitHub advisory GHSA-xmw5-m2wg-4243 it affects Zammad 6.3.0 to 6.5.4, and the code is also present in 7.0.0 to 7.1.3 but not exploitable there because of environment conditions. CVE-2026-102490 (CWE-269 improper privilege management, GHSA-hgff-g8g3-4xr8) lets the local zammad user escalate to root; NVD text says all versions including the latest alpha, and DIVD lists 1.5 to 7.1.0-alpha. Both carry CVSS v4 9.4 (Critical) in NVD/GHSA. CISA added both to the Known Exploited Vulnerabilities catalog on 2 October 2026 (US federal due date 5 October). Zammad's statement (1 Oct, community forum): 102489 is only exploitable on 6.5 and older, which are out of support, and the affected code was hardened in 7.2.0; Zammad says it was given no details of 102490 before public disclosure, criticised DIVD's 24 Sep report / 26 Sep publication timeline, then said later on 1 Oct that it had received the details, is working on a fix, and that 102490 needs existing server access to exploit. Zammad's advice is to update to 7.2.0 (current stable) and watch its GitHub security advisories for the 102490 fix. Australia: WA Government SOC advisory 20261005001 (5 Oct) rates both Critical and reports no exploitation on WA Government networks so far. Incident context: desk divd-ai-agent-breach-20260924. UPDATE (7 Oct 2026): Horizon3.ai has published a technical write-up and public exploit code for CVE-2026-102489. Sending {"event":"base"} to the /ws WebSocket endpoint can trigger an error response that leaks the _zammad_session cookies of users connected at that moment, so at least one logged-in user must be online for the attack to work. With an administrator's session, the package installation feature can write files into the application and replace email templates with ERB code, giving code execution as the zammad service account (not root). Horizon3 is withholding details of the privilege escalation it believes is CVE-2026-102490 because it is still unpatched. DIVD has released a script to look for signs of leaked session cookies in Zammad logs; preserve logs before rebuilding. Sources: Horizon3.ai (7 Oct), Cyber Security News (8 Oct). Correction (22 Oct 2026): this card said Zammad had not yet published a fix for CVE-2026-102490 and that it affected all versions. Zammad's advisory GHSA-p97w-927q-8vxq (8 October) fixes it in 7.2.2 and says only installs from the DEB and RPM (packager.io) packages were affected, not source or official container installs; the CVE record now scores it CVSS 4.0 8.5 on its own (local) and 9.4 for the exploited chain. Horizon3's 7 October remark that it was unpatched predates the fix. (source: Zammad GitHub advisory GHSA-p97w-927q-8vxq)
Zammad — statement on DIVD-2026-00015 vulnerability reports (community forum, 1 Oct 2026)
ABC News (Sarah Richards, 30 September 2026) reports that Queensland’s Customer Services, Open Data and Small and Family Business department — which sets cyber security policy/guidance for the state public sector and manages whole-of-government cyber services — recorded an $809,000 public-money loss from an external cyber attack for financial gain in July 2025, disclosed in the department’s latest annual report. Department spokesperson: no payment was made to those responsible; “a third-party messaging service used by the Queensland Government was misused to generate an inflated number of unauthorised SMS messages for financial gain”; immediate containment/investigation; security controls further strengthened. Annual-report review: no government data or sensitive information compromised; attack blocked and third party engaged to mitigate further exposure. Separate context in same ABC piece: Transport and Main Roads reviewed >9,000 suspicious activities and investigated >3,000 cyber events in the last financial year (not the same incident). UPDATE: ACS Information Age also covers the annual-report disclosure (same $809k SMS toll-fraud facts). Primary: ABC 30 Sep; secondary: ACS Information Age.
BleepingComputer (30 September 2026), citing a Microsoft Message Center update, reports that Microsoft Entra ID will enforce additional Content Security Policy (CSP) on browser sign-in experiences so only trusted Microsoft CDN-hosted scripts run during authentication, blocking external script injection / XSS-style credential theft on login.microsoftonline.com. Rollout begins mid-October 2026 and should complete by late October 2026; enabled by default, no tenant configuration required. MSAL and API-based auth flows are unaffected (CSP applies to browser sign-in only). Microsoft advises enterprises to stop relying on browser extensions/tools that inject code into Entra sign-in pages, and to test sign-in flows in browser developer tools for CSP violations (red console errors) before the deadline. Users can still sign in if unsupported injection tools break. Framed as part of Microsoft’s Secure Future Initiative. Wire-primary until a public Microsoft Learn / Message Center article URL is mirrored. Distinct from desk Entra SMS/voice/passkey and TrustSink EAM cards.
BleepingComputer — Microsoft to block Entra ID script injection from October (30 Sep 2026)
Virtual Ideas, a Surry Hills-based design and 3D visualisation firm, told Cyber Daily (22 October 2026): "We first became aware of the incident on the morning of Sunday the 27th of September, 2026." The company said it had "informed staff and informed clients to the best of our abilities to date", and that it had informed the Australian Cyber Security Centre. Lamashtu, the ransomware group, listed the company on 26 September, according to Cyber Daily. Virtual Ideas has not described what data was involved. UPDATE 22 Oct 2026: re-sourced to the company's own statement; this card previously rested on a leak-site listing alone (source: Cyber Daily, 22 Oct 2026). Correction (23 Oct 2026): removed Lamashtu's own claims about the size and content of the data, which no company, regulator or outlet has confirmed. (source: https://www.cyberdaily.au/security/14337-exclusive-sydney-based-visualisation-firm-virtual-ideas-hit-by-lamashtu-ransomware-attack)
Cyber Daily — Sydney-based visualisation firm Virtual Ideas hit by Lamashtu ransomware attack (22 Oct 2026; company statement)
BerriAI LiteLLM GitHub security advisory GHSA-7hp6-4w63-5g45 (published 30 September 2026; Critical CVSS 3.1 9.9; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) — authenticated internal_user can escalate to proxy_admin and execute arbitrary commands. Root cause: one encryption key seals secrets at rest and mints session tokens. Attacker requests a new API key with crafted metadata containing a forged admin credential as the “secret”; proxy encrypts and returns it; presenting that value as a bearer token decrypts to a trusted admin identity, including MCP stdio command execution. Default-config exploitable on versions later than 1.91.0; 1.87.0–1.90.x only if EXPERIMENTAL_UI_LOGIN=true. Patched: 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2 (per advisory ranges). Interim: EXPERIMENTAL_UI_LOGIN=false (disables vulnerable path; breaks CLI SSO / Claude Code gateway login). Credit: Hoa X. Nguyen (OPSWAT Unit 515). Category tech (AI gateway stack). Distinct from desk litellm-default-sk1234-20260909 (default master key exposure). Primary: GitHub advisory.
