ShinyHunters Claims FBI Breach — The ransomware group claims to have stolen data on thousands of FBI employees; Reuters verified some data but could not confirm its origin.

US-UK Defense AI Cooperation — Britain and the US launched a new partnership to develop AI-enabled defense capabilities and autonomous systems for protecting critical infrastructure.

OpenAI Urges US to Lead Global AI Standards — OpenAI called on the US to spearhead international technical standards, model evaluation metrics, and incident reporting protocols for advanced AI.

Czech President Warns of Possible Russian Cyberattack on NATO — President Petr Pavel warned of hybrid operations, including cyberattacks and sabotage, aimed at testing NATO's cohesion.

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control.

Adobe Patches Critical Flaws in Connect, AEM Forms.

Ofcom takes a hard look at Pornhub's Apple-powered age checks.

ChatGPT advertising system reportedly tracks users across websites.

AI agents steal 600,000 credit cards in attacks on online retailers.

The campaign, active since at least July 2026, has reportedly stolen more than 600,000 unexpired payment card records, deployed web skimmers, and accessed systems belonging to major retailers, travel companies, and industrial firms.

Android 17 enables certificate transparency, and breaks custom CAs.

F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks.

Attackers are exploiting WordPress CVE-2026-87902 within hours of disclosure.

The attacks use pearcmd.php to write attacker-controlled PHP files to disk, but only when specific theme and server conditions are met.

Compromised MemTensor packages are pushing the sckit credential stealer through npm and PyPI.

The Go-based malware targets developer and cloud secrets, launching on memory recall in the npm plugin or as soon as the PyPI module is imported.

A new cPanel flaw, CVE-2026-87899, in CalDAV/CardDAV lets any logged-in cPanel account run code as root and take full control of the server.

A second flaw, CVE-2026-87900 in WP Toolkit, lets authenticated users modify databases belonging to other accounts.

Three Chrome-Windows 0-days were exploited in one chain to escape Chrome’s sandbox and achieve remote code execution.

Chinese threat actor UTA0565 used fake sites in the attacks, with the chain ultimately deploying CLEANGULP malware.

F5’s BIG-IP APM 0-day is being exploited for unauthenticated RCE.

CVE-2026-94127 affects systems where APM acts as an OAuth authorization server. F5 has released hotfixes, and CISA added the flaw to KEV.

Next.js patched a critical ImageResponse flaw that can lead to server code execution.

"CVE-2026-94545" affects 16.2.0 through 16.3.5 on Node.js when attacker-controlled values reach generated SVG. The fix is 16.3.6.

ShinyHunters says it breached the FBI and stole data on agents and job applicants.

The FBI says it is investigating claims of unauthorized activity affecting FBIjobs[.]gov.

ShinyHunters also claims a PeopleSoft zero-day was used, but no public technical details of the flaw are available.

Check Point is warning customers about a newly disclosed Security Management Server zero-day exploited in targeted attacks in July.

CVE-2026-93616 lets an attacker who can reach the web service upload and run scripts without logging in. A fix landed Sept. 22.

Spanish PM Pedro Sánchez on AI:

The paradox is that we have these techno oligarchs investing in a technology that many of their workers say could kill and end humanity. And at the same time, these technical oligarchs are investing massively in immortality.

I think that what we need is serious regulation, responsible development of AI, and not bunkers and Mars missions for saving the techno oligarchs.