this week in security — october 11 2026 edition

THIS WEEK, TL;DR

U.S. prosecutors charge ransomware recovery CEO over secret payments to hackers
Bleeping Computer: U.S. prosecutors have charged the owner of a ransomware recovery company with allegedly defrauding victims for years by claiming to use proprietary decryption tech but instead secretly paid and cut deals with the hackers. MonsterCloud CEO Zohar Pinhasi, 50, pleaded not guilty and was released on bond. This comes years after Pinhasi was featured in a ProPublica story about the industry of ransomware negotiating middlemen, which pretty much just results in paying the hackers anyway. Prosecutors said Pinhasi has "no special technology to decrypt data." He faces 20 years in prison if convicted — and would be the latest ransomware middleman to go to prison, after a trio were jailed earlier this year for moonlighting with the hackers.
More: DOJ-EDNY | Justice Department | HackRead | Gizmodo | The Jerusalem Post | Cyberscoop

FBI arrests suspect allegedly involved in breach of agents' data
Krebs on Security: Reports broke Friday into the weekend that another ransomware negotiator has been arrested, this time "in connection" with the ShinyHunters breach of the FBI. A Canadian former executive of a cybersecurity firm named as Edward Dubrovsky was arrested while in Pennsylvania on extortion and conspiracy charges. Details are really thin, and it's not yet clear exactly how he's allegedly linked to the group, but he's said to be directly involved with the hack itself. More details to come as I get 'em… but this will definitely be one to watch. Plus: Reuters ($) spoke with a former cyber-crim and friend of the suspected FBI hacker, who Reuters named as Saif al-Din Khader. The friend told Khader it would be "crazy" to breach the agency. Khader, 17, was taken into Jordanian custody last week and is said to be cooperating with the FBI. Advanced persistent teenagers are no joke. Meanwhile: I wrote about what we can learn from the FBI and Pentagon data breaches.
More: The New York Times ($) | CNN | CBS News | CourtListener | DataBreaches.net | @FBIDirectorKash | ~this week in security~

U.S., allies seize tools used by China's Flax Typhoon for hacks
CISA: A third ransomwa… nah, I'm kidding (can you imagine?!). In all seriousness, the U.S. and its allies are raising the alarm once again about the threat from a Chinese botnet operator called Integrity Tech (aka Flax Typhoon), after authorities seized a bunch of websites that hosted tools that the hackers relied on to target their victims, including governments, telecom companies, and beyond. The tools, Microscan and FishHub, were used for pen-testing websites to find flaws, and for handling phishing attacks. Flax Typhoon has long been accused of allowing its massive botnet to be used to hide Beijing's malicious network activity. The group was previously sanctioned and exposed as part of China's ongoing hacking campaigns — thought to be part of a wider effort to potentially invade Taiwan. CISA has some IOCs, so check your logs!
More: Justice Department | NCSC | The Record | HelpNetSecurity | Bitdefender

U.K. retailer Asos confirms data breach after hackers send in-app push notification
BBC News ($): Rough week for U.K. fashion outlet giant Asos. A relatively new group of hackers calling themselves Xuanye Gateway broke into one of Asos' third-party services, Simon AI (aka Monetate), to send out a fake push notification to app users telling them that their personal data had been stolen from the company's data storage account hosted by Snowflake. It looks like MFA may not have been enabled, allowing the hackers in with stolen credentials. Asos' stock dropped 15% in London after the push notification went out. The BBC later confirmed that the hackers stole names, home addresses, phone numbers, and customer profiles — including some customer website search terms. It's unclear how much data was taken, but Asos serves over 17 million customers. The British cyber plods have some guidance on those affected. There's a good thread on the incident by area cyber weatherman @GossiTheDog.
More: Financial Times ($) | TechCrunch ($) | SecurityWeek | Insurance Journal | Infosecurity Magazine | @zackwhittaker | @joetidy

THE STUFF YOU MIGHT'VE MISSED

Thousands of exposed systems found across solar and wind farms
Modat: Security firm Modat found over 8,000 exposed systems across the European renewable energy sector alone, including exposed admin interfaces and control panels. In at least one case, the researchers found a dashboard with "Start, Stop and Reset" controls, and the turbine’s location on a map. Reuters ($) and Ocean News have more.

Hackers nab HTTPS certificates for Google domains and other big tech companies
Ars Technica: As-yet-unidentified hackers broke into the systems of three top-level domains (.gh, .sl, and .as) and used that access to create fraudulent TLS (HTTPS) certificates for Google and several unnamed large organizations. With the certificates, the hackers could spoof those domains as if they were the real websites. Join @dangoodin on an explainer of the sticky tape and string that holds much of the internet's trust together. Google, meanwhile, said it blocked the fraudulent certificates in Chrome fairly pronto. 

Former CIA staffer pleads guilty to theft of $194 million and hundreds of gold bars
The New York Times ($): News broke earlier this year that a senior CIA officer with hundreds of gold bars in his house was arrested. That CIA officer has now pleaded guilty to defraud the government to the tune of $194 million. Court filings show David Rush used his position at the CIA, which included considerable authority over government intelligence programs and spending, to create a highly classified, top secret, but very fake program that only a handful of people knew about. He used this program to trick a defense contractor into buying the gold, thinking it would help the U.S. government in the event of a nuclear attack. If this wasn't just mostly shuffling classified paperwork at Langley, this would be an epic movie. (Who on earth vetted this guy?) More via ABC News, the AP, and the Justice Department.

Zero day digest: Bugs in Cisco, Citrix, Fortinet, and SonicWall
Hey kids, you wanna see some zero-days? Alright, let's blast through a few highlights: Citrix patched that new NetScaler SAML bug under attack… Cisco patched a critical bug in its Catalyst SD-WAN tech that it says is also being used in hacking campaigns… the U.S. Secret Service cordially reminds you to please patch your Fortinet appliances from the FortiBleed attacks [PDF] that, yes, are still happening… and CSO Online asks what we're all thinking: Why are these security appliances so buggy? In other news: Pwn2Own Ireland saw some fun exploits for Google Pixel phones.

OTHER NEWSY NUGGETS

Denmark's ID database hacked: Denmark's national ID database known as CPR has been compromised, exposing 8.8 million people's data, including those who are dead. The hackers, whose identities aren't yet known, stole the data by abusing a legitimate Danish company's access to the database. One of the accounts used to siphon off the data was reportedly secured with a password of "123456," which might I remind you is literally the *worst* password you could possibly choose. (via Bloomberg ($), Politiken ($)) 

Wave of cyberattacks hit Japan: Tokyo has declared a "cyber space emergency" after dozens of companies, including retail, food, rental operations, and a rail group, were hacked with millions of people's data leaked. The government is warning banks not to accept driver's licenses as proof of identity to open new accounts, fearing the data might not be used legitimately. The U.S. has long expressed concerns over Japan's cyber defenses. (via Financial Times ($), Bloomberg ($), Associated Press, Japan Times)

AI hacks hit South Korean banks: South Korea also faced a bunch of suspected open-source AI-driven cyberattacks targeting several banks. CrowdStrike pointed the blame at a hapless Chinese national who used AI models to target the banks with weak security, but also doxed himself in the process. The hacker reportedly stole thousands of pieces of personal information, but that number might grow. (via Reuters ($), Kyunghyang Shinmun, Tech Times)

Cerner breach affects 20 million: The hack affecting Oracle's Cerner electronic patient records unit in February 2025 included the personal data of 20 million people, including 3 million in Texas, which first reported the figure. Oracle didn't say how many people had their health records exposed — so the number is probably not zero. (via Bloomberg ($), SecurityWeek, BankInfoSecurity, Becker's Hospital Review)

Flock staff flee: Reuters ($) reported this week that surveillance giant Flock is asking around ~20% of its workforce to leave with voluntary buyouts as the embattled maker of license plate cameras faces continued pushback from communities and legislators. I asked if CEO Garrett Langley would take a pay cut as a result, but a spokesperson refused to say. (via 404 Media ($), TechCrunch ($))

THE HAPPY CORNER

*boonnngggg!* It's the happy corner gong. Let's wrap up this week with some little pockets of goodness. 

First up, "no AI" can now be a software feature, and the open source document editor LibreOffice is leading the charge. You won't find any AI features in LibreOffice by default for now, citing its privacy pledge. With its extensions feature, you're welcome to still add your own. (via @cstross)

If you haven't started using an ad-blocker, now is a great time. It's one of the best bits of advice I give people (aside from using a password manager and two-factoring all the things). Ad-blockers cut down on malware, bad websites, and malicious ads, and can save you from web-wide tracking. Kevin Boone has a post explaining how you can get system-wide ad blocking in Android, which can already be done with iPhones, iPads, and Macs. (FYI, I also have a guide for subscribers on some of the best ad-blockers and why.)

I'm a little late to this but… in this short, belated edition of What Can Doom Run On? Someone managed to port Doom to an... SQL database. Why? Honestly, I have no idea, but I'm glad they did. Bonus: Someone also got Doom to run on a Lexmark printer for reasons that evade me. 

And pour one out for the incredible Margaret Hamilton, who passed on this week at the age of 90. Hamilton was a mathematician and computer scientist, who was best known for her work in contributing to that famous stack of paper code used to program the onboard flight software for the Apollo space program, which got American astronauts to the moon and back. Rest in power, Margaret, you absolute badass.

Have good news to share? Get in touch! this@weekinsecurity.com.

CYBER CATS & FRIENDS

This week's cyber cat is Storm … who… Z..z..zz… Z .. z.. z… zzz… sssshh. That's one sleepy kitten…! This is what you get after a hard day's red teaming and making sure the house is secure. Thanks so much to Paul W. for sending in!

SUGGESTION BOX

Thanks for reading this week's edition! I'll be back next week as usual with your roundup of everything that you need to know. Keep an eye out for more on the FBI breach arrests... and we're still expecting to learn more about who is behind these NetScaler attacks — is it espionage, cybercrime, or a little both?

If you liked this newsletter, please share it! And please do reach out if you have anything you want to share for next week's edition — I love hearing from you and what you're learning about, working on, or researching. Drop me an email any time!

G'day,
@zackwhittaker