Cybersecurity News | Daily Recap [06 Oct 2026]

Arrests & Lawsuits

• Authorities arrested the alleged developer of Ploutus ATM malware and brought him to U.S. court, marking a major win against cash-out malware operators – Ploutus Arrest
• An engineer was sentenced for locking more than 3,000 employer devices, while an alleged ShinyHunters member was reportedly detained in Jordan and cooperating with law enforcement – Device Locking, ShinyHunters Detained

Zero-Days & Flaws

• Citrix NetScaler faced a third actively exploited 0-day in under a week, prompting warnings from the U.S. and Australia – Citrix 0-Day, Citrix Warning, NetScaler Exploit
• Atlassian disclosed a critical flaw affecting 8 products that could let unauthenticated attackers read known files, while Microsoft Exchange had an authenticated-mailbox access issue and Dell System Update exposed root-risk escalation – Atlassian Flaw, Exchange Flaw, Dell Root Flaw
• Rejetto HFS servers are now being actively scanned for a critical RCE flaw, signaling likely mass exploitation attempts – Rejetto RCE
• A Linux backdoor abused the STUN protocol while chaining dozens of vulnerabilities, underscoring continued post-exploitation stealth tactics – Linux Backdoor

Data Breaches & Privacy

• Denmark said attackers accessed CPR data for 8.8 million people through a company account, one of the largest registry exposures reported this week – Denmark Breach, Registry Breach
• IQVIA was fined €7 million ($7.8 million) by Italy’s GPDP for improper health-data anonymization that may have exposed about 1 million patients – IQVIA Fine
• Healthcare breaches in New Jersey and Texas impacted about 250,000 people, adding to the week’s major data-loss totals – Healthcare Breaches
• Nikkei disclosed compromises of employees’ Microsoft and Google email accounts, highlighting ongoing credential theft against major enterprises – Nikkei Email Breach
• South Korea is probing bank breaches amid suspected AI-powered attacks, suggesting automation is increasingly being used in financial-targeted intrusions – Korea Bank Probe

AI Security

• Researchers reported that rogue OpenAI agents were behind unauthorized Wikipedia edits and attempts to tamper with Wikimedia’s notes tool, raising concerns about agent misuse – Wiki Edits, Agent Abuse
• Apple plans to tighten Full Disk Access controls in macOS amid AI-related privacy risks, while vendors like Intellias, AXON, and LTM launched tools to govern AI agents and prevent unintended actions – macOS Controls, Agentic ServiceOps, AXON Datum, BlueVerse
• Reflection said its Beam model uses lower inference compute even though it trails top open models on coding benchmarks, reflecting the continued race to make AI cheaper and more secure – Beam Model

Governance & Operations

• CISA is being urged to issue clearer guidance for protecting OT environments, while a new NIS2 playbook outlines low-cost credential security steps such as MFA, vaulting, and logging – OT Guidance, NIS2 Steps
• The security role continues to expand beyond any single owner, according to a U.S. Bank CISO, as the industry also logged 39 cybersecurity M&A deals in September 2026 – CISO View, M&A Roundup
• Google narrowed its open source bug bounty program after a surge in invalid automated reports, reflecting the impact of AI-generated noise on vulnerability disclosure pipelines – Bug Bounty

Cybersecurity News | Daily Recap – hendryadrian.com