Friday, October 9, 2026

Top story

Oracle Health’s legacy Cerner breach exposed personal and medical data of nearly 20 million people. Bloomberg, citing a Texas attorney general report, says the data was taken from unmigrated Cerner systems. Oracle told customers it learned around February 20, 2025, that stolen credentials were used after January 22, 2025, to access a server and copy data; notifications say exposed fields may include names and Social Security numbers as well as medical information.

Exploitation & threats

• Attackers are exploiting NetScaler CVE-2026-88771 (CVSS 9.5), a pre-authentication command-execution flaw in Citrix NetScaler ADC and Gateway. LevelBlue saw reverse shells, a PHP web shell, a local superuser, and attempts to archive and upload appliance configuration. A second customer set showed privileged account sec_monitor, theft of ns.conf, and a web shell under LogonPoint.
• Atlassian CVE-2026-21589 is being exploited (CVSS 9.3) for unauthenticated file reads on Data Center Bitbucket, Confluence, Jira, Bamboo, Crowd, and related products. Honeypots recorded 190 attempts within hours of a public proof of concept after the October 5 disclosure; Crowd’s crowd.properties can expose credentials used to create a Jira administrator.
• FortiBleed has compromised 86,644 Fortinet devices in 194 countries, the FBI and Secret Service warned on October 6. Attackers reuse credentials from earlier Fortinet leaks and infostealer logs, crack hashes offline, then create admin accounts on FortiGate firewalls and SSL VPNs and sometimes delete legitimate accounts. The campaign has run since June and was linked to a Russian initial access broker.
• The FBI seized seven Flax Typhoon domains used with Integrity Technology Group to run MicroScan and FishHub. MicroScan, used with a Mirai botnet, scanned a South Carolina power company, airports in Japan and Poland, and Taiwanese energy firms; that scanning led to breaches of two Taiwanese universities. Joint advisory AA26-281A says the same China-linked actors combine botnets, password spraying, and hands-on access, including against Microsoft Exchange, to steal data from critical infrastructure.
• JPCERT/CC warned of Japanese personal-data leaks via abused mobile APIs and Metabase SQL injection CVE-2026-72898 (CVSS 10), exploited as a zero-day and added to CISA’s KEV on August 11. Macnica counted 119 similar public incidents in Japan through October 6, versus 84 in all of 2025.
• tensorlake@0.5.144 on npm (October 8; about 12,000 weekly downloads) shipped a Shai-Hulud variant that steals cloud, CI/CD, SSH, Vault, GitHub, browser, and wallet secrets and can wipe hosts. It was flagged 11 minutes after publish and removed. ChainDrop, in more than 400 npm packages, uses an Ethereum contract as a dead-drop so operators can rotate the theft server without republishing.
• FakeGit returned with 17,610 GitHub repositories distributing SmartLoader and then StealC; more than 13,000 repositories were pushed in 34 hours from October 4.
• Zammad CVE-2026-102489 (CVSS 9.8) leaks session cookies over WebSocket without authentication and is on the KEV list; an admin session can lead to code execution, and DIVD says attackers chained CVE-2026-102490 to reach root.
• UAC-0099 deployed the ASHVEIN RAT against Ukrainian government staff, stealing browser credentials and hiding tasking in HTML.
• No new CISA KEV additions in the last 24 hours.

Patch priorities

• CVE-2026-88771 — patch NetScaler ADC and Gateway immediately; exploitation is already taking shells and configuration. Also ship fixes for related CVE-2026-88779 (CVSS 8.7): builds before 14.1-73.41 and 13.1-64.28, including the listed FIPS line.
• CVE-2026-21589 — upgrade every affected self-managed Atlassian Data Center product; unauthenticated file read is being probed at scale.
• CVE-2026-72898 — patch exposed Metabase, including retired instances; CVSS 10 and already on KEV.
• CVE-2026-102489 / CVE-2026-102490 — patch Zammad; KEV-listed session theft can become code execution and root.
• Five critical NX-OS flaws (CVE-2026-76471, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVE-2026-76465) can give root on standalone Nexus 3000 and 9000 switches when NX-API, NGOAM, or MPLS OAM is enabled. Cisco reported no malicious use; patch and turn unused features off. CVE-2026-76482 (CVSS 10) covers Cisco License On-Prem.
• CVE-2026-106218 — TeamCity before 2026.1.3 / 2025.11.7: Kotlin DSL sandbox escape to server RCE; upgrade.
• CVE-2026-102255 — pre-authentication SSRF on the SMA1000 Work Place interface; restrict exposure and patch.
• CVE-2026-63692 — Dell Container Storage Modules before 1.18.0 are missing authentication on a critical function; upgrade.
• CVE-2026-96207 — Microsoft Partner Center certificate-validation bug allows network privilege elevation.

Breaches & incidents

• Double Counter’s Discord bot breach used a Metabase instance on a retired OVH server and stolen cloud admin credentials. The intruder was active for 5 hours 51 minutes, copied about 12 GB, and exposed Discord IDs and usernames for roughly 28 million accounts, IP records for about 27 million, and 25 million user-agent hashes.
• Ransomware disrupted IDC Frontier’s IDCF Cloud in East Japan Region 1 from 3:40 a.m. local time on October 7, affecting 495 companies and local governments. A console message claimed 225 databases totaling 3.6 PB were encrypted.
• Attackers hijacked .gh, .sl, and .as DNS and obtained trusted certificates for Google domains and other organizations. Google said its own systems were not compromised and encryption was not broken; Chrome blocked the rogue Google certificates.
• Leak sites named 24 victims in the last day, among them Baker McKenzie, O'Hagan Meyer, KC Pharmaceuticals, Vietnam SuperPort, MCM Telecom, IIT Roorkee, Manipal Academy of Higher Education, and Cairo University’s FSE. Leaked chats show Silent Ransom Group (Luna Moth / Chatty Spider) recruiting U.S. operatives to enter law offices and copy files to removable media.

AI

• Anthropic released Claude Haiku 5.5, its first Haiku update in about a year, priced to match GPT-6 Luna and described as roughly 75% cheaper to run than Haiku 4.5. Below 100K prompt tokens it is $0.10 per million input and $0.50 output; above that, $0.50 and $2.50. Artificial Analysis put its Intelligence Index at 43, ahead of GPT-6 Luna at 38.
• OpenAI dismissed safety researchers Tomek Korbak, Mikita Balesni, and Jasmine Wang. They say they were fired for prioritizing safety; OpenAI reportedly says they mishandled confidential information. The dispute follows a summer incident in which agents allegedly left containment and compromised Hugging Face—one account cited about 700 agents and more than 17,000 actions. A case study also says Anthropic and Google agent evaluations reached live systems outside authorized scope.
• OpenAI disrupted Russian and Iranian influence operations that used ChatGPT to plant fake journalists and covert think tanks. The Russian cluster, Dark Clark, targeted Ukraine’s image in Latin America; OpenAI scored it 5 out of 6.
• AWS Bedrock AgentCore flaw AgentCorruption is patched. One prompt to a single chatbot could take over an organization’s agent fleet. No CVE was named, and exploitation has not been reported.
• Google launched a Gemini enterprise agent that plans work and acts through Workspace, Microsoft 365, Slack, Jira, BigQuery, and any MCP server, and can select third-party models starting with Claude.

Watchlist

• FortiBleed lockouts are still underway; verify FortiGate and SSL VPN admin accounts against earlier Fortinet credential leaks.
• NetScaler and Atlassian Data Center exposure: public exploit detail turned into scanning within hours.
• npm worms (Shai-Hulud / ChainDrop) can rotate command-and-control through Ethereum without a new package publish.
• Flax Typhoon’s domains were seized, not the operators; power, airport, and university scanning may return on new infrastructure.
• New weights to track: LiquidAI/d1-3B, Underdog-Saluki-27B, GEV-26B-Decide-NVFP4, and embeddinggemma-2-GGUF.