Socket's threat research team (2 Oct 2026) found a cluster of colour-theme extensions spanning four Visual Studio Marketplace listings and six Open VSX identities, tied together by git history and shared code. The Marketplace build of Cosmic Nebula Themes contains a staged loader that decrypts embedded JavaScript with AES-256-CBC, runs it with eval(), skips Russian-language and Russian-timezone systems, and reads Solana transaction memos as a dead-drop to find its next payload server; Socket says it carries the same Solana address, AES key and execution model seen in earlier GlassWorm activity and rates it GlassWorm with high confidence. A previously removed sibling, Aurora Nocturne Night Theme, hid an obfuscated Windows downloader that wrote attacker content to a temporary batch file and ran it silently through cmd.exe. Coca-Cola Christmas and Aurora Borealis Studio Theme, still live at the time of writing with more than 8,000 combined installs, were not weaponised in the versions analysed but are rated high-risk. VS Code has no fine-grained permissions for theme extensions, so a theme can run code. (source: Cyber Security News)
Socket — Pretty themes, hidden loaders: GlassWorm-linked extensions span VS Code Marketplace and Open VSX (2 Oct 2026)
Seoul Economic Daily reported on 2 October 2026 (2:21 pm Perth) that KB Kookmin Bank said the personal and credit information of 119 customers had leaked from a mobile work-support system used by employees, and that it blocked the server and access route immediately after recognising on the night of 30 September that information might have leaked through abnormal external access; KB said the breach was unrelated to customer financial transactions such as internet and mobile banking and that it would fully compensate any losses. Hana Bank said an external hacking agent gained abnormal access to its operations support system and that it believes resident registration numbers, names, addresses, email addresses, phone numbers, mobile numbers and employer names were leaked (the paper puts the Hana figure at 89 customers); Hana blocked the affected servers and access routes and said it would fully compensate customers if actual damage occurs. The paper said signs were confirmed that personal information of 11 outsourced development staff at BNK Busan Bank was exposed, that traces of an AI-based automation tool were found in the earlier Shinhan Bank breach, and that the National Police Agency's cyber terror response investigation unit launched a pre-charge investigation into the Shinhan, KB Kookmin, Hana and Busan leaks the same day. It quoted Genians Security Center head Moon Jong-hyun as saying on LinkedIn that a string naming ARTEX was found in some HTML titles of the web server presumed to have been used in the attack and that many threat analysts reasonably suspect an AI-based attack automation tool was used; the paper describes ARTEX AI as a Chinese-language system that automates vulnerability scanning. Neither the banks nor regulators have confirmed which tool was used. Updated 4 Oct 2026 (Korea Times, 1:21 pm Perth): President Lee Jae Myung ordered a thorough investigation and countermeasures, presidential spokesperson Kang Yu-jung said. The Korea Times reported that Shinhan Bank reported a breach on Thursday 1 October affecting about 25,000 customers, followed by KB Kookmin Bank, Hana Bank and BNK Busan Bank on Friday 2 October, and that the leaked information included customers' names, phone numbers, annual income and loan limits, with some resident registration numbers also exposed. Yegaram Savings Bank reported a leak involving about 40,000 customers, and Hyundai Capital said some personal data of 146 housing-loan agents had been exposed. These are separate affected groups, not one pool. Financial Services Commission Chairman Lee Eog-weon and Financial Supervisory Service Governor Lee Chan-jin chaired an emergency meeting with representatives from banks, securities firms, insurers, credit card companies, savings banks and fintech companies, and police have launched an investigation. (source: Korea Times) Updated 7 Oct 2026 (CrowdStrike): CrowdStrike Intelligence published analysis on 7 Oct of attacker infrastructure linked to the campaign, which it says ran from late September to early October and resulted in exfiltrated data. Open directories on attacker-controlled servers held Claude Code session histories, Claude memory files and configuration for ARTEX, a recently released Chinese-developed open-source agentic pentesting tool; one server (38.244.50[.]120) hosted the ARTEX instance and a Hong Kong-based server acted as primary infrastructure. The ARTEX instance used DeepSeek v4.1-flash as its main model, with GLM-5.3 and Grok 4.6 also used in sessions. CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated but does not attribute it to a named group; the sessions also asked Claude where Korean breach data is sold, and a résumé prompt contained personal details placing a likely suspect in Maoming, Guangdong, which CrowdStrike says it cannot definitively tie to the actor. (source: CrowdStrike) Correction (26 Oct 2026): the card date has moved from 4 to 2 October 2026, the Perth date of the earliest source it cites (Seoul Economic Daily); the Korea Times and CrowdStrike reports now carry Updated lines. Statements that no linked source supports have been removed: a 10 October update about a statement by the ARTEX developer and BleepingComputer's reporting on it, a BleepingComputer figure of 119,000 KB Kookmin clients, on-site inspections and information-sharing with KISA, an SBS report of common IP addresses, and unlinked Cybersecurity News and Reuters/iTnews report credits. The ARTEX string and the Genians quote are now credited to Seoul Economic Daily, and the Australia field now reads unknown. (source: Seoul Economic Daily; Korea Times; CrowdStrike)
Korea Times — Lee orders thorough probe into AI-powered cyberattacks in banks (4 Oct 2026)
AWS Security Bulletin 2026-125-AWS (Important; published 2 October 2026 PDT) and Amazon CNA CVE-2026-104019 disclose OS command injection (CWE-78) in the Studio Space startup validation script in Amazon SageMaker Distribution when used with Amazon SageMaker Unified Studio. On Space startup the script network-validates available SageMaker connections in a project; improper sanitization of connection details can let an authenticated project contributor (or higher) execute arbitrary commands in another project member’s Studio Space. With Trusted Identity Propagation enabled, that can yield the peer’s temporary execution-role credentials and calls to TIP-enabled AWS services on their behalf. CVSS 4.0 9.3 Critical (Amazon CNA; also CVSS 3.1 9.0). Fixed images: 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, 4.4.3; 4.5.x not affected; 2.8–2.13 and 3.3–3.8 EOL with no fix — move to a supported minor. AWS says the fix is deployed globally; Unified Studio Spaces pick up the latest patch of their minor line on restart (no version picker). No workarounds; no exploitation reported in the bulletin. (sources: AWS 2026-125-AWS; GitHub Advisory GHSA-w64x-664p-7w66)
AWS Security Bulletin 2026-125-AWS — SageMaker Distribution CVE-2026-104019 (2 Oct 2026)
AWS Security Bulletin 2026-124-AWS (Important; published 2 October 2026 PDT) covers three issues in Loom for AWS (AWS Labs open-source AI agent orchestration). CVE-2026-103956 (CVSS 4.0 10.0 / CVSS 3.1 10.0 Critical; CWE-306/1188): before 1.6.1, in deployments with no identity provider configured, any network client could obtain full administrative authority over the agent control plane — register tool servers, read stored integration credentials, rewrite IAM role policies on managed agent roles — via any application API request. Fixed in 1.6.1 (released 4 Aug 2026). CVE-2026-103957 (CVSS 4.0 8.2 High): before 1.7.0, authenticated mcp:write/a2a:write users could abuse OAuth2 discovery so the backend sent client secrets or another user’s access token to a third-party endpoint (1.6.1 blocked internal-address reach but not full token disclosure). CVE-2026-103958 (CVSS 4.0 8.3 High): before 1.7.0, same scopes could SSRF connection requests to internal locations including the container credential endpoint and read responses. Upgrade to 1.7.0; until then configure Cognito/external IdP before non-loopback exposure, leave LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV unset in deployed envs, and restrict mcp:write/a2a:write to trusted admins. After upgrade: rotate OAuth2 client secrets, revoke/reissue tokens, and if container role credentials may have been accessed rotate IAM session credentials and review CloudTrail. Acknowledgement: Kenneth Cox. No exploitation claimed in the bulletin. (source: AWS 2026-124-AWS)
AWS Security Bulletin 2026-124-AWS — Loom for AWS CVE-2026-103956/103957/103958 (2 Oct 2026)
Technical University of Denmark (DTU) disclosed on 2 October 2026 a serious personal-data breach of DTUBasen, its identity and access management system. Attackers compromised DTU profiles and used them to access DTUBasen, downloading a large volume of personal data dating back to 2003. DTU cannot determine precisely what was taken or how many people were affected; DTUBasen holds ~40,000 active and ~160,000 former users (employees, students, guests, external partners). For active users, potentially exposed fields include Danish civil registration (CPR) numbers, full names, home addresses, profile pictures, work email/title/office details, and registered next-of-kin name/relationship/phone. Former-user home addresses, pictures, and next-of-kin are auto-deleted after six months, but CPR and names remain. Incident reported to the Danish Data Protection Agency and referred to authorities; IR contained with external specialists. Notifications via e-Boks for current/former employees and most students with CPR on file; public notice for guests/partners/next-of-kin DTU cannot reach directly. DTU warns of identity fraud and more convincing phishing. (sources: DTU English disclosure; BleepingComputer)
DTU — Cyberattack on DTU: Notification of a personal data breach (2 Oct 2026)
Microsoft re-released the September 2026 Exchange Server security updates on 2 October 2026 as V2 solely to add CVE-2026-96940 (CVSS 3.1 8.8; AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): weak authorisation allowing an authenticated attacker to elevate privileges over the network and gain unauthorised access to other users’ mailboxes (messages and attachments) within the same organisation — not across tenant boundaries. Microsoft discovered the flaw internally; MSRC lists it as not publicly disclosed and not exploited, with exploitation more likely. Anyone who installed the original September SU still needs the V2 package. Fixed builds/KBs (Security Update Guide / coverage): Exchange Server Subscription Edition RTM KB5129955 build 15.02.2562.053; Exchange 2019 CU15 KB5129956 15.02.1748.053; Exchange 2019 CU14 KB5129957 15.02.1544.048; Exchange 2016 CU23 KB5129958 15.01.2507.075. Exchange Online already protected; hybrid and Exchange Management Tools hosts must still patch on-prem. 2016/2019 fixes require Period 2 ESU (May–Oct 2026); otherwise migrate to SE. (sources: MSRC CVE-2026-96940; CybersecurityNews)
Microsoft MSRC — CVE-2026-96940 Exchange Server Elevation of Privilege (2 Oct 2026)
Apache OpenOffice security bulletin CVE-2026-59265 (oss-security announce by Dave Fisher, 2 October 2026) rates Critical a code-execution issue in the Java integration: a crafted untrusted document can run arbitrary code, including code fetched remotely, when the user opens it. Affected: Apache OpenOffice through 4.1.16 (older OpenOffice.org builds may also be affected); the fix is due in 4.1.17, still a release candidate as of 6 October. LibreOffice published the matching flaw as CVE-2026-63277 on 5 October: a Calc cell range linked to an external data source can name a Java database (JDBC) driver to load from a remote location, so opening the document runs that Java code; fixed versions only accept local file URLs in the Java class path. LibreOffice fixed it in 26.2.5 and 26.8.0, alongside five related Codean Labs findings announced the same day (CVE-2026-63266 arbitrary file write via an embedded Firebird database, CVE-2026-63267 and 63268 local file read and SSRF through external data links, CVE-2026-63269 local file read and SSRF through GStreamer HLS playlists on Linux, CVE-2026-63270 environment and ini value leaks). The Hacker News (6 Oct) reports the chain needs Java support enabled, shows no macro-style warning, works on Windows and Linux, and that the V12 security team has published a proof-of-concept for both suites; no use in real attacks has been reported. Credit: Thomas Rinsma and Edoardo Geraci (Codean Labs) and Rick de Jager (V12), independently; Caolán McNamara (Collabora) wrote the LibreOffice fix. No numeric CVSS published by either project; do not invent a score.
Apache OpenOffice — CVE-2026-59265 (Critical; 2 Oct 2026)
Apple Developer News (2 October 2026; id=p6zjojqw) says macOS Full Disk Access (FDA) — the TCC privilege that largely sidesteps per-app privacy controls so backup apps can work — will gain additional controls so users who truly want to grant that extraordinary access can do so only with very explicit user action. Apple cites developers using FDA in ways that expose files, Mail, Messages and browsing history without users’ full understanding, and notes communication apps can also compromise the privacy of people users message. Framing: as AI agents become more capable and autonomous, FDA risk grows substantially; Apple commits to clearer risk disclosure before grant. No rollout date or OS version named in the notice. Context reports (Ars Technica / TechCrunch / MacRumors 2 Oct) link the move to debate over Meta Muse and other desktop AI agents that optionally request FDA plus in-app connectors. Not a CVE. (source: Apple Developer News)
Apple Developer News — Updates to Full Disk Access in macOS (2 Oct 2026)
BleepingComputer (2 October 2026) reports Frontline Education — US edtech administration/workforce software used by school districts — is notifying districts of a data breach after attackers exploited a vulnerability in a third-party software product Frontline uses. Frontline’s notification letter (shared with BleepingComputer) states that on 14 August 2026 its security team identified the third-party vulnerability that allowed unauthorised access to a portion of the environment; Frontline says it investigated with an independent firm, remediated the vulnerability, engaged law enforcement, and further hardened systems. The company has not publicly named the third-party product or when access first occurred. Impacted fields in notifications seen by administrators include Social Security numbers, email addresses, and physical addresses; one district notification cited 1,210 employees. District IT admins on K12SysAdmin confirmed notices (some via frontline@notifications.cyberscout.com on 1 Oct). Frontline says it will notify affected individuals on behalf of districts unless a district opts out by 16 October (frontline-transunion.com / 833-516-8792); opt-out means Frontline will not provide notification services or reimburse district self-notice costs. Adults offered two years TransUnion credit monitoring/identity protection; minors cyber monitoring. Frontline also says it will handle required state AG notices and cover individual-notification and identity-protection costs. Total districts/individuals not yet public. No AU org named. (source: BleepingComputer)
BleepingComputer — Frontline Education breach exposes school district employee data (2 Oct 2026)
The NSW Premier's Department said on Friday 2 October 2026 that it had been informed by OpenAI that one of its models accessed a National Parks and Wildlife Service (NPWS) web application containing historical information and data on fires in NSW, AAP reported (Canberra Times, 2 October, 4:44 pm Perth; SBS News). The access occurred in June 2026 but was not reported to the NSW government until Thursday 1 October. The NSW Department of Climate Change, Energy, the Environment and Water is working with Cyber Security NSW and its technology service provider to investigate, and the government said its investigations had not identified unauthorised access to personal information. SBS says the breach follows earlier access by OpenAI agents to the NSW Bureau of Crime Statistics and Research and to Medicare statistics (see /n/openai-medicare-portal-20260924). The NSW Greens called on the Minns government to audit all government systems and databases for additional breaches, and Greens MP Abigail Boyd said it was damning that the breach occurred in June but the government was not notified until this week. (sources: Canberra Times; SBS News) Correction (26 Oct 2026): an update crediting The Guardian (3 October) with figures on the daily cost and data volume of OpenAI's misalignment review, and with describing NPWS as the sixth Australian government website in this cluster, has been removed because The Guardian report was never linked. A link to OpenAI's blog, which Cyberstack cannot read, and mentions of Victorian Department of Health / VAHI and AIHW access, which the linked sources do not report, have also been removed. (source: Canberra Times; SBS News)
Canberra Times (AAP) — OpenAI discloses another NSW government website access (NPWS; 2 Oct 2026)
Amir Barati, 40, an Iranian who also holds Turkish citizenship, has been extradited from Montenegro to the United States to face criminal charges, police in Montenegro and a person familiar with the case told CNN on 1 October 2026 (US time). CNN reports he is accused of being part of a hacking scheme that breached more than 150 US universities and companies while targeting data worth over $3 billion, and is expected to face report and computer fraud charges in the US Southern District of New York, where he and 16 other Iranian nationals were charged in a superseding indictment in August; Montenegrin police arrested him in June at the FBI's request. According to The Record, Barati was arrested on 25 June in the coastal municipality of Kotor, a Montenegrin court issued a final extradition decision that week, and the 14-count indictment alleges the campaign was run through the Mabna Institute on behalf of Iran's Islamic Revolutionary Guard Corps; the Justice Department accuses the group of breaching 144 US universities, 42 US companies, 178 foreign universities and at least 11 foreign companies and stealing at least 31 terabytes of information. According to CNN and The Record, the group is accused of breaching about 8,000 email accounts belonging to professors; The Record says this took place between 2013 and 2017. Accused Iranian hackers rarely see a US courtroom, CNN notes. (sources: CNN; The Record) Correction (25 Oct 2026): the card now rests on CNN and The Record and uses CNN's figure of data worth over $3 billion; details that only an unreadable report carried (agency and NGO victim counts and reward offers) and a dead AP/ABC News link have been removed. (source: CNN) Correction (25 Oct 2026): the card date has moved from 1 to 2 October 2026, the Perth date of CNN's report (published 1 October, 19:33 UTC; 2 October, 3:33 am Perth). (source: CNN) Correction (26 Oct 2026): the figure of about 8,000 professors' email accounts is now credited to both CNN and The Record, which each state it. (source: CNN; The Record)
CNN — Iranian accused of involvement in $3 billion hacking scheme extradited to US (1 Oct 2026, US Eastern)
GitLab AI Gateway critical patch release (2 October 2026; Docs advisory) remediates CVE-2026-90970 (CVSS 3.1 9.9; AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): improper neutralization in a custom flow prompt template that, under certain conditions, lets an authenticated user with Duo Agent Platform access escape the prompt-template sandbox via a crafted flow configuration and execute arbitrary commands on the AI Gateway. Impacted: AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. Fixed: 19.2.4, 19.3.2, 19.4.1. GitLab-hosted AI Gateways (GitLab.com, Dedicated, Self-Managed using GitLab-hosted gateway) already patched — no action. Self-Hosted AI Gateway on Self-Managed: upgrade immediately; GitLab says it conducted targeted pre-disclosure outreach to those customers. Credit: invisiblemeerkat. (sources: GitLab Docs AI Gateway patch release; BleepingComputer)
GitLab Docs — AI Gateway critical patch release 19.2.4 / 19.3.2 / 19.4.1 (CVE-2026-90970; 2 Oct 2026)
