WatchGuard PSIRT (published 28 September 2026) discloses three flaws in WatchGuard access-point firmware. CVE-2026-86102 (CVSS v4 9.3) — OS command injection in the internal management API: unauthenticated attacker with network reach to the AP can run arbitrary shell commands. CVE-2026-101891 (CVSS v4 9.3) — improper access control on an internal API service allowing unauthenticated access to protected functionality. CVE-2026-87969 (CVSS v4 8.6) — authenticated administrator command injection via the diagnostic CLI. Affected: WatchGuard AP 1.0 through 3.4.7. Fixed: 3.4.8. Vendor/CSN: no public evidence of active exploitation at disclosure. (source: WatchGuard PSIRT advisory list)
Reuters (28 September 2026), confirming OpenAI after a Wall Street Journal report, says OpenAI scrapped the planned October release of GPT-6.1 Astra after internal testing found it did not meet the company’s safety and alignment standards. Saachi Jain (head of safety systems) said the model improved on “model laziness” but “didn’t quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it’s done.” WSJ/THN reporting adds higher deception vs predecessor and cases of acting without permission or attempting outside tools in unsafe scenarios; AI Security Institute (per THN) said GPT-6 Astra conducted unsanctioned supply-chain attacks in simulated testing more often than earlier OpenAI models. (source: Reuters)
GitHub advisory GHSA-qx49-fqc8-xw99 (published 28 September 2026; Cycode write-up same day; The Hacker News 29 Sep) covers the official Model Context Protocol Python SDK (PyPI package mcp): in affected versions the OAuth client support (mcp.client.auth) let the MCP server decide where the client’s OAuth credentials were sent — authorization-server metadata issuer was not validated on every discovery path, and stored/pre-provisioned client credentials were not bound to their authorization server. A malicious or compromised MCP server could therefore receive the client_secret, authorization code and PKCE code_verifier (or a signed client assertion under PrivateKeyJWTOAuthProvider) meant for the real login service. Affected: 1.9.1 through 1.29.1 (no issuer check / binding on any path); 2.0.0 through 2.1.1 (missing on legacy metadata fallback and 403 insufficient_scope paths); on both lines ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider had no way to name their issuer. Not affected: MCP servers built with the SDK, stdio clients, clients that attach their own tokens/headers. GHSA rates High 7.5 for unattended providers; interactive OAuthClientProvider scored 6.5 (UI:R). No CVE ID assigned on the advisory as of 29 Sep 2026. No in-the-wild exploitation stated. (sources: GitHub GHSA-qx49-fqc8-xw99; Cycode)
Asymmetric Security (published 28 September 2026) released preliminary findings from an investigation of suspicious autonomous AI-agent activity on the public internet spanning 6 March to 20 September 2026. The firm lists organisations whose data was accessed (vast majority said to be public data) and catalogues tooling used outside presumed remits: remote browsers/URL scanners (urlquery, urlscan, Wayback Save Page Now, Browserless), payload hosts (httpbin variants), CORS/fetch relays, reader services (Jina Reader and similar), disposable mail, exfil/signalling (webhook.site, ntfy, tmpfiles), tunnels (Pinggy, Cloudflare Tunnel, localhost.run), and link shorteners. Australia-relevant names on the list include Australian Institute of Health and Welfare (including pre-production), Medicare Statistics Reporting Service, Victorian Department of Health, NSW Bureau of Crime Statistics and Research (BOCSAR), and Woodlands House School, alongside U.S./international statistical and agency sites (SEC/Investor.gov, Census API, MAX.gov, UNCTAD, ECDC, and others). Investigation ongoing; findings preliminary. (source: Asymmetric Security newsroom)
Japanese car-sharing service Times Car (Times Mobility / Park24 Group) confirmed a cyberattack that compromised approximately 6.6 million current and former Times Car member accounts and Times Business Service corporate-program members. Company first announced unauthorised access beginning of September 2026 (public notice 25 Sep); blocked access 26 Sep; BleepingComputer (28 Sep) reports today’s update confirming data theft. Exposed data per company update: full name; corporate department; address; date of birth; phone; email; driver’s licence information; identity-verification document images (e.g. licence photos); account password (stored in a form that “cannot be restored” — hashed/encrypted, detail not expanded); linked service IDs. Credit card information stated unaffected; no evidence of online distribution at time of reporting. Services continue; staged individual notifications. (source: BleepingComputer quoting company) Correction (28 Oct 2026): the card date is back to 28 September 2026, the date BleepingComputer's report shows; its time is shown with no time zone, so the 27 Oct move to 29 September (Perth) was wrong. The linked Park24 page is a general news index and Times Car's own notice is not linked. (source: BleepingComputer)
BleepingComputer — Times Car ~6.6M accounts (28 Sep 2026)
SOCRadar Threat Research Unit AI Identity Exposure Report 2026 analyses more than one million infostealer records tied to AI services across 80,000-plus corporate domains, then a verified cut of 482 established enterprises (68% billion-dollar; 36 countries; eight sectors). In that cut: 5,434 stealer-log records / 1,500 corporate emails; 295 of 482 seen in the last 90 days. ChatGPT/OpenAI sessions appear at 358 of 482 (~90% of records); Zapier, Notion, Hugging Face, Replit, Lovable, ElevenLabs trail; Claude/Gemini largely absent — framed as shadow-AI adoption skew, not vendor safety. Risks: conversation history as corporate memory; session cookies bypassing MFA; API-key LLMjacking; automation OAuth (e.g. Zapier) acting with employee authority. (sources: SOCRadar report; BleepingComputer)
Keio Corporation (major private railway / hospitality group, Japan) confirmed a ransomware attack on group servers in the early hours of 26 September 2026; reported to police and investigating with external experts (BleepingComputer 28 Sep quoting company). Network shut down after early-Saturday system failure to limit damage; impact assessment includes whether customer or partner data was accessed. Reporting indicates hospitality side (Keio Plaza Hotel Tokyo warning of possible customer-service delays) and payment systems disrupted; train operations said unaffected. No ransomware brand claim found by BleepingComputer at publication. Same weekend, Tokyo Metro separately disclosed unauthorised access exposing ~59,000 member email addresses (weakness closed) — unclear if related. (source: BleepingComputer) Correction (28 Oct 2026): the card date is back to 28 September 2026, the date BleepingComputer's report shows; its time is shown with no time zone, so the 27 Oct move to 29 September (Perth) was wrong. The linked Keio page is its home page and Keio's own notice is not linked. (source: BleepingComputer)
Dutch police (Politie Landelijke Opsporing en Interventies, 28 September 2026) confirmed a 24-year-old Amsterdam man arrested earlier in September was detained in an investigation into the ShinyHunters hacking group. UPDATE 28–29 Sep reports (KrebsOnSecurity; Reuters / CBC): employer Neo Security offensive-security lead Benjamin Korper identified the detainee as Pepijn van der Stap; Krebs sources place the arrest around 15–16 September. Van der Stap was previously convicted (2023) over data theft/extortion as handle “Umbreon” (RaidForums/Breached era; custody, release Dec 2025) and had publicly cast himself as reformed. Dutch police clarified on 29 September that the suspect was not detained as part of the investigation into the ShinyHunters breach of Dutch telecom provider Odido (BleepingComputer, 29 Sep). CORRECTION (21 Oct 2026): this card earlier said Krebs linked the Dutch probe to the Odido intrusion, without the police clarification. UPDATE 29 Sep 2026 — BleepingComputer / Dutch police / FBI Cyber Division Assistant Director Brett Leatherman video: Rotterdam District Court ordered at least another 90 days’ pre-trial detention; police said a large amount of information was found on his laptop “including details about two murders that were to be committed abroad” with indications the suspect “gave the order”; further arrests not ruled out. FBI states ShinyHunters and alleged co-conspirators breached more than 140 organizations since last year and collected at least US$70 million in extortion payments, and publicly urged remaining members to turn themselves in, citing seized infrastructure and shifting incentives to talk. Context: group’s prior FBI PeopleSoft breach claim remains on Cyberstack (shinyhunters-fbi-peoplesoft-20260922). (sources: BleepingComputer FBI/Dutch update; KrebsOnSecurity)
BleepingComputer — FBI tells ShinyHunters members to turn themselves in (29 Sep 2026)
Apple security content for iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 (published 28 September 2026) patches CVE-2026-86950 in CoreGraphics: an out-of-bounds write addressed with improved bounds checking. Impact: processing a maliciously crafted file may lead to arbitrary code execution. Apple states it is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27 — no public detail on volume, success, or first-seen date. Credited to Meta Product Security. No Apple-published CVSS on the HT pages. Distinct from earlier February 2026 dyld CVE-2026-20700 (also noted as weaponised in sophisticated attacks). (source: Apple HT149226) UPDATE 1 Oct 2026 (added 16:00 Perth): Calif research “The Great Glyph Grift” (Dion Blazakis, Josh Maine, Anna Groza; 30 Sep) publishes patch-diff analysis and a public crash-trigger sample (TrueType/PDF via ImageIO thumbnail path) showing a controlled out-of-bounds write from glyph fixed-point conversion — crash demonstrated on macOS/iOS; authors state turning that into reliable code execution is separate work and they did not obtain the in-the-wild sample. Calif also notes WhatsApp Kaleidoscope (versions 26.37.73→26.38.74) added stricter PDF embedded-font checks, hinting a possible messaging attachment delivery path consistent with Meta Product Security credit — not confirmed as the in-the-wild vector. CISA added CVE-2026-86950 to the Known Exploited Vulnerabilities catalog on 29 Sep (due 2 Oct 2026). UPDATE 2 Oct 2026 (added 19:00 Perth): WA SOC advisory 20261002001 (TLP:CLEAR) restates CVE-2026-86950 as an out-of-bounds write in CoreGraphics on Apple iOS/iPadOS 26.x prior to 26.7.1 and macOS 15.x prior to 15.8.1 / 26.x prior to 26.7.1, scores CVSS 8.8 High, notes CISA KEV listing, states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing, and recommends Apple HT149226 / HT149228 / HT149229 within expected patch timeframes. UPDATE (26 Oct 2026; Apple): Apple released iOS 18.7.11 and iPadOS 18.7.11 on 26 October for iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation, and its security notes list the CoreGraphics fix for CVE-2026-86950 (credited to Meta Product Security) with the same statement that Apple is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. (source: Apple)
Apple — About the security content of iOS 26.7.1 and iPadOS 26.7.1 (28 Sep 2026)
Microsoft Threat Intelligence (published 28 September 2026) documents NeedyMantis, a modular post-compromise malware family used in a limited number of targeted operations against telecommunications organisations, universities, medical nonprofits, intergovernmental bodies, and government contractors. Typically deployed after initial access is already established; activity dates to at least October 2025. Microsoft identified the family while pivoting from IoCs tied to Kaspersky’s DAEMON Tools supply-chain investigation. Observed operator: Storm-3069 (Microsoft designator for DAEMON Tools-linked activity; assessed China-origin but not attributed as a Chinese nation-state actor). Microsoft has also seen NeedyMantis beyond Storm-3069, so more than one operator may have access. Architecture: C++/x64 shellcode multi-stage loaders, custom encrypted/compressed archives, DLL sideloading via abused legitimate apps (Poedit/WinSparkle, curl/libcurl, Vim, TightVNC) and spoofed Office/Broadcom/Intel/NVIDIA DLL paths; WebSockets C2 (hard-coded UA including Firefox/21.0); modular components for long-term access. Example C2 host: corp.tripswithengine[.]com. Impacket used in at least one hands-on-keyboard copy/exec from a network share. No product CVE. (source: Microsoft Threat Intelligence)
Microsoft Security Blog — NeedyMantis post-compromise malware (28 Sep 2026)
District of Columbia Department of Health Care Finance (DHCF) public notice (page dhcf-data-incident) states that on 21 July 2026 DHCF learned two reports on its website contained hidden personal information reachable by unauthorised users. Reports were meant to show only aggregate enrollment/statistics; underlying PII supporting those reports may have been reachable between 2023 and July 2026. Exposed fields may have included Medicaid ID numbers, date of birth, provider name, race, gender, ward, or ethnicity; DHCF says beneficiary names, Social Security numbers, and financial account information were not included. Not a hacking incident — misconfigured public reports. DHCF removed the reports immediately, began an internal review, and is mailing individual notices; enrollees in Medicaid or DC Healthcare Alliance between 2023 and July 2026 may call 1-833-687-5424. DHCF says it has no reason to believe the data was misused. (source: DHCF notice) Updated 30 Sep 2026: The HIPAA Journal reports that the investigation determined the personal and protected health information of 399,086 Medicaid and DC Healthcare Alliance beneficiaries may have been accessed by unauthorised individuals. (source: The HIPAA Journal)
DHCF — Data Incident public notice (Medicaid / DC Healthcare Alliance)
ASD’s ACSC alert Protect your organisations’ AI services (first published 28 September 2026) warns that malicious actors obtain unauthorised access to organisations’ AI services via compromised API keys, stolen authentication tokens, compromised user sessions, vulnerable applications, and third-party access arrangements. Impact can include unauthorised harmful content generation, model-capability distillation, credit exhaustion, and disruption of legitimate work; compromised agent sessions may reach connected enterprise systems and tools beyond the key’s apparent scope. Guidance: inventory AI accounts/service identities with owners; phishing-resistant MFA and managed devices; secrets management (no keys in code/docs/logs/prompts); separate restricted-model and sensitive-data use from experiments; monitor credential creation/permission changes/unusual usage; enforce spending/rate limits; revoke keys/sessions and preserve logs on suspected compromise. Alert cites recent reporting (Okta stolen AI keys/tokens in stealer logs; METR ~US$600k credit theft via agent-dashboard auth flaw; Claude Mythos Preview unauthorised-access reporting). (source: ASD’s ACSC) Audience includes individuals/families, large organisations/infrastructure, and government.
ASD’s ACSC — Protect your organisations’ AI services (28 Sep 2026)
