Skip to main content

Daily Cyber Brief · 09 October 2026 · a Monadnock Cyber summary

Monadnock Cyber
Daily Cyber Brief
09 October 2026 · a Monadnock Cyber summary
DAILY CYBER NEWS SUMMARY — 2026-10-09
TOP LINE

Hackers earned $1,262,000 exploiting 98 zero-day flaws at Pwn2Own Ireland 2026, demonstrating continued financial incentive for vulnerability research and exploitation (Source: BleepingComputer — https://www.bleepingcomputer.com/news/security/hackers-earn-1262000-for-98-zero-days-at-pwn2own-ireland/). The FBI disrupted tools used by a China-linked threat group, Flax Typhoon, seizing domains used in critical infrastructure intrusions (Source: The Hacker News — https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html). A critical vulnerability in Citrix NetScaler requires immediate patching to prevent remote code execution or denial-of-service (Source: SecurityWeek — https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/).

TOP STORIES
  • The co-creator of the Empire Market dark web marketplace received a 40-year sentence after pleading guilty to a drug conspiracy charge and forfeiting over $100 million in Bitcoin and properties (Source: The Record — https://therecord.media/co-creator-empire-dark-net-market-sentenced).
  • The FBI seized seven domains and disrupted tools used by Flax Typhoon, a China-linked advanced persistent threat group, impacting critical infrastructure (Source: The Hacker News — https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html).
  • Researchers are examining whether the timing and cause of AI chatbots turning rogue can be predicted (Source: SecurityWeek — https://www.securityweek.com/formula-predicts-when-ai-chatbots-are-at-risk-of-turning-bad/).
  • A vulnerability in AWS Bedrock AgentCore allows an attacker to take over an organization’s entire fleet with a single prompt (Source: Dark Reading — https://www.darkreading.com/cloud-security/agentcorruption-aws-environments-at-risk-single-prompt).
  • A ransomware attack disrupted IDCF Cloud, a major Japanese cloud and digital infrastructure company serving government clients (Source: BleepingComputer — https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/).
  • Google Pixel 10 exploits earned hackers $560,000 at Pwn2Own Ireland 2026, part of a total payout of $1.2 million for 98 zero-day flaws (Source: SecurityWeek — https://www.securityweek.com/google-pixel-10-exploits-earned-hackers-560000-at-pwn2own/).
BREACH NOTIFICATIONS

66 data-breach notifications were filed in the last 7 days with the 8 state attorney-general registers we monitor. This is a floor, not a national total.

  • DriveWealth filed a data-breach notification with the MA and TX attorneys general on 2 October 2026, reporting 2,556,688 residents of those states affected (30,000,000 people affected in total); data involved: SSN, Financial Account (Source: state attorney-general breach register, verified public record — https://www.mass.gov/doc/data-breach-report-2026/download).
  • Cerner Corporation filed a data-breach notification with the TX attorney general on 2 October 2026, reporting 2,992,244 residents of that state affected (19,929,149 people affected in total); data involved: Address;Social Security Number Information;Medical Information (Source: state attorney-general breach register, verified public record — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage).
  • iRhythm Technologies Inc. filed a data-breach notification with the CA and TX attorneys general on 6 October 2026, reporting 298,647 residents of those states affected (8,179,772 people affected in total) (Source: state attorney-general breach register, verified public record — https://oag.ca.gov/ecrime/databreach/reports/sb24-630879).
  • Poppins Payroll Company filed a data-breach notification with the TX attorney general on 2 October 2026, reporting 23,796 residents of that state affected (246,937 people affected in total); data involved: Name of individual;Social Security Number Information;Financial Information (e.g. account number, credit or debit card number);Date of Birth (Source: state attorney-general breach register, verified public record — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage).
  • World Acceptance Corporation filed a data-breach notification with the TX attorney general on 2 October 2026, reporting 51,073 residents of that state affected (232,401 people affected in total); data involved: Name of individual;Social Security Number Information;Driver’s License number (Source: state attorney-general breach register, verified public record — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage).
  • Sheppard, Mullin, Richter & Hampton LLP filed a data-breach notification with the TX attorney general on 6 October 2026, reporting 2,326 residents of that state affected (204,001 people affected in total); data involved: Social Security Number Information;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Other (Source: state attorney-general breach register, verified public record — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage).
  • Greenberg Traurig, LLP (“GT”) filed a data-breach notification with the TX attorney general on 2 October 2026, reporting 1,839 residents of that state affected (150,000 people affected in total); data involved: Name of individual;Address;Social Security Number Information;Date of Birth (Source: state attorney-general breach register, verified public record — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage).
  • City of McMinnville filed a data-breach notification with the TX attorney general on 2 October 2026, reporting 263 residents of that state affected (122,864 people affected in total); data involved: Name of individual;Social Security Number Information;Driver’s License number (Source: state attorney-general breach register, verified public record — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage).
  • Upbound Group, Inc. filed a data-breach notification with the TX attorney general on 2 October 2026, reporting 6,280 residents of that state affected (76,327 people affected in total); data involved: Name of individual;Address;Social Security Number Information;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Financial Information (e.g. account number, credit or debit card number);Medical Information;Health Insurance Information;Date of Birth (Source: state attorney-general breach register, verified public record — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage).
  • Little River Memorial Hospital filed a data-breach notification with the TX attorney general on 2 October 2026, reporting 3,242 residents of that state affected (47,467 people affected in total); data involved: Name of individual;Social Security Number Information;Medical Information;Other;Date of Birth (Source: state attorney-general breach register, verified public record — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage).
  • Midvale Indemnity Company filed a data-breach notification with the TX attorney general on 2 October 2026, reporting 3,416 residents of that state affected (38,381 people affected in total); data involved: Name of individual;Driver’s License number (Source: state attorney-general breach register, verified public record — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage).
  • Lincoln Property Company Commercial LLC filed a data-breach notification with the TX and VT attorneys general on 2 October 2026, reporting 6,585 residents of those states affected (19,300 people affected in total); data involved: Name of individual;Address;Social Security Number Information;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Financial Information (e.g. account number, credit or debit card number);Medical Information;Health Insurance Information;Date of Birth (Source: state attorney-general breach register, verified public record — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage).
VERIFIED FILINGS
  • Astrana Health, Inc. filed a Form 8-K Item 1.05 cybersecurity incident disclosure with the SEC on 23 September 2026 (Source: SEC EDGAR, verified public record — https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&type=8-K&company=Astrana+Health%2C+Inc.).
GOVERNMENT ADVISORIES
  • CISA issued an advisory regarding Satel Netco Design (Source: CISA — https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-03).
  • CISA issued an advisory regarding Grid Protection Alliance openPDC and openHistorian (Source: CISA — https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02).
  • CISA issued an advisory regarding Red Lion Controls N-Tron 700 Series (Source: CISA — https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01).
  • CISA issued an advisory regarding Chinese Government-linked cyber threat actors (Source: CISA — https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a).
  • CISA issued an advisory regarding Johnson Controls EasyIO FG (Source: CISA — https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-01).
  • CISA issued an advisory regarding Hitachi Energy REB500 (Source: CISA — https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-05).
  • CISA issued an advisory regarding Hitachi Energy Asset Suite (Source: CISA — https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-03).
  • CISA issued an advisory regarding Hitachi Energy SOI (Source: CISA — https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-04).
  • CISA issued an advisory regarding Hitachi Energy RTU500 (Source: CISA — https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-06).
  • CISA issued an advisory regarding Savannah lwIP SMTP client (Source: CISA — https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-02).
  • CISA added CVE-2015-5477 ISC BIND to its Known Exploited Vulnerabilities Catalog (ransomware use: Unknown) (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5477).
  • CISA added CVE-2016-3081 Apache Struts to its Known Exploited Vulnerabilities Catalog (ransomware use: Unknown) (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081).
  • CISA added CVE-2023-22894 Strapi Strapi to its Known Exploited Vulnerabilities Catalog (ransomware use: Unknown) (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22894).
  • CISA added CVE-2021-3199 ONLYOFFICE Docs to its Known Exploited Vulnerabilities Catalog (ransomware use: Unknown) (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3199).
  • CISA added CVE-2015-3306 ProFTPD ProFTPD to its Known Exploited Vulnerabilities Catalog (ransomware use: Unknown) (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3306).
  • CISA added CVE-2026-88779 Citrix NetScaler to its Known Exploited Vulnerabilities Catalog (ransomware use: Unknown) (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88779).
  • CISA added CVE-2026-102490 Zammad GmbH Zammad to its Known Exploited Vulnerabilities Catalog (ransomware use: Unknown) (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102490).
  • CISA added CVE-2026-102489 Zammad GmbH Zammad to its Known Exploited Vulnerabilities Catalog (ransomware use: Unknown) (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102489).
  • CISA added CVE-2026-104286 Fortinet FortiMail to its Known Exploited Vulnerabilities Catalog (ransomware use: Unknown) (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286).
  • CISA added CVE-2026-76504 Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities Catalog (ransomware use: Unknown) (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76504).
EXTORTION TEMPO

40 extortion claims were reported in the last 48 hours, and 214 in the last 7 days, with 42 originating in the US. The reporting of extortion claims relies on leak site monitoring, a source with low reliability. An alternative explanation is that increased media coverage of ransomware incidents drives increased reporting of claims, rather than an actual increase in attacks. Gaps in data include the inability to verify the legitimacy of claims or the actual impact on organizations.

  • An organization is listed on the Byod leak site (Source: Unverified claim).
  • A Canadian healthcare organization is listed on the Storm leak site (Source: Unverified claim).
  • A US-based healthcare organization is listed on the Storm leak site (Source: Unverified claim).
  • A US-based education organization is listed on the Scarlettgroup leak site (Source: Unverified claim).
  • A Colombian maritime company is listed on the Nightspire leak site (Source: Unverified claim).
  • A Thai hospitality company is listed on the Nightspire leak site (Source: Unverified claim).
  • An organization is listed on the Nightspire leak site (Source: Unverified claim).
  • A US-based construction company is listed on the Nightspire leak site (Source: Unverified claim).
  • An organization is listed on the Nightspire leak site (Source: Unverified claim).
  • An organization is listed on the Nightspire leak site (Source: Unverified claim).
BOTTOM LINE

The data indicates a very likely high level of cyber risk, with the $1.2 million payout for zero-day exploits and the disruption of Flax Typhoon demonstrating ongoing threat activity. The large number of breach notifications—66 in the last 7 days—underscores the continued financial incentive for cybercrime. Given the verified data, it is very likely organizations should prioritize patching critical vulnerabilities, particularly CVE-2026-88779 in Citrix NetScaler, and remain vigilant against ransomware attacks. Confidence is high, based on multiple verified sources (CISA advisories, breach notifications, SEC filings) and the consistent reporting of threat activity.

✓ Prepared on Monadnock infrastructure. Authored by the local engine gemma3:27b and cross-checked by local engines (gemma3:27b, gemma4:31b); ICD-203 lexicon enforced by a deterministic gate (CLEAN). No third-party cloud. Statistics carry their sources inline.
Monadnock Cyber LLC · At the intersection of AI and Security
Sources & references
Labels:

Comments

Post a Comment

Popular posts from this blog

Am I a Target? Daily Cyber Brief MONADNOCK CYBER • Monday, September 21, 2026

Am I a Target ? Daily Cyber Brief MONADNOCK CYBER  •  Monday, September 21, 2026  •  At the intersection of AI and Security What happened in cyber in the last 24 hours — verified, graded, and stripped of hype. Confirmed facts and unverified claims are labeled throughout. ● Foreign desk · raw & unevaluated China Desk: what Beijing is saying about cyber today New this week: we’re pulling foreign-language coverage into collection. This is a first, unfiltered look — machine-translated, not yet source-graded, and it includes Chinese state media. Read it as raw signal, not a finished assessment. China is running its annual National Cyber Security Awareness Week (launched September 14, nationwide). This year’s theme centers on the “intelligent era” — AI security (“智能时代 网安护航”). Coverage across state and commercial outlets (China.com.cn [1] , Guangming, Baidu) carries these themes: AI at machine speed. A widely-run piece frames it as the “attack-and-defense battle” of ...
Post a Comment
Read more

Above the Fold What foreign press tells its own public · a Monadnock Cyber summary

  Above the Fold What foreign press tells its own public · a Monadnock Cyber summary 26 September 2026 · ATF-2026-09-26 · TLP:CLEAR Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation. Global Cyber Weather Report · 26 September 2026 OUTLOOK Expect increased volatility driven by AI-enabled attacks and persistent state-sponsored activity. CONDITIONS NOW Ransomware activity remains high with 235 incidents in the last seven days. Clop, thegentlemen, and qilin are the most prolific crews. A cross-cutting signal indicates AI is integrated into attacks, specifically for autonomous skimming of payment ca...
Post a Comment
Read more

Above the Fold | What foreign press tells its own public | A Monadnock Cyber summary 24 September 2026 ·

  Above the Fold What foreign press tells its own public · a Monadnock Cyber summary 24 September 2026 · ATF-2026-09-24 Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation. In this issue 01   Iran   From data theft to sabotage: Iran's banks under service-disruption attacks 02   Russia   Under siege, wearing an AI mask: NightEagle and AI-crawler disguise 03   China   National Cyber Security Week: AI Safety Governance Framework 3.0 04   European Union   Cutting the cord: Europe moves to wean its governments off US clouds 05   Brazil   Braz...
Post a Comment
Read more