Latest cybersecurity news, incidents and how SI models dey develop — wey dem observe and analyze for victims and researchers inside legal white-hat bounds. No intrusion or exploit how-tos.
Dis article na machine translation.
- Cyberattack response: country-by-country guides
Nine country guides, local-language editions and downloadable non-executable BPMN response processes.
- Cyberattack response for companies in the United States
Evidence, reports, counsel, insurance and public communications after a cyberattack in the United States.
- Cyberattack response for companies in the United Kingdom
Evidence, reports, counsel, insurance and public communications after a cyberattack in the United Kingdom.
- Cyberattack response for companies in Canada
Evidence, reports, counsel, insurance and public communications after a cyberattack in Canada.
- Cyberattack response for companies in Australia
Evidence, reports, counsel, insurance and public communications after a cyberattack in Australia.
- Cyberattack response for companies in Germany
Evidence, reports, counsel, insurance and public communications after a cyberattack in Germany.
- Cyberattack response for companies in France
Evidence, reports, counsel, insurance and public communications after a cyberattack in France.
- Cyberattack response for companies in the Netherlands
Evidence, reports, counsel, insurance and public communications after a cyberattack in the Netherlands.
- Cyberattack response for companies in Singapore
Evidence, reports, counsel, insurance and public communications after a cyberattack in Singapore.
- Cyberattack response for companies in Japan
Evidence, reports, counsel, insurance and public communications after a cyberattack in Japan.
- Cybersecurity daily — 1 November 2026: MCP migration and corrected extension scope
Smithery's connection-management shutdown date has arrived; Cursor's notice also names 2.1.312. Distinguish planned shutdown, observed operation and verification time.
- Cybersecurity daily — 31 October 2026: extension removal is not incident recovery
Cursor extension follow-up, Wasmtime UDP authorization bypass, and updated AWS Brotli mitigation status. Check host privileges, network authorization and deployed patches.
- Cybersecurity daily — 30 October 2026: verify enforcement beyond configuration
Clerk adds passkeys as a second factor; an older PDF MCP authentication flaw enters the advisory database. Verify enforcement, not just settings and logs.
- Cybersecurity daily — 29 October 2026: verify that Brotli patches are active
AWS details Brotli mitigation: phased Lambda rollout, Node.js 24 verification, container rebuilds and upstream-response decoding.
- Cybersecurity daily — 28 October 2026: separate detection, delegation and runtime authorization
Zuma/Agent Gateway runtime authorization and Socure Agent Intelligence: distinguish release stages and authority boundaries.
- Cybersecurity daily — 27 October 2026: the boundary around agent-managed IAM
Google Cloud introduces IAM Helper. Separate diagnostics and simulation from permission changes, and verify the approval-to-execution boundary.
- Why Faster Cybercrime Intake May Not Reduce Case Backlogs
Public Japanese statistics and an explicit queueing model show why faster intake may shift a bottleneck downstream. Evidence preservation, international assistance, and deterrence require distinct measurements.
- Crypto fraud and theft: Japanese requests for Canadian asset restraint and seizure
For Japanese victims and receiving police officers: RCMP cooperation, formal central-authority requests, evidence and translations, procedural-stage conditions and asset return.
- Prompt injection is not SQL injection: the NCSC design lesson
The NCSC blog says prompt injection is not SQL injection: current large language models do not separate instructions from data, and the risk may never be fully removed the way parameterized queries remove SQL injection (https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection). The NCSC news warns that the comparison is dangerous and challenges claims that the issue can be stopped (https://www.ncsc.gov.uk/news/mistaking-ai-vulnerability-could-lead-to-large-scale-breaches). Design lesson only. Not an attack guide and not legal advice.
- Wetin you go tell client about EU AI Act Article 50 label
Commission Article 50 page separate provider duty from deployer duty for interaction notice, machine-readable mark, and deep-fake disclosure (https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50). One law-firm alert talk say those duty become applicable on 2 August 2026 and dem no defer am with high-risk rule (https://www.goodwinlaw.com/en/insights/publications/2026/08/alerts-technology-dpc-eu-ai-act-transparency-obligations-now-in-force). General information, e no be legal advice.
- Cybersecurity exercises wey dey follow industry workflows
24 industry views, 18 technical surfaces, and eight offline exercises wey dey connect CTF learning to continuity, repair, and recovery.
- AI video, voice impersonation, and di boundaries of authority
A sourced review of Tavus, reported AI misuse, and di identity, consent, and tool authority boundaries wey adopters suppose test.
- System One Coding: to compose code through decisions
Typed blocks, staged verification, measured comparisons, and a registered free pilot.
- If dem take over your account: timeline and evidence list to make before you consult police (you fit copy am)
After account takeover, wetin to keep and no delete. Copy-ready timeline and evidence list. Then contact your country police or cybercrime reporting service, and your bank or payment provider.
- If crypto-asset fraud reach you: how to make di remittance table to carry to police and di exchange
For crypto or investment fraud, before another transfer or a "recovery operator," put each payment and message on 1 sheet. Then contact your country police or cybercrime reporting service, your bank or payment provider, and di exchange. Dis page no promise recovery.
- IC3 complaint worksheet: wetin to gather before you file (crypto and online fraud)
Prepare every field wey FBI IC3 dey ask — losses, transaction hashes, details of di oda party, headers — then file 1 complete complaint and keep your copy.
- Why enterprise need twin, and how Mithril dey provide am
Production no be di correct place to learn who fit reach sensitive system, how refusal dey look, or weda di cluster wey dey run na di one wey dem declare. Twin dey keep dose names and e no dey apply di result. Mithril dey turn dat twin to document: reverse-domain components dey compose, one run dey return di response and di decision, and dem dey check cluster against wetin dem observe without to start am.
- No key wey dem steal, $351 million for 1 hour — Bitget hot-wallet breach and di trust boundary of di approval flow
Bitget confirm on September 25 say about $351.6 million leave parts of im hot and warm wallets for unauthorized transfers wey dem detect at 18:31 UTC on September 24. Di offline cold wallets, as dem report, no dey affected, withdrawals dey paused, and di exchange talk say im $464 million User Protection Fund cover di full loss. As Bitget talk, di attacker no take di private keys but reach backend system and spoof transaction data to steer di approval flow to release funds. We dey look di Lazarus attribution question and di same shape with di management-and-identity-plane theme wey dis observatory cover for recent weeks.
- Di week wey di identity issuer itself fall — F5 BIG-IP APM OAuth zero-day (CVE-2026-94127) and how KEV gather for management and identity planes
F5 disclose for 22 September say critical zero-day for BIG-IP APM OAuth path (CVE-2026-94127, CVSS 9.8) dey allow unauthenticated remote code execution, and dem confirm say exploitation dey happen for di wild. CISA add am to di KEV catalog di same day with federal deadline of 25 September. Arista VCO and two Check Point management-server flaws enter KEV dat day too — we dey look di way attacks gather on boundary appliances dem management and identity planes.
- Di week wey di road to local root open all at once — Linux kernel LPEs enter CISA KEV catalog as public exploits land
For 18 September, CISA add three Linux kernel flaws wey dem dey actively exploit (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to di KEV catalog and Red Hat confirm say public exploit code dey. Di same day, working exploits for four kernel LPEs (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) come out under coordinated disclosure. We dey look why shared-host privilege escalation dey follow boundary appliances into di spotlight.
- Auth bypass wey get maximum severity hit di identity authority itself — Cisco ISE CVE-2026-76460 and di pattern wey dey repeat of boundary-appliance root compromise
Cisco ISE / ISE-PIC authentication bypass CVE-2026-76460 (CVSS 10.0) dey under active exploitation. CISA add am to di KEV catalog for 16 September with federal remediation deadline of 19 September; workaround no dey and iACLs na only mitigation. We dey look di boundary-appliance root-compromise pattern — wey dey run parallel with di Secure Email Gateway zero-day (CVE-2026-76461) wey dem disclose 14 September — and wetin e mean when logs of compromised appliance itself stop to be primary source.
- AI gateways don become di attack surface — LiteLLM KEV listing and di path through keys, MCP, and di cloud
BerriAI LiteLLM MCP authentication bypass (CVE-2026-59822) don land for CISA KEV catalog, and Microsoft report say attackers dey use LiteLLM gateways to deliver XMRig. Wiz research find roughly 1 in 10 of ~3,000 public instances accept di default key sk-1234 or run with no auth. We dey look wetin e mean say AI infrastructure na vault of credentials.
- When dem hijack di body of di agent — one extension wey dey drive AI assistants across five products
Forever Security show say one ordinary browser extension fit drive di built-in AI of five products — Chrome, Comet, Edge, Opera Neon, and Claude. Separately, Mandiant report say attacker hijack AI coding-assistant session and spread di Shai-Hulud worm across about 100 repositories. We dey map di trust boundaries of agentic runtimes.
- Zero-day chain of «patch gap» — bugs wey dem don fix for Chromium but wey dem never fix for Chrome, wey multiple spy groups share inside 1 week
E come out say di BlueMoon attack chain, wey join Chrome V8 sandbox escape with Windows ALPC abuse, dey shared by at least multiple clusters wey dem describe as China-origin, according to Volexity observation. Fix don enter Chromium but e never reflect for stable Chrome, and we dey arrange di danger of dis «patch gap».
- VC Brief: SYN Ventures — cybersecurity specialist fund wey operators dey lead
Fund wey operators dey lead, with $900M AUM, wey former CISOs and founders build. We dey map di two funds and ~40-company portfolio against di position of mithril.fund.
- Cisco Secure Email Gateway zero-day CVE-2026-76461 — when email-parsing SQL injection end for root execution
CVE-2026-76461 (CVSS 9.8) dey actively exploited and dem add am to CISA KEV catalog. We dey break down di pattern wey dey repeat of «root compromise of boundary appliance» — and wetin e mean when di appliance own logs no fit trust again.
- We dey introduce di Security Observatory blog
Every day dem dey observe and analyze cybersecurity news, incidents, and how AI models dey develop, and dem dey publish am here.
- Unauthenticated file writing through di mail gateway back door — FortiMail zero-day CVE-2026-104286 and di IBE feature
For 1 October, Fortinet disclose di path traversal zero-day wey dey inside FortiMail (CVE-2026-104286, CVSS 9.8) wey make unauthenticated arbitrary file writing possible, and confirm say di exploitation don happen in di wild. CISA add am to KEV catalog same day with di federal deadline for 4 October. No patched release don publish for any of di four affected branches, so disabling IBE be di stopgap — we dey look am against di late-September KEV surge.
- From scam victims reach enterprise white hats: map of di cybersecurity landscape (2026)
Thirteen categories, from help for scam victims to enterprise security testing, with reported losses, funding wey dem announce, market forecasts by publisher, and an honest status of where Mithril dey fit.
- SAML-Conditioned Memory Overflow for NetScaler — CVE-2026-88779 Don Enter KEV (Due October 7)
Citrix don show memory-buffer-bounds flaw for NetScaler ADC / Gateway (CVE-2026-88779, CVSS v4.0 8.7, CWE-119). Citrix say dem observe targeted attacks on deployments wey never get mitigation, and the attacks fit lead to denial of service. CISA KEV listing show say the vulnerability don dey exploited, and the short description say the flaw fit allow denial of service. No one among the two sources confirm say affected deployments don actually go down. CISA add am on October 4, federal due date na October 7. Together with CVE-2026-88771 and CVE-2026-88772 (both added September 27), na the third NetScaler KEV entry wey dem add within two weeks, no be the product third KEV for all time (earlier entries include CVE-2023-4966). Global Deny List signatures (v24 or later) na the interim mitigation, and the fix dey for 14.1-73.41 / 13.1-64.28 or later.
- Unauthenticated API access in Cisco Catalyst SD-WAN Manager — CVE-2026-76504 Added to KEV (Due October 3)
Cisco published CVE-2026-76504 (CVSS 3.1 9.8 per Cisco, CWE-177) in advisory cisco-sa-sdwan-webauth-xr8beuuU: improper URI-encoding handling in the API session-based authentication management of Cisco Catalyst SD-WAN Manager can let an unauthenticated remote attacker reach the API with admin privileges. CISA added it to KEV on September 30, 2026, with a federal due date of October 3. Fixed releases start at 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 (earlier branches migrate). No known workarounds exist; interim mitigation is restricting internet access to trusted hosts, plus the optional Live Protect shield. Cisco has confirmed exploitation in the wild.
- Apple CoreGraphics zero-day added to KEV — CVE-2026-86950, report of exploitation in an extremely sophisticated targeted attack (Due October 2)
On September 28, 2026, Apple released iOS 26.7.1 / iPadOS 26.7.1 / macOS Tahoe 26.7.1 / macOS Sequoia 15.8.1, fixing an out-of-bounds write (CVE-2026-86950, CWE-787) in CoreGraphics. Processing a maliciously crafted file may lead to arbitrary code execution; Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. CISA added the vulnerability to KEV on September 29, 2026, with a federal due date of October 2 (forensicTriage Yes). The CISA-ADP CVSS 3.1 base is 8.8 (High). The fix is the listed releases only; the primary sources reviewed for this post state no interim workaround.
- Binance: 'No wallet key leaked' - the largest hot-wallet incident on record (10/29) and first observations
From the night of October 29 UTC Binance disclosed a security incident involving unauthorized withdrawals from its hot wallets. Its verified frozen total stood at $2.54B (23:22Z) and then 'around $3 billion' (10/30 00:52Z); it states it will cover all losses and suspended deposits and withdrawals. Its initial investigation 'may involve a compromised DevOps engineer's laptop' through which an attacker reached a service container and submitted unauthorized withdrawal transactions, with no evidence of a wallet private-key leak. Reported stolen amounts range $5.6B-$6.3B with no confirmed total. This article records the first passive observation of 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 (named by ZachXBT after the Arbitrum Security Council's ~$30.5M freeze; first tx 10/29 21:29:47Z, 3 EVM txs, 0.0038 ETH) the on-chain verification of the Arbitrum freeze transaction (from = the address itself), and two converging third-party attribution claims (TRM Labs: TraderTraitor; Specter: commingling with the DPRK-attributed Bitget exploit via THORChain).