Briefing — 10 October 2026

🎧 Subscribe to the podcast feed | Download episode

Security News

Japan confirms arrest of Russian Qilin operative, extradition to Germany (The Record) — Japan's National Police Agency confirmed the arrest and extradition to Germany of a Russian national linked to the Qilin ransomware group — the first publicly confirmed Qilin arrest.

FBI arrests second suspected ShinyHunters member after FBI breach (BleepingComputer) — A second ShinyHunters suspect has been arrested following last month's confirmed breach of FBI systems by the group; the FBI Director confirmed the arrest.

FBI arrests co-founder of ransomware negotiation firm (Krebs on Security) — The FBI arrested the co-founder of a Canadian cybersecurity firm specialising in ransomware recovery, following the DOJ charges pattern reported earlier this week against Zohar Pinhasi.

Hackers abuse Google Ads and Bing redirects to push Claude ClickFix malware (BleepingComputer) — Attackers are embedding legitimate Bing redirect URLs in Google search ads pointing to fake Claude AI installer pages that deliver credential-harvesting malware via ClickFix.

AWS AgentCore security undone by single credential-requesting prompt (The Register) — A now-patched prompt injection vulnerability in AWS Bedrock AgentCore could allow a single crafted prompt to steal credentials and pivot across an organisation's entire agent fleet.

Unpatched AhsayCBS backup platform flaws exploited for webshells and cryptomining (BleepingComputer) — Critical and medium-severity vulnerabilities in AhsayCBS enterprise backup management are being actively exploited to deploy webshells and mine cryptocurrency; audit exposure immediately.

iRhythm cardiac sensor company notifying states of data breach (The Record) — iRhythm, which makes wearable cardiac monitoring patches used by hundreds of thousands of patients, has begun notifying regulators of a breach from earlier this year involving sensitive health and device data.

Ukraine drones knock out two Yandex AI data centres (Ars Technica) — Drone strikes destroyed two of five Yandex data centres, disrupting the dominant Russian internet and AI platform's advertising, search, and mapping services.

ASOS breach reveals the risks in customer-facing SaaS identity (Dark Reading) — Analysis of the ASOS social engineering attack shows how compromising a single employee identity via push-bombing enabled much deeper corporate network access — a warning for all SaaS-heavy retail operators.

OpenAI fires three safety researchers in dispute over AI risk handling (SecurityWeek) — OpenAI dismissed three safety researchers it says violated policies on handling sensitive information; the researchers dispute this, citing disagreements over how AI safety concerns are escalated.

UK & Critical National Infrastructure

lopay, a UK-based fintech payments company, is the sole UK victim in this ransomware window, claimed by Black X. lopay operates in the financial services sector; organisations using lopay should monitor for any service anomalies or vendor communications.

The ongoing ASOS breach analysis is directly relevant to UK retail and e-commerce organisations. Dark Reading's assessment highlights that a single compromised identity — obtained via social engineering and push notification fatigue — gave attackers access beyond the initial compromise point. UK retailers operating mixed SaaS environments should review identity and MFA posture.

No new NCSC advisories in the past 48 hours. The Qilin arrest in Japan and Rhysida's targeting of US county government both warrant monitoring: Qilin has UK victims in previous windows, and Rhysida has previously targeted NHS organisations.

Ransomware Victims (48h) — 37 victims · 20 groups

HaveIBeenPwned — New Breaches