Briefing — 12 October 2026

🎧 Subscribe to the podcast feed

Security News

AI Systems Fully Capable of Nightmare Infrastructure Attacks, Defenders May Have Minutes to Respond (The Register) — A Booz Allen Hamilton report finds autonomous AI can identify and attack OT/ICS targets including water, power, and critical services, with defenders facing extremely compressed response windows.

FBI Arrests Cybersecurity Executive Over Data Breach After Oracle HR Platform Left Unpatched (Slashdot / CNN) — Canadian exec Edward Dubrovsky arrested on extortion and false statements charges tied to a hack exposing sensitive data of current and former FBI employees, traced to an unpatched contractor system.

Nippon Columbia Malware Incident Exposes 8.6 Million Records (BleepingComputer) — Daiichi Kosho disclosed a malware infection at contractor Nippon Columbia exposed over 8.7 million customer and employee records from its karaoke entertainment platform.

ShinyHunters (UNC6240) Targets Education Sector via Oracle PeopleSoft RCE (CVE-2026-35273, CVSS 9.8) (Google Threat Intelligence / Mandiant) — Active compromise and extortion campaign exploiting a critical PeopleSoft vulnerability observed in May–June 2026; education sector administrators should patch immediately.

Yandex Bot Traffic Drops 99% After Data Centre Attack (Cloudflare Radar / Hacker News) — Cloudflare telemetry shows Yandex crawler traffic nearly eliminated following what appears to be a major disruption to the company's data centre infrastructure.

Let's Encrypt Cutting TLS Certificate Lifetimes to 64 Days from February 2027 (Slashdot) — Staging environment testing begins October 14; administrators with static cron renewal jobs must review configurations. A further reduction to 45 days is planned for 2028.

Meduza Locker Ransomware Adds 7 Unidentified Victims in Single Morning (Threat Feed) — Seven new victims posted in rapid succession overnight with data publication windows ranging from 2–14 days, indicating an active and ongoing campaign.

Booking.com Reservation Database Offered for Sale (Threat Feed) — Threat actor claims to be selling a database containing Booking.com reservation records including guest names, contact details, hotel information, booking amounts, and confirmation numbers.

ICS/OT Access to Wisconsin Fuel Station Listed for Sale (Threat Feed) — Actor claims VNC access to industrial control systems at a fuel station including fuel inventory monitoring and multiple industrial hosts — a direct CNI targeting incident.

CVE-2017-5638 (Apache Struts S2-045) Actively Exploited Against Polish Government System (Threat Feed) — A nine-year-old Apache Struts vulnerability being used to compromise an academic/government entity in Poland, demonstrating persistent risk from unpatched legacy systems.

UK & Critical National Infrastructure

No new NCSC advisories were issued in the past 48 hours.

Three UK organisations appeared in the same underground access marketplace today: Keynect (professional services), Touch-Base Ltd (software development), and Omfax Systems Ltd (software development) all had claimed unauthorised access listed for sale by actor 512bit. The batched, same-vendor listing suggests coordinated initial access broker activity targeting UK SME tech firms.

On the OT/ICS front, two incidents in today's threat feed are directly relevant to UK CNI operators. A fuel station in Wisconsin and a municipal swimming pool in Italy both had their industrial control systems allegedly compromised — with the pool incident giving the attacker claimed control over heating, cooling, ventilation, pumps, and alarm systems. Neither is a UK incident, but both are consistent with the pattern NCSC has previously warned about regarding internet-exposed OT infrastructure.

The Booz Allen Hamilton AI-versus-OT report referenced in the security news section is particularly relevant for UK defenders: it describes a capability gap where AI-enabled attacks on industrial systems could outpace human detection and response. This aligns with recent NCSC messaging on disruptive cyber activity and internet-exposed edge devices.

Ransomware Victims (48h)

30 victims · 10 groups