Briefing — 18 October 2026

🎧 Subscribe to the podcast feed | Download episode

Security News

Saudi OpenAI Employee's Arrest Revives Fears About AI Company Espionage (Slashdot / Washington Post) — Abdulrahman Alfozan, 35, a Saudi national working at OpenAI, was arrested by the FBI. He has not been charged with espionage, but the DOJ's National Security Division Counterintelligence section is handling the case. The DNI confirmed state-sponsored espionage against private sector AI companies is a reality. An ex-CIA official called it "probably the tip of the iceberg."

NCSC: Post-quantum updates to TLS guidance (NCSC) — The NCSC published revised TLS guidance on October 15th endorsing hybrid PQC configurations under the IETF's RFC 10024. The core message: organisations must migrate to TLS 1.3 now — earlier TLS versions cannot support post-quantum cryptography. High-priority migration activities should be completed before 2031, though stable implementations are already available.

HELIX claims Quikrete breach (Threat Feed) — The HELIX ransomware group claims to have breached Quikrete, the US concrete products company, allegedly exposing 630,839 customer records, 484,853 email addresses, 1.5 million phone records, 1.4 million postal addresses, and over 729,000 sales orders across multiple datasets.

ARS META SALUD data leaked (Threat Feed) — Sons of Anarchy claim to have leaked health insurance data from ARS META SALUD in the Dominican Republic, including national identity numbers, social security numbers, health plan enrolment details, dates of birth, and full contact records.

N0VEMBER SQL injection attacks (Threat Feed) — Threat actor N0VEMBER has conducted SQL injection attacks against the Computer Society of India (a repeat breach — previously hit in July 2026) and the Argentine education platform CyTA, both via active SQL injection vulnerabilities.

NightSpire claims redacted victim (U**IN* Group) (Threat Feed) — NightSpire ransomware group has listed an unidentified victim identified only as "U**IN* Group" with data publication threatened within 2–3 days.

UK & Critical National Infrastructure

No new NCSC advisories in the past 48 hours. The most significant CNI-relevant development this window is the NCSC's post-quantum TLS guidance — the first time the NCSC has made a clear, time-bound recommendation to migrate to TLS 1.3 specifically to enable quantum-resilient cryptography. Organisations running TLS 1.2 or older should treat this as a firm migration trigger, not an advisory to file.

Redact's listing of ONEOK Inc — a US pipeline and natural gas distribution operator with $39.4B revenue — is the highest-revenue critical infrastructure claim this window. Parker-Hannifin, while classified as manufacturing, supplies motion and control technologies across aerospace, defence, and industrial sectors. Both listings remain unverified but Redact has a track record of publishing exfiltrated data.

The Brenner Base Tunnel listing by Everest is notable: this is a joint Austrian-Italian sovereign infrastructure project, not a private company. It represents a continued pattern of ransomware groups targeting major European infrastructure construction projects where sensitive engineering data and government procurement records are at stake.

The Saudi OpenAI arrest has direct implications for AI supply chain security in the UK. NCSC guidance on AI model governance should be read in conjunction with the insider threat risk this case illustrates — particularly for UK organisations with deep AI vendor dependencies.

CISA Known Exploited Vulnerabilities

• CVE-2026-21589 — Atlassian Multiple Products: Unauthenticated file access vulnerability in web application root directory. Added 15 October 2026.
• BeyondTrust and Fortinet products — added 16 October 2026 (see CISA KEV catalogue for details).

HIBP New Breach

Gîtes de France — The French holiday rental network suffered a breach in May 2026, added to HIBP on 18 October 2026. 117,574 unique email addresses exposed alongside names, phone numbers, postal addresses, and booking details.

Ransomware Victims (48h) — 48 victims · 13 groups