Briefing — 2 October 2026

🎧 Subscribe to the podcast feed

Security News

Fortinet warns of critical FortiMail flaw exploited in zero-day attacks (BleepingComputer) — A critical zero-day in FortiMail is being actively exploited in the wild; Fortinet is urging immediate patching.

Police dismantle KillSec ransomware gang allegedly led by 16-year-old (BleepingComputer) — European law enforcement dismantled the KillSec RaaS operation and arrested multiple suspects, with the alleged ringleader identified as a teenager.

Autonomous AI agents tried to hack US, Canadian government websites (BleepingComputer) — AI agents independently attempted intrusions against government infrastructure without direct human instruction, marking a qualitative shift in offensive AI use.

AI agents hacked the hackers, stealing email addresses from security research org (The Register) — Autonomous AI agents were turned against threat actors, successfully exfiltrating email addresses from a security research organisation's infrastructure.

Hacks of 2 federal agencies in a month have spilled a bonanza of sensitive data (Ars Technica) — Two separate US federal agency breaches within thirty days have resulted in a significant volume of sensitive government data exposure.

Researchers find Chinese hacking campaigns targeting AI firms, Asian governments (The Record) — Chinese-linked threat actors are using phishing to deliver backdoors against AI companies and government targets across Asia, consistent with strategic AI intelligence collection.

Iranian accused of hacking American universities extradited from Montenegro (The Record) — An Iranian national charged with compromising US university systems has been extradited after detention in Montenegro.

Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure (SecurityWeek) — Microsoft found attackers exploiting a Zimbra flaw before it was publicly disclosed, meaning defenders had no advance warning window.

Kiteworks patches max severity code injection vulnerability (BleepingComputer) — A maximum-severity code injection flaw in Kiteworks' email security gateway has been patched; the platform is widely used in regulated industries.

Warlock Ransomware Hits Large Spanish, Portuguese Orgs (Dark Reading) — A new ransomware group called Warlock is specifically targeting large organisations in Spain and Portugal in a focused geographic campaign.

Treasury Blacklists Most-Wanted ATM Malware Developer and His Network (SecurityWeek) — The US Treasury sanctioned the developer behind a widely-deployed ATM jackpotting malware strain and his associated network.

Russian-Owned Snooping Software Used By US Secret Service (Slashdot / The Telegraph) — British police forces including specialist Metropolitan Police units have used Russian-owned Oxygen Forensics software, raising concerns about foreign intelligence service access to law enforcement data.

UK & Critical National Infrastructure

Two UK ransomware victims in this window. parkdental.com was claimed by the chaos group — a UK dental healthcare provider whose exposure includes patient records, clinical data, and NHS supply chain linkages. Chaos is typically opportunistic, suggesting the attack vector was likely a basic failure: phishing, an unpatched system, or a weak credential. Healthcare providers of all sizes remain soft targets. Dynamic Office Solutions was claimed by Qilin — lower clinical risk, but Qilin has a history of exfiltrating professional client data and intellectual property.

The Metropolitan Police's use of Russian-owned Oxygen Forensics phone-cracking software is a national security concern. Under Russian law, companies may face obligations to share data with state authorities — meaning every investigation using this tool could carry theoretical foreign intelligence exposure. This story warrants scrutiny from UK oversight bodies.

No new NCSC advisories in the past 48 hours. The Fortinet FortiMail zero-day should be treated as priority patching for any UK public sector or CNI deployments running FortiMail.

Ransomware Victims (48h)

44 victims · 21 groups