Briefing — 7 October 2026

🎧 Subscribe to the podcast feed | Download episode

Security News

Hackers obtain counterfeit TLS certificates for Google and other large services (Ars Technica) — A critical PKI-level threat: attackers have obtained forged TLS certificates for major services including Google, undermining the browser trust model and enabling potential man-in-the-middle attacks at scale.

Hackers exploit 32 zero-days on first day of Pwn2Own Ireland (BleepingComputer) — Researchers demonstrated 32 previously unknown vulnerabilities on day one, targeting mobile devices, routers, NAS devices, and cameras — IoT and OT edge device classes with notoriously slow patch cycles.

South Korea president confirms AI agents used in coordinated 7-bank hack (Reuters) — The first official government-level acknowledgement of AI-assisted offensive hacking at scale; a single attacker IP simultaneously targeted Shinhan, Yegaram, KB Kookmin, Hana, BNK Busan, Welcome Savings, and Hyundai Capital banks.

Over 1 million records stolen from Arizona court system (SecurityWeek) — Court data is an especially rich target combining legal histories, addresses, dates of birth, and financial information for a large population.

Ninja Forms plugin flaw exploited to hack WordPress sites (BleepingComputer) — Active exploitation of a vulnerability affecting one of WordPress's most widely-installed form plugins (1M+ installations); patch immediately.

ClickFix attacks evolve to better hide malicious payloads (Dark Reading) — Social engineering lures tricking users into running malicious commands via fake browser prompts have been updated to evade existing detection signatures.

Aon falls victim to TERMITE ransomware — The global professional services and insurance giant, which handles sensitive HR, insurance, and financial data for thousands of corporations, has been listed as a TERMITE victim with significant downstream exposure risk.

LockBit 5.0 resurfaces with two new victims — The group, which appeared disrupted earlier this year, has listed two new victims on a threat feed. Renewed activity warrants close monitoring.

Trump Mobile suffers data breach (CyberSecurityNews) — The Trump-branded mobile carrier has confirmed a data breach exposing customer information.

IBM and Red Hat find 400+ vulnerabilities in popular Java libraries (Slashdot) — A significant advisory load for enterprise security teams to triage, spanning widely-deployed Java components.

Anthropic reconfigures its security research programme (The Register) — Changes to Anthropic's vulnerability disclosure and researcher engagement structure.

OpenAI to watermark ChatGPT outputs by default — but only in the EU (Ars Technica) — EU AI Act compliance driving default C2PA watermarking on generated content; no equivalent commitment for other jurisdictions.

UK & Critical National Infrastructure

ASOS confirms hackers sent unauthorised notification to app users (Slashdot) — UK online retailer confirms its mobile app notification infrastructure was abused, likely via a compromised account. Notification platforms are an underestimated attack surface for credential theft and phishing amplification.

No new NCSC advisories in the past 48 hours.

The counterfeit TLS certificate story deserves urgent attention from UK defenders: any organisation that relies on HTTPS as a trust boundary should immediately review certificate transparency log monitoring, browser pinning policies, and whether their certificate management processes would detect a rogue certificate issued for their domains. The Pwn2Own zero-day disclosures over the coming days will likely include devices widely deployed in UK enterprise and OT environments — monitor vendor advisories closely.

Ransomware Victims (48h) — 47 victims · 18 groups

HaveIBeenPwned — New Breaches