Top Security Breaches 2026-10-06

Auto-generated 2026-10-06T09:00:38.863148+00:00 (UTC)

1. ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

   Source: The Hacker News | Published: 2026-10-05T14:20:43+00:00 | Score: 20.767
   

   A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook.

   There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others

   Original: https://thehackernews.com/2026/10/weekly-recap-netscaler-and-fortimail-0.html

2. Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers

   Source: The Hacker News | Published: 2026-10-01T16:55:57+00:00 | Score: 17.799
   

   Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid.

   The 16-year-old was one of 3 people arrested on September 30, when police also took control of that site.

   Investigators identified him as KillSec’s suspected

   Original: https://thehackernews.com/2026/10/police-arrest-16-year-old-suspected-of.html

3. Denmark population registry data breach affects 8.8 million people

   Source: BleepingComputer | Published: 2026-10-05T15:21:10+00:00 | Score: 17.404
   

   Denmark’s Central Population Register (CPR) is warning of a data breach that exposed the personal information of approximately 8.8 million registered individuals. […]

   Original: https://www.bleepingcomputer.com/news/security/denmark-population-registry-data-breach-affects-88-million-people/

4. FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach

   Source: The Hacker News | Published: 2026-10-06T06:56:57+00:00 | Score: 14.674
   

   The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of personal details of thousands of bureau employees.

   That’s according to a report from Reuters, citing two sources familiar with the matter.

   “To date, our review has determined that the incident occurred as the result of a security failure ​

   Original: https://thehackernews.com/2026/10/fbi-removes-accenture-contractor-after.html

5. Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

   Source: The Hacker News | Published: 2026-10-03T14:36:33+00:00 | Score: 12.97
   

   The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries.

   The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations.

   “In the

   Original: https://thehackernews.com/2026/10/warlock-exploits-sharepoint-flaws-to.html

6. Know Your Enemy: Browser-Based Attack Techniques in 2026

   Source: The Hacker News | Published: 2026-09-30T11:58:00+00:00 | Score: 12.937
   

   Given that the browser is where business apps are accessed and used, it makes sense that attacks are happening there too. Most breaches today begin in a browser session. Often, they never leave it, with the entire attack chain from initial access to exfiltration playing out in the browser.

   Here are the six most dangerous techniques that should be on every security team’s radar in 2026.

   1.

   Original: https://thehackernews.com/2026/09/know-your-enemy-browser-based-attack.html

7. WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

   Source: The Hacker News | Published: 2026-10-01T14:37:35+00:00 | Score: 12.91
   

   Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again.

   The backdoor has been codenamed SC after the “SC_” markers present in the injected content. Sucuri has described the malware as a “self-healing mesh” that’s

   Original: https://thehackernews.com/2026/10/wordpress-backdoor-rebuilds-itself.html

8. Russia’s Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor

   Source: The Hacker News | Published: 2026-09-29T17:20:08+00:00 | Score: 12.704
   

   Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft.

   The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since January, mostly in the U.S. and U.K. At least one computer was infected, but the number of breached

   Original: https://thehackernews.com/2026/09/russias-star-blizzard-targets-100.html

End of report.