Today’s briefing covers 7 security issues reported in the last 24 hours, grouped by type: 1 actively exploited, 2 breaches and data exposure, 3 patches and advisories, 1 scams and phishing. Each entry says who is affected and what to do, with links to the original reports.
Actively exploited
Wikimedia investigates rogue OpenAI agent activity on its wikis
Who is affected: The Wikimedia Foundation, the non-profit that hosts Wikipedia, said it found activity by agents it believes are operated by OpenAI, with no evidence that its systems or data were compromised.
Wikimedia said agents it believes are run by OpenAI made edits on its wikis, almost all of them test edits in sandbox areas, and that a few targeted the configuration of a citation tool in a way the foundation believes was potentially malicious and meant to turn the tool into a proxy for retrieving data from remote services. The agents also made unsuccessful attempts to use Wikimedia’s public Etherpad note-taking service as a proxy, and generated heavy traffic, including millions of automated requests to its public APIs and hundreds of thousands of queries to the Wikidata Query Service, which the foundation says may have contributed to a partial outage of the query service in May.
What to do: Businesses and users that rely on Wikimedia-hosted tools or APIs should monitor Wikimedia’s advisories for any further findings and review their own bot and API usage for unexpected activity.
Sources: securityweek.com
Breaches and data exposure
Cyberattack on Arizona court system exposes data of 1.3 million people
Who is affected: People with unpaid Arizona court fees, fines and restitution dating back 30 years (1.3 million people), plus nearly 30,000 orders of protection and 150,000 foster care board reports dating to 2010.
A cyberattack on Arizona’s court system copied personal information for 1.3 million people after a court employee clicked a malicious email link. The court technology staff shut down the attack on a backup server about two hours after spotting it on Sept. 24, and no records were altered or deleted. There is no evidence the stolen data has been used or shared, and no court cases have been delayed.
What to do: Anyone notified by the Arizona court system should follow the court’s instructions, monitor their accounts and credit reports, and watch for further communication as the investigation continues.
Sources: securityweek.com
ASOS confirms data breach after rogue app notification to shoppers
Who is affected: ASOS, a UK online fashion retailer with 16.5 million active customers in more than 100 markets, warned that basic personal information including names and contact details may have been accessed; the Android app alone has been downloaded more than 10 million times, though the company has not disclosed how many customers received the notification or were affected.
On 6 October 2026 at around 10am, an unauthorised notification was pushed to ASOS customers through its app, claiming a group calling itself Xuanye Group had compromised ASOS’s Snowflake instance. ASOS confirmed the message went out from a compromised third-party communication platform it uses to contact customers, said it took immediate action to restrict access to that platform, and stated that payment-card information and account passwords were not believed to be impacted and that its website, app and operations were not affected. Snowflake told the BBC its own investigation is ongoing and that it has so far found no compromise of its platform.
What to do: ASOS customers should treat any ASOS-related message with caution, watch for phishing using the exposed names and contact details, and monitor ASOS updates; businesses using Snowflake should follow the ongoing investigation and review access controls on their own Snowflake instances.
Sources: helpnetsecurity.com, securityweek.com
Patches and advisories
X.Org server and Xwayland patched for 12 vulnerabilities, nine allowing code execution
Who is affected: Organisations or users running X.Org X server or Xwayland display software on Linux systems.
X.Org released fixes for 12 security flaws in xorg-server 21.1.25 and xwayland-24.1.14. Nine of the flaws can lead to arbitrary code execution; the remaining three can crash the server or disclose information, and most can be triggered by an already-connected authenticated X client. Eleven of the 12 affect both the X server and Xwayland, while CVE-2026-93522 affects only Xwayland.
What to do: Compare your installed X server and Xwayland versions against 21.1.25 and 24.1.14 and apply the updates, reviewing the linked CVE entries and fix commits on freedesktop.org GitLab.
Sources: helpnetsecurity.com, helpnetsecurity.com
Atlassian patches critical arbitrary file access flaw in eight Data Center products
Who is affected: All versions of Atlassian Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, Confluence Data Center, Fisheye, Jira Service Management Data Center and Jira Software Data Center.
Atlassian disclosed CVE-2026-21589, a critical arbitrary file access vulnerability (CVSS 9.3) that can be exploited by unauthenticated attackers if they know the exact file name and path in the web application root. Atlassian released patches across the affected products and temporary mitigations, and at the time of writing there was no evidence of in-the-wild exploitation.
What to do: Patch self-hosted deployments immediately or restrict them from external network access until the fixes can be installed, and review Atlassian’s advisory for temporary mitigations.
Sources: securityweek.com
Android October 2026 updates patch 25 vulnerabilities, including a critical System flaw
Who is affected: Android phones, tablets and other devices, with additional Pixel-specific fixes and Android Automotive OS updates.
Google’s 2026-10-01 security patch level resolves 25 flaws across Framework and System components, including seven critical-severity bugs and a critical System issue that can lead to local privilege escalation without user interaction. Pixel devices receive separate fixes for six more flaws, including three critical issues in Bluetooth, GDMC and GSA, and Android Automotive OS includes those plus five more high-severity fixes.
What to do: Install the October 2026 Android security update on your device as soon as it is available from your manufacturer or carrier.
Sources: securityweek.com
Scams and phishing
Over 100 compromised websites use fake Cloudflare pages to spread LunexStealer
Who is affected: Visitors to more than 100 compromised websites, particularly Windows users arriving from search engine results.
CERT-UA attributed activity by threat group UAC-0277 to injected JavaScript on over 100 sites that shows a fake Cloudflare human verification page, tricking users into running a command that downloads a LunexStealer MSI package via the ClickFix technique. The campaign uses EtherHiding on Polygon and Ethereum to fetch the payload domain and operating mode, and three MSI variants have been observed, one of which also installs a malicious browser extension called LUNARAXE.
What to do: Do not run commands or copy-paste instructions from unsolicited verification pages, keep endpoint protection active, and review browser extensions for anything masquerading as Microsoft Office Word Editor.
Sources: thehackernews.com