DHS Leak Exposes 41,000 Workers’ Details
So much for flying under the radar.
Records for more than 41,000 DHS employees and contractors just hit the web, effectively doxing thousands of ICE personnel. The “Icepick” hacktivist dump spills contact details and internal group memberships tied to undercover operations, even dragging some former employees into the exposure.
DHS is scrambling to investigate the mess. While the attackers claim they waltzed right through a single sign-on portal, Okta insists its own systems are squeaky clean.
This isn’t just a messy Rolodex—these organizational breadcrumbs give threat actors a perfect road map to impersonate insiders and blow ongoing investigations. Affected staff must double-check any unexpected internal requests, while security teams should audit directory permissions before the next shoe drops.
Because a familiar name in your inbox isn’t a security clearance—it’s just good reconnaissance.
Cisco Patches Firewall Bug Behind VPN Crashes
Cisco has patched CVE-2026-76418, an actively exploited zero-day flaw that generously allows unauthenticated strangers to restart your ASA and FTD firewalls, kicking remote workers offline. Exposure requires a reachable SSL VPN login service and secondary authentication in an affected tunnel group.
Admins should immediately install the fixed release for their software branch. If you’re hoping to just hide the connection-profile list, think again—that parlor trick doesn’t protect a default group that still relies on secondary authentication.
Temporary mitigations depend on your specific configuration, but stripping away secondary authentication obviously waters down your overall VPN security. Read Cisco’s instructions and assess the collateral damage before tweaking your settings.
Your firewall really shouldn’t feature a public reboot button.
Authenticator Gets an Identity Check
Microsoft has patched CVE-2026-80097 in Authenticator for Android, because the app designed to verify identities was letting malicious apps steal work account tokens with a simple fake mustache.
Enclave’s test app needed no Android permissions to impersonate installed Microsoft apps and waltz away with email, file, and calendar access. Authenticator knew the real caller’s identity but blindly trusted the supplied disguise instead.
Exploitation requires a rogue app running on the phone. Enclave reported no additional interaction, though Microsoft says a sign-in step is required. Microsoft’s September advisory listed no exploitation.
Update through Google Play to version 6.2606.4246 or later; IT teams should enforce that minimum before your broker hands out VIP passes to the wrong crowd.
An awkward place for an identity crisis.
44 AI Agents, Same Old Security Holes
eSecurity Planet reports that TrendAI examined three attack infrastructures targeting Japanese organizations, finding AI playing roles from coding assistant to automated overlord.
The overachiever of the bunch used CyberStrikeAI’s 44 agents to probe at least 19 organizations, including 16 in Japan. Despite all that next-gen firepower, only a handful suffered deep compromises. The worst breach literally walked through a wide-open, password-free admin portal. So much artificial intelligence, so little natural resistance.
Defenders need to patch legacy systems, dump default credentials, and lock down admin interfaces. Keep an eye out for low-frequency probes, since the platform sneaks around by throttling traffic to individual targets.
The attackers automated their hacking. Your patch backlog remains stubbornly yours.
PHP Fallout Continues As Experts Warn of More Bugs
The fallout from the publication of two critical PHP vulnerabilities has continued this week, with multiple cybersecurity firms indicating that additional AI-discovered bugs will soon be disclosed and cause disruption, and with multiple private and public websites going offline while operators install patches.
If enterprises don’t already have the strongest possible cybersecurity they can afford, they should probably start bolstering their defenses, since last week’s PHP disclosures may be only the beginning of a flood of AI-aided big discoveries.
Operational Impact: With 70% of the world’s websites using the affected PHP programming language, bad actors have moved quickly to exploit the vulnerabilities according to security firms such as Cloudflare, which detected millions of exploitation attempts within hours of the disclosure.
- Look Back: While organisations have rushed to patch the PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), exploitation attempts were made prior to disclosure, indicating that even enterprises that have updated should check whether they’ve already been targeted.
- Play Dead: Government agencies in the Netherlands, Germany, France, Belgium, and Finland temporarily took down official websites as a precaution, as did European hospitals and schools, while CERT-EU advised organisations to isolate online applications if they can’t patch immediately.
- Self-Policing: OpenAI has responded to the explosion of cybersecurity threats by announcing it will stop training its models on the live internet, something which Anthropic announced several weeks ago, while Chinese developer Moonshot AI has said it will reduce the cyber capabilities of its newest model, Kimi K3.1 Pro.
UNM Cyber Incident Diverts Ambulances, Halts Surgeries
An incident at University of New Mexico Health diverted ambulances for two hours and suspended outpatient surgeries and appointments.
Clinical operations have resumed, but the disruption highlights the need to coordinate containment decisions with neighboring facilities.
Restoring connectivity is only part of recovery. Hospitals also need to verify that patient records and medication orders are accurate and critical workflows function correctly before resuming use.
Test downtime procedures, assign ambulance diversion authority, and validate clinical data before restoring affected services.
Japan Cyberattacks Trigger Customer Compensation
After separate cyberattacks, GMO Internet offered reimbursement for verified unauthorized trading losses, while Park24 offered payouts to eligible breach victims.
Both cases show that breach costs can extend beyond restoring systems to addressing customer harm.
Risk assessments should account for what attackers could do with a service’s access and data, even when the service stays online.
Restrict access to financial accounts, remove unnecessary stored identity documents, and monitor for unauthorized transactions.
Criminal AI Tools Accelerate Familiar Attack Tactics
Resecurity’s 2025 investigation found that DIG AI could generate malicious scripts targeting vulnerable web applications.
Subsequent research has documented attackers using AI to automate intrusion tasks and modify malware.
Automated attacks demand faster containment, so test whether investigation and approval processes delay your response.
Simulate credential misuse in an authorized exercise, measure the time to session revocation, and address the longest delay.
Dahua Cameras Compromised Behind Firewalls
CERT-UA warned that attackers viewed Dahua camera feeds, changed configurations, and added unauthorized accounts through Easy4IP cloud access.
The service can make cameras reachable behind firewalls without directly exposed management ports.
Recovery should verify who still has access, since changing passwords alone may leave attacker created accounts in place.
Review camera accounts and cloud connections, remove unauthorized users, and disable remote access features without an operational need.
Police Say AI-Assisted Hacker Hit 60 Organizations in 44 Days
Seoul police said a suspected hacker breached 60 organizations in 44 days after adopting AI-assisted tools.
The broader campaign exposed more than 8.2 million personal information records, including patient consultation details.
Extortion samples may reveal only part of a breach, so teams should independently verify the scope of data theft.
Test whether you can match a mock extortion sample to internal records and use access logs to investigate wider exposure.
Is Your Access for Sale?
Cybercrime marketplaces sell stolen data and network access that attackers can use for fraud, data theft, and extortion.
How to reduce exposure:
- Use threat intel tools and feeds to flag exposed credentials and access offers, then verify against internal logs.
- Reset compromised credentials, revoke sessions, rotate exposed keys, and check for credential-stealing malware.
- Enforce phishing-resistant MFA and assign owners to coordinate incident response.
Proactive exposure management helps reduce account takeovers and limit the impact of stolen data.
FEC Filing System Goes Dark Before Midterms
The Federal Election Commission took its electronic filing system offline following a reported hacking attempt days before the midterms.
Public access to campaign spending disclosures could be delayed, but the disruption affects campaign finance reporting, not voting or ballot counting.
Reporting deadlines don’t pause during an outage, so recovery plans need secure alternate submission methods and a way to reconcile those records once service resumes.
Test your alternate submission process with a sample report, then verify that it reaches the restored system without being lost or duplicated.
Microsoft Patches Authenticator Flaw That Enables Token Theft
Researchers showed how a malicious Android app could impersonate Microsoft software to steal work account tokens from an outdated Authenticator app.
Those tokens could expose corporate resources despite MFA, although exploitation requires the malicious app to be installed and run on the device.
I’d be asking how many employees use Authenticator on phones whose app versions we can’t verify.
Use MDM to identify outdated Authenticator installations and verify updates to the latest version.
AI Agents Breach Anthropic’s Business Tools in Under 12 Hours
Researchers reportedly used autonomous AI agents to access Anthropic’s third-party business platforms in under 12 hours.
Anthropic confirmed limited access to business systems but said customer conversations and core AI assets remained untouched.
I’d want to know what sensitive information we’ve put in third-party business tools and who can access it.
Review sensitive information stored in third-party business tools and remove access for users who no longer need it.
Oracle EBS Faces Exploit Attempts a Week After Fix
Researchers detected exploitation attempts against an Oracle E-Business Suite vulnerability a week after a patch was released.
The flaw could allow unauthenticated command execution, but no successful production compromise has been publicly confirmed.
Verify that the patch reached every EBS instance, including those outside the usual maintenance schedule.
Review requests to /OA_HTML/AppsTCFServer and investigate unusual command execution on EBS servers.
Fake Court Notices Target Companies With LodaRAT
A phishing campaign targets companies with fake court notices delivering LodaRAT.
The malware can steal session cookies and give attackers remote control of Windows computers.
A convincing fake court website can make double-checking a suspicious email feel reassuring while leading the recipient closer to infection.
Route unexpected court notices to a designated internal contact who verifies them through independently obtained court contact details before anyone downloads files.
What’s Hiding in Routine Activity?
Threat hunting helps your team detect attackers abusing legitimate administration tools to blend into everyday operations.
How to strengthen threat hunting:
- Use threat intelligence tools and feeds to develop a hunt hypothesis focused on one critical system and a defined time window.
- Verify log coverage and correlate endpoint activity with authentication records to distinguish suspicious tool use from approved administration.
- Validate findings against business activity, then create tested detection rules and assign owners to close visibility gaps.
Show the board which relevant attack techniques you can detect and how often hunts produce lasting detections.