FortiBleed Firewall Attacks, AI Bank Cyberattacks, ASOS Data Breach

The week from 6 to 12 October 2026 brought a wave of cybersecurity incidents, including ransomware attacks, data breaches, critical software vulnerabilities, and AI-powered cyber threats. From compromised Fortinet firewalls and attacks on South Korean banks to exposed renewable energy systems, these stories highlight the growing risks facing businesses, governments, and critical infrastructure. Here are the key cybersecurity developments organizations should know about and the security lessons they offer.

FBI and Secret Service warn about FortiBleed attacks on Fortinet firewalls

A joint advisory from 6 October says a credential-harvesting campaign has compromised tens of thousands of FortiGate devices. Attackers sometimes delete or change the original admin accounts, locking owners out, and the access is being linked to ransomware affiliates. Read the FBI IC3 advisory

AI-driven attacks on South Korean banks

Investigators believe an open-source, LLM-based penetration-testing tool was used against several Korean banks, exposing personal data of tens of thousands of people. Every confirmed intrusion hit internal or partner-facing systems rather than customer apps, and the banks have not formally confirmed the tool’s use. Read the Korea JoongAng Daily report

ASOS confirms a customer data breach after a rogue app notification

On 6 October, ASOS app users received a push notification saying the company had been hacked. ASOS confirmed that a third-party customer-messaging service was accessed, exposing basic contact details. The attacker’s claim about Snowflake has not been confirmed. Read the BBC report

Osaka Metropolitan University hit by ransomware

Around 500 servers stopped working from 2 October, forcing the university to cancel classes for several days. Systems covering email, payroll and accounting were affected, and reports suggest some backups were also encrypted. Read The Record’s coverage

Warlock uses old SharePoint flaws to deploy ransomware

Symantec and Carbon Black report that the Warlock group attacked at least four organisations in two months, including a water utility and a telecom provider. The attackers used unpatched on-premises SharePoint servers as the entry point, then used domain replication to spread ransomware. Read The Hacker News’s coverage

Ransomware recovery CEO charged with fraud

US prosecutors have charged the owner of a Florida ransomware remediation company, who allegedly claimed to have proprietary decryption technology while secretly negotiating with hackers. He has pleaded not guilty. Read the BleepingComputer report

FBI arrests another suspect linked to the ShinyHunters breach

A former executive of a cybersecurity firm was arrested in Pennsylvania on extortion and conspiracy charges. He is reportedly linked to the ShinyHunters breach of FBI systems, and a teenage suspect was detained in Jordan. Read Krebs on Security’s coverage

US and allies seize tools used by China’s Flax Typhoon

Authorities seized websites hosting vulnerability-scanning and phishing tools used by the Chinese botnet operator Flax Typhoon, also known as Integrity Tech. CISA has published indicators of compromise so organisations can check their logs. Read the CISA advisory AA26-281A

Thousands of exposed renewable energy systems found online

Researchers at Modat found more than 8,000 internet-exposed systems across European wind and solar parks, including admin panels. In one case, a turbine dashboard had start, stop and reset controls. Read the Modat research

Fraudulent HTTPS certificates issued for Google domains

Hackers took over three country-code domains (.gh, .sl and .as) and used them to issue fake TLS certificates for Google and other large services. Google said Chrome blocked the fraudulent certificates quickly. Read Ars Technica’s coverage

Wave of cyberattacks prompts Japan to act

Dozens of Japanese companies across retail, food, rental and rail were reportedly hacked, with millions of records leaked. Tokyo has declared a cyber space emergency, and the government has told banks not to accept driver’s licences as proof of identity for new accounts. Read the AP report

Critical SonicWall flaw exploited days after disclosure

CVE-2026-102255 is a pre-authentication server-side request forgery flaw that attackers began exploiting within days of its disclosure. CSO Online argues the pattern of serious bugs in edge security appliances deserves attention in its own right. Read the CSO Online analysis

GitLab fixes a critical RCE flaw in AI Gateway

GitLab has patched a critical vulnerability in its AI Gateway that could allow remote command execution. Because the component manages tokens and connections to external AI models, a successful attack could have wide impact. Read Telefónica Tech’s weekly briefing

Ransomware affiliate uses an AI coding tool’s protocol as a command channel

CloudSEK documented a Gentlemen ransomware affiliate using a Model Context Protocol (MCP) interface to run commands inside compromised networks. The attacker turned tools normally used by an AI programming assistant into operational infrastructure. Read Telefónica Tech’s weekly briefing

Strong cybersecurity also depends on email authentication protocols such as DMARC, SPF, and DKIM, which help prevent email spoofing, detect unauthorized senders, and reduce phishing risks.