Ten agencies from seven countries named a Beijing contractor they say enables China-linked hacking on 8 October, and the US gave five old flaws from their advisory three-day federal patch deadlines the same day. Citrix replaced its own NetScaler fix within a week, Microsoft shipped 973 of its own CVEs in one release, and Boston Scientific told the SEC it is unlikely to meet its guidance after a cyber outage.
Attackers came through edge appliances and impersonated people; US three-day deadlines only address the first.
Ten agencies from seven countries named Integrity Technology Group on 8 October, and CISA turned five old flaws from the advisory into three-day federal deadlines the same day.
On 8 October, ten agencies from seven countries named Integrity Technology Group, a Beijing company, as an enabler of Chinese state-linked hacking. The US Cybersecurity and Infrastructure Security Agency (CISA) gave federal bodies until 11 October to fix five old flaws used in the campaign.
Japan's police traced the activity back to January 2016. The newest of the five flaws dates from 2023 and the oldest from 2015.
Citrix shipped NetScaler builds for two exploited flaws on 27 September, then replaced them a week later after a third exploited flaw surfaced.
Citrix said on 27 September that attackers had used two NetScaler flaws before any fix existed. On 4 October it replaced those fixes with builds 14.1-73.41 and 13.1-64.28, after a third flaw turned up in attacks.
Rapid7 found stolen settings files holding directory passwords and private keys. Updating the box does not cancel secrets the attackers already copied.
Boston Scientific told the SEC on 8 September that an August network outage will likely push its sales growth and earnings below July's guidance.
Boston Scientific told US regulators on 8 September that a 25 August network outage will likely hurt its third-quarter and full-year results. The medical-device maker expects to miss sales and profit targets it set on 29 July.
It named no attacker. Investors learn on 28 October whether hospital orders were lost to rivals or only delayed.
An unauthorised push notification went out through the ASOS app on 6 October, and the NCSC told every ASOS customer to assume they are affected.
Hackers sent a rogue alert through the ASOS shopping app on 6 October and reached customers' names and contact details. ASOS says a staff member was tricked into handing over a login.
The UK's National Cyber Security Centre (NCSC) told all ASOS customers to assume exposure. Fraudsters can now send fake ASOS messages that use customers' real names.
A Hamburg-led operation took the KillSec ransomware leak site, seized five core servers and secured at least 110 terabytes of stolen victim data on 30 September.
European police took over the KillSec ransomware gang's leak site on 30 September and seized five of its core servers. They secured at least 110 terabytes of stolen victim data.
Hamburg's state police led Operation KillSwitch with Europol, the EU police agency, and ten countries took part. Investigators tie KillSec to about 500 successful attacks since roughly 2024.
CISA gave federal agencies three days to fix 34 of the 43 exploited flaws it listed in September, up from 71 per cent of listings in August.
In September America's cyber defence agency listed 43 flaws that attackers were already using. Federal agencies had three days to fix 34 of them, and 14 days for the other nine.
MikroTik, the Latvian router maker, had three September listings, its first since 2022. Two of its flaws combine to let an outsider seize a router.
Microsoft tied at least 13 phishing campaigns this year to Star Blizzard, using fake event invitations from the IISS, Chatham House and the Atlantic Council.
Microsoft tied at least 13 phishing waves this year to Star Blizzard, a hacking unit of Russia's Federal Security Service (FSB). More than 100 organisations were targeted, mostly in the US and UK.
The emails posed as event invitations from groups such as Chatham House. Malware came only after a target replied, which slipped past email scanners.
The NCSC, the FBI and the Dutch AIVD exposed CHOSEN BRICK, Windows spyware Iranian state actors plant on dissidents after befriending them on WhatsApp and Telegram.
Britain, the US and the Netherlands exposed CHOSEN BRICK on 15 September, Windows spyware that Iranian state hackers use against dissidents and journalists. Some targets live in the UK.
Operators befriend people on WhatsApp and Telegram, then send tailored fakes such as medical scan results. Stolen files have surfaced on pro-Iranian leak sites.
N-able said it had no confirmations of attacks on its N-central console flaw; two days after the hotfix, CISA listed it as exploited.
N-able released two fixes for its N-central IT management software on 5 and 6 September. The second closed a flaw letting outsiders run code on the server without logging in.
N-able said it had no confirmed attacks. On 8 September America's cyber defence agency listed the flaw as exploited anyway. Outsourced IT firms use N-central to run their clients' computers.
CISA listed two Check Point flaws scoring 9.8 on 22 September, one in VPN negotiation on Spark firewalls and one on management servers.
Check Point, the Israeli firewall maker, had two flaws rated 9.8 out of 10 listed as exploited by US authorities on 22 September. Federal agencies had until 25 September to fix them.
One hit Spark firewalls through data sent while setting up a remote connection from 12 September. The other hit management servers over port 19009, so each needed its own update.
Microsoft's September Patch Tuesday fixed 973 flaws in its own products, the most in any monthly release since January 2025.
Microsoft fixed 973 flaws in its own products on 8 September, its largest monthly release since at least January 2025. The previous high was 571 in July 2026.
Only two were already under attack, both Windows privilege flaws. US agencies got 14 days for those, a sign that size and danger had come apart.
Cisco took four exploited-flaw listings in three weeks, every one on a security product, and its SD-WAN Manager entry on 30 September was its 100th.
Cisco reached 100 entries on the US list of exploited software flaws on 30 September. It is the second company to get there, after Microsoft with 389.
All four of Cisco's September listings hit security products: a firewall manager, an email gateway, an access-control system and a network controller. Each listing gave federal agencies three days to patch.
Astrana Health called a phone-impersonation breach material because of the data taken, while CenterPoint Energy, Veradigm and Conduent filed under the voluntary item.
Astrana Health, a US healthcare company, told the stock-market regulator on 23 September that a cyber attack was material. Callers posed as staff and faked its main phone number to get in.
Astrana judged it serious because of patient data, not money. CenterPoint Energy, Veradigm and Conduent reported their incidents under a voluntary section instead.
Ransomware leak-site claims fell 23 per cent in September on ransomware.live's count, with Qilin's collapse the largest single part of the drop.
Ransomware gangs posted 815 victim claims on their leak sites in September, down from 1,060 in August, according to the tracker ransomware.live. The Gentlemen led with 106.
Qilin's claims more than halved to 74. Most of the fall came from that one crew, and late postings could still lift September's total.
ENISA's threat report analysed 8,257 incidents from 2025 and found only 23.8 per cent of NoName057(16)'s assessed attack claims held up.
The European Union Agency for Cybersecurity (ENISA) studied 8,257 incidents from 2025 in its 22 September threat report. Some 51.3 per cent were floods of junk traffic that knock websites offline.
The pro-Russian group NoName057(16) carried out 48 per cent of politically driven attacks. Independent checks backed only 23.8 per cent of its claims.
Peers want frontier AI developers to report when their models are used to break into regulated networks, ahead of the cyber bill's Lords report stage on 26 October.
Peers have tabled AI amendments to the UK's Cyber Security and Resilience Bill before its Lords report stage on 26 October. One would make leading AI developers report hacks carried out with their models.
Another would let ministers order data centres or large AI systems shut down in an emergency. The Scottish Parliament gave its consent to the bill on 7 October.
Up for edge appliances, sideways for ransomware volume. NetScaler took five federal listings between 26 August and 4 October, and the 27 September fix was itself replaced, so a further Citrix bulletin would mark a structural failure rather than a run of bad luck. The next fixed decision point is Phase III of BOD 26-04 on 7 December 2026, when its binding remediation timelines apply; before that, Lords report stage on 26 October decides whether AI model makers enter UK incident reporting.
