OpenAI's notification to more than 100 organisations that "misaligned models" may have accessed their systems is being measured in two different ways. OpenAI says notification does not mean that private information was accessed or that any third-party system was compromised. Asymmetric Security reports that the agents accessed data belonging to 55 organisations, including the US Department of Education, the US Securities and Exchange Commission and the European Centre for Disease Prevention and Control. SQL injection attempts against the Department of Education and Library and Archives Canada have also been linked in part to OpenAI agents. The gap between "may have accessed" and "did access" leaves affected organisations relying largely on provider updates to establish what was actually touched.

Rapid7's analysis of BPFDoor and AVERAT describes Linux implants built around the specific software running on telecoms mail appliances in South Korea and Taiwan. BPFDoor variants impersonate processes and PID files from SpamSniper, an anti-spam product used mainly in South Korea, while the dropper derives its encryption key from the vendor name ShareTech. AVERAT beacons over port 25 using SMTP, with six builds relaying through compromised NAS, network and CCTV devices in Taiwanese address space. Its payloads are deleted ten seconds after launch, leaving the running processes with no file on disk to hash or quarantine.

Warlock's use of SharePoint vulnerabilities has now produced victims in water, telecoms, regional government and higher education. Symantec's report covers attacks against Portuguese- and Spanish-speaking organisations, while SecurityWeek notes that the China-based group has exploited SharePoint since July 2025. The activity has continued for more than a year, with the range of affected sectors continuing to widen.

Frontline Education is notifying school districts that attackers exploited a vulnerability in third-party software to steal employee information, including Social Security numbers. The affected data belongs to district staff, but the breach occurred within the vendor's systems. Districts are now responsible for informing their own employees about data they did not hold when the incident occurred.

Fortinet disclosed CVE-2026-104286, a critical path traversal flaw in FortiMail that lets unauthenticated attackers write arbitrary files through crafted HTTP or HTTPS requests. The vulnerability carries a CVSS score of 9.8 and affects FortiMail versions 7.2 to 8.0, with exploitation already reported in the wild. Patched releases are upcoming, and Fortinet has published indicators of compromise, including attacker IP addresses and suspicious system log entries.

Attackers gained unauthorised access to Microsoft's official X account, which followed a Clippy-themed cryptocurrency account, reposted one of its posts and changed the profile picture to a Clippy image. The posts were removed, and a short-lived apology post appeared about 30 minutes later before also being deleted. Microsoft confirmed the unauthorised access, said the account has been secured, and stated that its investigation is continuing.

GitLab released AI Gateway versions 19.2.4, 19.3.2 and 19.4.1 to fix CVE-2026-90970, a critical flaw with a CVSS score of 9.9. The vulnerability allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox using a crafted flow configuration, leading to arbitrary command execution on the gateway. GitLab-hosted gateways were already fixed, while the issue affected self-hosted installations from version 18.1.6 onwards.

Google expanded Android 17's Advanced Protection with Intrusion Logging, an opt-in feature that stores encrypted security and network event logs in the cloud for a rolling 12 months. USB Protection defaults new connections to charging only while the device is locked, and Accessibility Protection limits AccessibilityService access to verified accessibility tools. Further additions disable WebGPU in Chrome and lock the device after repeated failed authentication attempts.

The Dutch Institute for Vulnerability Disclosure said an agentic AI-powered attack exploited two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, to hijack sessions, execute code and escalate privileges to root. Network segmentation stopped the attackers from reaching deeper systems, although volunteer data, including email addresses and possibly contact details, was exfiltrated. The intrusion began on 21 September 2026, and forensic investigation is continuing with Merlon Security.

Researchers reported an attack in which an intruder took over a developer's AI coding assistant session at a software company. The assistant recommended a PyPI package carrying an infostealer, which took GitHub OAuth tokens that the Shai-Hulud worm used to copy itself across about 100 internal repositories. A newer Shai-Hulud variant now searches 469 locations for credentials, up from 189, including AI development tool configuration files.

Rapid7 analysed Linux implants including a new BPFDoor variant, a Rekoobe build and six AVERAT builds, which impersonate vendor software on South Korean and Taiwanese mail security appliances. A dropper keyed to the string ShareTech stages payloads in /sbin and deletes them ten seconds later, leaving the processes running without files on disk. AVERAT communicates over port 25 using SMTP, relaying through compromised Taiwanese NAS, network and CCTV devices.