The ASOS incident is difficult to classify because the evidence comes mainly from the attacker's own message. A push notification sent through the retailer's app claimed a Snowflake compromise and threatened a leak, while ASOS's statement refers only to unauthorised activity on third-party platforms used for customer communications. The notification does not establish that Snowflake data was accessed, and the delivery channel points towards misuse of messaging infrastructure rather than a database breach. ASOS says names and contact details may have been accessed and that it does not believe payment cards or passwords were affected. Its share price fell around 12 percent on the reports, showing how quickly an unverified claim can affect the market. Domino's credential-stuffing emails sit at the other end of the spectrum: the company says its systems were not breached and that accounts were accessed using passwords reused from unrelated breaches.

The FBI's account of its ShinyHunters breach shifts the focus from the attackers' method to a missed fix. The bureau says a contractor failed to apply a security patch that had been explicitly issued, while Reuters sources identify the platform as Oracle PeopleSoft and the contractor's employer as Accenture. Last month's coverage showed ShinyHunters bypassing WAF rules on unpatched PeopleSoft instances, so the exposure was already documented before the FBI's jobs site was compromised. The contractor was removed, but the exposed data includes counterintelligence job descriptions, addresses of human intelligence operatives and medical records. The detention of Rey in Jordan may help the bureau establish the scope of that exposure, while the incident also leaves a difficult question about responsibility when patching a third-party platform sits with a contractor.

Atlassian's CVE-2026-21589 and the WordPress plugin campaign involve vulnerabilities whose practical impact extends beyond their initial entry points. The Atlassian flaw affects all versions of eight Data Center products, and exploitation requires an exact file name and path, with no directory listing. Atlassian notes that sensitive files in some configurations increase the risk and rates the flaw 9.3. Patchstack's WordPress campaign uses stored XSS in Ninja Forms and WPC Product Bundles to execute in an administrator's browser, installing a hidden administrator, a backdoor login URL and an unauthenticated file manager. Removing the vulnerable plugin does not remove that persistence, leaving administrators to deal with the compromise separately from the original vulnerability.

ASOS confirmed that an unauthorised notification was sent to customers at around 10am on 6 October 2026, following unauthorised activity on third-party platforms used to communicate with customers. Basic personal information, including names and contact details, may have been accessed, while payment-card details and account passwords are not believed to be affected. The retailer restricted access to the notification platforms, and its website and app continue to operate normally.

Atlassian disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting all versions of eight Data Center products, including Confluence, Jira, Bitbucket, Bamboo and Crowd. An unauthenticated attacker can read specific files in the web application root directory, provided the exact file name and path are known. Atlassian rates the flaw 9.3 on CVSS 4.0, while Cloud products have been patched with no evidence of exploitation.

Adversa AI demonstrated Cryptographic Context Injection against GitHub Copilot CLI, where a fetched web page carries ciphertext that the agent decrypts in its own shell and then treats as trusted instructions. In autopilot mode, the agent reads local files such as .env.prod and sends them to an attacker's endpoint within 28 seconds. Only one tested model, mai-code-1.1-flash, ran the full chain, while GitHub validated the report but declined to treat it as a vulnerability.

The FBI removed a contractor on 5 October 2026, saying a third-party platform was breached after the contractor failed to apply an issued security patch. Reuters sources identified the platform as Oracle PeopleSoft and the third-party organisation as Accenture, which did not address the claim. The breach exposed job details, addresses and medical records of thousands of bureau employees, and ShinyHunters claimed the intrusion.

Patchstack observed attackers exploiting stored cross-site scripting flaws in the Ninja Forms and WPC Product Bundles plugins, with both attempts loading the same JavaScript from one domain. The script uses a logged-in administrator's session to install a malicious plugin and create a hidden administrator account. It also adds a backdoor login URL and an unauthenticated file manager, with files backdated to resemble older system files.

Island researchers found a phishing platform posing as AI advertising products for brands including Gemini, ChatGPT, Claude and Perplexity, with a Muse Ads lure added eight days after Meta announced Muse. Clicking Connect opens a fake browser window inside the page, while operators watch submissions live and choose which MFA prompt the victim sees. The same backend also serves refund and fake recruitment lures, and exposed GitHub repositories revealed earlier source code.