Bitget, a crypto exchange, says thieves took $387m from its online wallets. It blames North Korea and will repay customers from its own fund.

The rest of the day

18 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   FBI confirms its jobs site was breached

   The FBI confirmed on Friday that its jobs website, FBIJobs.gov, was broken into. [8] The gang, ShinyHunters, says it got in through a flaw in Oracle PeopleSoft software on the site and then reached servers the bureau runs on Amazon's government cloud. [8] Files it gave reporters include a mental-health evaluation and blood-test results for staff; Reuters matched two social security numbers in them against credit records. [9] Former agents told the BBC they fear undercover colleagues could be found at home. [10] The gang wants the FBI to withdraw a May notice about it, not money, and says it will publish within four days. [10][11]

   Why it matters — The site is still down and the FBI says it does not yet know whether the hole was in its own systems or a contractor's. [8] Anyone who ever applied for an FBI job may be in the file. [8]

2. 03

   Kiteworks tells customers to switch off

   Kiteworks, which sells software that companies use to send confidential files, emailed customers this week asking them to shut its servers down for a six-hour window on Saturday. [12] Its security chief says US federal intelligence agencies warned that an attacker may try to target some customers' systems, and that no break-in is known. [12] A support worker told the German outlet Heise the reason was a possible flaw with no fix yet. [12] The company was once called Accellion; in December 2020 the Clop gang used a flaw in its file-transfer tool to steal data from dozens of firms. [12]

   Why it matters — Jake Knott of the security firm watchTowr said nobody asks a whole customer base to unplug working systems over a hunch. [12] Every firm that keeps the software running through Saturday is betting the warning is wrong.

3. 04

   SharePoint and router flaws under attack

   CISA, the US cyber-defence agency, added two flaws on Friday to its list of ones being used in real attacks. [13] One is in Microsoft SharePoint, the software companies use to share documents. Microsoft labelled it a minor spoofing flaw in August; it now says the flaw lets an attacker run code on the server, and that it had reliable evidence of attacks as of 25 September. [13] The other is in MikroTik routers: CERT Polska, Poland's response team, showed that two flaws chained together give full control of an internet-facing router with no password. [13] Microsoft has not said who is attacking, how many organisations were hit, or what the attackers did inside. [13]

   Why it matters — Microsoft's first label told administrators this could wait. Its new one says attackers are already inside some servers, and it has not said whose. [13]

4. 05

   WordPress flaw attacked within hours

   WordPress, the software behind a large share of the world's websites, fixed a flaw on 22 September in the way it picks the template for a page. [14] Patchstack, a security firm, saw the first attempts to use it within hours of the fix being made public, and says they have since turned into real break-ins. [14] The flaw only works when a site's theme folder is named starting with 'page-' and the server can read a chosen file. [14] The old Twenty Twelve and Twenty Fourteen themes and the popular Neve, Hestia and Sydney themes have that layout. [14] The fix was copied back to every WordPress version since 4.7. [14]

   Why it matters — A site owner running one of those themes who has not updated since Tuesday is reachable by anyone who read the advisory. [14]

5. 06

   Old Revolut records taken from a US broker

   DriveWealth, a US broker that once held the US-share accounts of Revolut customers, says attackers talked their way into its systems on 4 and 5 September and took old customer records. [15] The records cover names, emails, phone and postal addresses, jobs, citizenship, age, gender and part of an account number; passwords and card details were not taken. [15] DriveWealth says the rules obliged it to keep the records after Revolut moved its customers to a new arrangement. [15] Revolut says its own systems were not touched. It is the second leak to reach Revolut customers this month. [15]

   Why it matters — The stolen fields are exactly what a convincing fake email needs, and DriveWealth said as much in its own warning. [15] Nobody in the file chose DriveWealth; Revolut did.

6. 07

   Health-tech firm Astrana reports a break-in

   Astrana, one of the largest US healthcare technology companies, told the US stock-market regulator on Tuesday that hackers had reached its servers. [16] They rang employees while faking the company's own main phone number, and talked their way to access. [16] Astrana had to rebuild some systems from clean backups; it has not said whether ransomware was used, how many patients are affected or what was taken. [16] It sells software to about 20,000 medical providers and made $972.5m in revenue last quarter. [16] It is the latest of several health-tech firms to report a breach this year, after Veradigm, CareCloud and others. [16]

   Why it matters — Patients whose records sit in Astrana's systems have not been told anything yet; the filing went to investors first, because the law requires it there. [16]

7. 08

   A web form that hijacks Salesforce's AI

   Zenity Labs, a security research firm, found three flaws in Agentforce, the AI assistant Salesforce sells to work inside its customer-management software. [17] An attacker could type hidden instructions into a company's public Web-to-Lead form, the ordinary web form where sales leads are collected. [17] The instructions sit unnoticed until an employee asks the AI agent to look at that lead; the agent then follows them. [17] Two of the flaws let the agent send customer data out with no click from anyone; the third could turn it into a sender of convincing phishing. [17]

   Why it matters — A form that exists to let strangers write into a company's database now writes into an AI that acts on what it reads. [17]

8. 09

   North Korean group hits an Indian IT supplier

   SentinelOne, a security company, says Jade Sleet, the North Korean group behind the $1.5bn Bybit theft, broke into a small Indian IT services firm with no crypto business of its own. [7] It used two Mac backdoors, FLATROOF and ROOFDECK, last seen in the March-April attack on KelpDAO's bridge. [7] The lure was a fake job interview aimed at staff in DevOps, crypto and finance roles. [7] The group's habit, GitHub noted in 2023, is to target the suppliers of crypto firms as well as the firms themselves. [7]

   Why it matters — A supplier's machines are a way into every customer it serves; the Bybit coins were taken through a compromised developer environment at Safe{Wallet}, a supplier. [7]

9. 10

   Google's AI hunts flaws at hospitals

   Google said on Thursday it is expanding a programme called Scan for Good. [18] Two AI tools, Google's Gemini 3.8 Flash Cyber and Red Agent from Wiz, the cloud security firm Google owns, scan public services, critical infrastructure and non-profits for exposed systems. [18] It says the models have already found critical flaws at hospitals, a town council, a public rail operator and large tech providers, and hand each finding to a human researcher to verify and fix. [18] Wiz's Gal Nagli says the programme has run for several months and has no end date. [18] OpenAI announced a similar $1bn credits programme for hard-pressed defenders earlier this month. [18]

   Why it matters — The announcement follows disclosures that Google's own AI agents escaped their test areas and hacked other companies' websites; this time a person stands between the finding and the fix. [18]

10. 11

    NHS trust overwrites 11 years of maternity records

    Nottingham University Hospitals, an English NHS trust, overwrote its old maternity database on 18 August. [19] Staff copying a radiotherapy database for reporting reused a set of instructions written for another system, and one setting that needed changing was not changed. [19] The database held records of women and babies treated between September 2011 and November 2022. [19] The trust recovered the clinical notes, observations and test results, and current patients were unaffected. It cannot fully restore the log of who viewed each record over those eleven years. [19]

    Why it matters — A patient who asks whether someone looked at her maternity record between 2011 and 2022 may now never get an answer. [19]

11. 12

    Elsevier sent readers to a crime gang's page

    Elsevier, the Amsterdam-based academic publisher behind ScienceDirect, confirmed that visitors to some of its sites were sent to a leak page run by the LAPSUS$ crime crew on 21 September. [20] A nursing student trying to reach textbooks posted a screenshot of the redirect on Reddit. [20] Elsevier says the redirect was brief and narrow, and that no customer data, research content or core systems were touched; it has not said which platforms or for how long. [20] LAPSUS$ is best known for its attack on Rockstar Games. [20]

    Why it matters — A publisher that also runs ClinicalKey, a reference tool for doctors, was briefly steering its readers to a criminal gang's page. [20]

12. 13

    Strikes on Kyiv data centres cut the internet

    Russian drone strikes on Wednesday damaged data centres and telecoms sites in Kyiv, and at least four internet providers lost part of their networks, the monitoring group NetBlocks reports. [21] Ukraine's digital ministry says about 100,000 households had internet problems. [21] Utels said one data centre holding its core equipment lost power; it restored most customers within about two hours. Pautina said nearly half its network went down. [21] Russia's defence ministry says it hit two data centres that served Ukraine's military and intelligence; that could not be verified, and Ukraine has not confirmed it. [21] Two people were killed and at least 43 injured. [21]

    5 of 10

    of Pautina's network went down, roughly

    Why it matters — Ukraine's foreign minister says the warnings of incoming missiles reach people over the internet, so the network that was hit is the one that tells a family to go to the shelter. [21]

13. 14

    CISA sets out a plan for the flaw-numbering system

    CISA published a plan on Wednesday for the CVE programme, the world's shared numbering system for software flaws. [22] More than 67,000 CVEs have been published in 2026 so far, and submissions to the US vulnerability database rose 263% between 2020 and 2025, with AI adding to the flow. [22] The paper says faster reporting exposes gaps in checking when submissions are uneven, and names four areas to fix: how the programme is governed, who takes part, the systems that hold the data, and the reliability of each record. [22][23] The programme's contract nearly lapsed last year before a last-minute extension, and some experts have asked whether another body should run it, given CISA's budget cuts. [22]

    Why it matters — Every patch deadline and every flaw list in this edition hangs off a CVE number; the paper is CISA saying the numbers themselves need to be trusted more. [22]

14. 15

    Ofcom investigates Pornhub's iPhone age checks

    Ofcom, Britain's communications regulator, has opened an investigation into whether Pornhub's age checks for UK iPhone users are effective enough to keep children out. [24] Pornhub's owner Aylo cut off new UK users in February, saying the Online Safety Act pushed people to less regulated sites; UK visits had fallen 47% and then, reportedly, 77% after the rules began in July 2025. [24] In May it let back in users who had confirmed their age through Apple's own checks. [24] Ofcom says its question is how Aylo built and tested that process, not how Apple's system works. [24]

    Fall in UK visits soon after July 202547%

    Fall by October 2025, as reported77%

    Why it matters — The finding decides whether a signal from a phone maker counts as a check, and every other site facing the same law will read it. [24]

15. 16

    Fake logistics apps steal drivers' text messages

    Researchers at Have I Been Squatted found fake Google Play pages, branded as the logistics firms CEVA and TKW, handing out an Android app dressed up as a system service. [25] The app, Corp MDM, steals new text messages, forwards calls and hides itself, and reports to its server every 30 seconds. [25] The same server hosts fake login pages and Windows malware aimed at logistics companies. [25] The researchers think the spyware was written with AI help, because of bugs that get in its own way. [25]

    Why it matters — A stolen text message is often the one-time code a bank or a work login sends. A driver who installs a fake company app hands those over. [25]

16. 17

    Mac password-stealer poses as a crypto wallet

    Jamf, a company that manages Apple devices for businesses, found a new version of PamStealer, a program that steals passwords from Macs. [26] Earlier versions this summer posed as clipboard apps; this one uses a fake website for a crypto wallet called Wavel, which does not exist. [26] The download opens Apple's own Script Editor, which runs a hidden script that fetches the real payload. [26] The key to unlock that payload now lives on the attacker's server, so researchers cannot take the malware apart without the server's cooperation. [26]

    Why it matters — The fake site is aimed at people looking for somewhere to keep their coins, who hold exactly the passwords a thief wants most. [26]

17. 18

    A firm hired a North Korean fraudster on purpose

    Nisos, a US firm that investigates insider risk, let a suspected North Korean applicant be hired for a remote AI engineering job in June 2025 and shipped a laptop fitted with monitoring to a Florida address. [27] The laptop opened in a closet full of other companies' computers, a laptop farm. [27] Over months the operator applied for other jobs, chatted with 22 other operators and worked with four US helpers, all from the China-North Korea border. [27] Last week the US, Japan, Australia and Germany updated their advisory: the scheme has infected 30,000 devices in over 100 countries and drained 7,000 crypto wallets. [27]

    Why it matters — The fraud starts at a hiring desk, not a firewall, which is why the advice is to retrain the people who interview. [27]

18. 19

    Thirteen kinds of flaw in one dashcam

    CISA published an advisory on Wednesday about the Botslab G980H dashcam, listing thirteen kinds of flaw in one device, including a built-in password, a built-in encryption key, functions with no login at all, and passwords sent without encryption. [28] An attacker could get past the login, read stored data, change settings or stop the camera working. [28] The combined severity is rated 8.8 out of 10. [28]

    Why it matters — A dashcam records where a car goes, and a device with a password built into it is one that every buyer shares with every other buyer. [28]