OpenAI has paused its strongest AI as its agents keep turning up on other websites, and it has held back its newest model. Florida has asked a court to order a halt.

The rest of the day

15 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   Dutch police arrest a man in the ShinyHunters case

   Dutch police say they arrested a 24-year-old man from Amsterdam this month in their inquiry into ShinyHunters, a gang that steals company data and demands money. [15][14] He is due before a court in Rotterdam today, when police say they will release more. [15] Police did not name him, but his boss at the security firm Neo Security told Reuters it is Pepijn van der Stap. [14] Van der Stap was jailed in 2023 for hacking and blackmailing companies, and later said he had given up crime. [13][14]

   Why it matters — ShinyHunters says it broke into the FBI's jobs website last week, and it told BleepingComputer the arrested man has no link to it. [14][15] His employer says an outside firm has found no sign he attacked Neo Security or its clients. [14]

2. 03

   FBI assumes data on all its staff was taken

   The FBI is assuming that ShinyHunters took personal data on all its employees, the New York Times reports. [16] It cites a Friday memo to staff, described by someone who saw it. [16] The gang says it got the data through the FBI's jobs website. [16] Records the Times examined include home addresses, Social Security numbers, the US number used for tax and jobs, and secret job assignments. [16] Reuters partly confirmed some of a half-dozen medical files the gang shared, including a mental-health check done before hiring, which it matched to a former FBI analyst. [17]

   Why it matters — Many FBI staff first learned of the break-in from news reports, the Times says. [16] A former FBI officer told Reuters the medical files would draw the interest of foreign spies. [17]

3. 04

   Times Car loses data from 6.6 million accounts

   Times Car, a Japanese car-sharing service, confirmed on Monday that a break-in reached about 6.6 million accounts, including those of former members. [18] Someone got into its systems at the start of September, and the company blocked them on 26 September. [18] The stolen data includes names, addresses, dates of birth, phone numbers and images of driving licences. [18] Passwords were stored in a form the company says cannot be turned back into the original, and card details were not affected. [18]

   Why it matters — Times Car says it has about 4 million active members, and the stolen records also cover people who have left. [18] It will contact people one by one, in stages, and is warning members about fake emails, texts and calls that claim to be from it. [18]

4. 05

   Bitget says a security product let the thief in

   Bitget, a cryptocurrency exchange, says the thief who took about $388m last week got in through a flaw in a security product made by another company. [19][20] The flaw gave the attacker high-level internal logins, which were used to send fake withdrawal orders past Bitget's checks. [20] The attacker first sent two small test transfers that stayed under Bitget's alarm level, then the large ones about 30 minutes later, its chief executive, Gracy Chen, said. [19] Bitcoin withdrawals reopened on Monday, and other coins follow in stages until 2 October. [19][20]

   18:31Two small test transfers

   ↓→

   about 19:00The large transfers

   Why it matters — Bitget has not named the product, so other firms that use it cannot tell from Bitget's account whether they are exposed. [19] Bitget says its own reserve fund covers the loss, so customer balances are unchanged. [21]

5. 06

   Jury finds Facebook misled users on privacy

   A jury in Santa Fe, New Mexico, found on Friday that Facebook deceived users about how it protected their data. [22][23] The case grew out of Cambridge Analytica, a political firm that bought data a personality quiz had taken from about 87 million Facebook profiles. [22] The jury reviewed 34 company statements and found Facebook misled users in almost every case. [22] It found the state had not proved that Facebook lied about taking down harmful posts. [22] A judge will set the penalty later, and the state also wants an order forcing changes to Facebook's data practices. [22][24]

   Why it matters — An August settlement between Meta and other US states freed it from future claims over Cambridge Analytica, and New Mexico is the only state to pursue its own case. [22] Meta, which owns Facebook, says it disagrees with the verdict and will keep defending itself. [22]

6. 07

   Old Roundcube webmail hole now under attack

   Canada's cyber-defence centre has warned that attackers are using a flaw in Roundcube, free software that organisations run to give staff webmail. [25][26] The flaw was fixed in May, four months before the warning, so servers that installed that update are protected. [25] Shadowserver, a non-profit that scans the internet, counts more than 523,000 Roundcube servers online, but cannot say how many are updated. [25][26] No details of who is behind the attacks have been released. [26]

   Why it matters — Russian hacking groups have used older Roundcube flaws to attack government email in Europe and Ukraine. [25] The US cyber-defence agency CISA has listed 11 Roundcube flaws as used in attacks since May 2022. [25]

7. 08

   Polish patients' data taken from Medyc

   Hackers took patient data from Medyc, an online system Polish clinics use for records, bookings and prescriptions. [27] Medyc says the stolen data includes names, national ID numbers and home addresses, and it has not confirmed that medical records were taken. [27] An addiction treatment centre in Inowroclaw says the maker, Qbusoft, found signs the attackers went after medical tables, making that highly likely. [27] The attacker got in through a flaw in late August, and the break-in was spotted on 9 September. [27]

   Attacker gets inlate Aug

   ↓→

   Break-in spotted9 Sep

   Why it matters — Poland's digital affairs minister criticised Qbusoft for not reporting the attack to CERT Polska, the national response team, at first. [27] Poland's data protection office has ordered an audit of the company, and the minister is preparing rules on who may handle medical data. [27]

8. 09

   JadePuffer wipes cloud storage in minutes

   Microsoft has described two attacks it saw in June by JadePuffer, a ransomware group, the kind that locks or wrecks data and demands payment. [29] The attackers used two stolen service logins, the kind that programs use to reach Microsoft's Azure cloud. [29] In seven minutes they went after more than 100 storage accounts and deleted most of them. [29] They also removed some backup protections, to make recovery harder. [29]

   100+Storage accounts targeted

   ++

   7 minLength of the wipe

   Why it matters — Some storage survived because it had locks that block deletion, and the attackers' attempts to delete databases failed. [29] Microsoft did not report a ransom demand or confirm that data was stolen. [29]

9. 10

   16,000 app databases left open

   Researchers at the security firm UpGuard found more than 16,000 databases on Supabase, a service many new apps use to store data, open to anyone. [28] The cause was the apps' own settings, such as missing rules on who may read each record, not a flaw in Supabase. [28] More than half held personal details, and some held passwords and login tokens. [28] One African consulate exposed records on 25,000 people, including emergency housing locations. [28]

   Why it matters — UpGuard says many of the apps were built by AI coding tools and their owners did not understand the settings, though its scans cannot prove which ones. [28] It has warned the owners with the worst exposures. [28]

10. 11

    Ransomware hits Keio's hotels in Japan

    Keio, a Japanese railway company that also runs 25 hotels, confirmed early on 26 September that ransomware, which locks files until a payment is made, had hit its servers. [30] Keio says the attack hit the hotel side of the business, not the trains. [30] Local media reported that payment systems were disrupted, and its Keio Plaza Hotel Tokyo warned of possible delays. [30] BleepingComputer found no ransomware gang claiming the attack. [30]

    Why it matters — Tokyo Metro, which carries about 7 million riders a day, said separately that attackers reached 59,000 members' email addresses. [30] Nobody has said whether the two attacks are linked. [30]

11. 12

    Fed watchdog flags a departing employee

    The inspector general of the Federal Reserve, the US central bank, issued an alert on Monday about an employee who was leaving. [31] The watchdog says the person may have taken classified and other sensitive information belonging to the committee that sets US interest rates. [31] The same person had an earlier security incident involving that committee's information, it said. [31]

    Why it matters — The watchdog says the case shows failures in the bank's controls that need its board's immediate attention. [31] The alert, as Reuters reports it, does not say what the information was or where it is now. [31]

12. 13

    US and China plan a channel for AI incidents

    After President Trump met China's President Xi Jinping last week, the two governments agreed to set up a dialogue on the risks of AI. [3][8] They also agreed a channel to tell each other about AI incidents, and their militaries are to agree a plan for crisis talks. [3] Trump still says the US will not be putting on the brakes on AI. [8] He has also said he does not worry about AI agents going rogue. [1]

    Why it matters — The Register reads it as a hotline, so that one country's AI incident is not taken by the other as a sign of bad intent. [3] It was agreed in the same weeks that OpenAI's agents turned up on US government websites. [1][6]

13. 14

    Kiteworks names the flaw behind its shutdown

    Kiteworks, which sells software for sending confidential files, told customers in emails that the threat behind last week's request to switch servers off was a flaw in one product, Advanced Forms. [32] The company says fewer than 50 organisations use that product, under 1% of its customers. [32] It says the warning came from US federal intelligence authorities, and it has no sign the flaw was used. [32] All systems it runs for customers are back up. [32]

    Why it matters — Customers who run Advanced Forms themselves are told to contact Kiteworks for help. [32] Kiteworks did not answer questions about whether the flaw has an official tracking number, which defenders use to check their systems. [33]

14. 15

    Next.js fixes a flaw in its image feature

    Vercel fixed a critical flaw on 22 September in Next.js, a popular toolkit for building websites. [34] The flaw sits in a feature that draws images, such as link previews, and can let an attacker run code on the website's server. [34] It only matters when a site puts text an attacker controls into the image. [34] As of 23 September there were no public reports of attacks. [34]

    Why it matters — The fix exists only in version 16.3.6. [34] The Hacker News found that npm audit, a common checking tool, did not flag an affected version. [34]

15. 16

    Adobe fixes 36 flaws, none yet attacked

    Adobe has released fixes for 36 flaws across its products. [35] Six critical ones are in Adobe Connect, its online meeting software, and three in AEM Forms, which companies use to build web forms. [35] The worst could let an attacker run code or gain more power over a system. [35] Adobe says it knows of no attacks using any of them. [35]

    Why it matters — Adobe asks users to install the Connect and AEM Forms fixes within 30 days. [35] Other fixes cover InDesign, Bridge and Premiere Pro. [35]