A suspected ShinyHunters hacker is detained in Jordan and is helping the FBI find the rest of the gang

The rest of the day

8 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   Flaw found with AI attacked the next day

   Mythos, Anthropic's AI model for finding software flaws, helped a researcher at the security firm Horizon3 find a serious hole in Rejetto HFS. [10] HFS is free software for sharing files from a computer over the web. [10] The researcher, Zach Hanley, published the find and a video of the steps on Wednesday. [10] VulnCheck, a firm that watches for attacks, saw the first attempts the next day, from an address in China aimed at servers in the US and Japan. [10] Version 3.2.1 fixes it. [10]

   Flaw and video publishedWed

   ↓→

   First attacks seenThu

   Why it matters — VulnCheck counts 286 flaws found so far by Mythos and the partners allowed to use it, and this is only the second known to be used in a real attack. [10] Servers still running an older version are the ones being attacked. [10]

2. 03

   Danish university loses records going back to 2003

   The Technical University of Denmark (DTU) says a hacker used a stolen login to get into DTUBasen, the system that controls who can sign in to its services. [11] The attacker downloaded a large amount of data, and DTU says it cannot tell exactly what was taken. [11] The system holds about 40,000 current users and about 160,000 former ones, going back to 2003. [11] For current users it holds Danish personal ID numbers, home addresses, and the names and phone numbers of next of kin. [11]

   • Current users40,000 · 20%
   • Former users160,000 · 80%

   Why it matters — DTU warns the ID numbers can be used for identity fraud and to make scam messages more convincing. [11] It cannot reach every former student directly, so it has asked people to pass the warning on. [11]

3. 04

   London police stop using a phone-copying tool

   London's Metropolitan Police has paused its use of software from Oxygen Forensics and started a full review. [12] Oxygen's software copies data off phones seized in investigations. [12] US prosecutors have accused its chief executive and a Russian partner of hiding that five Russians owned the company and that its code was written in Moscow. [12] The Met says it used the tool in under 0.2% of more than 23,000 forensic jobs in the past year. [12]

   Why it matters — US prosecutors do not say the software held harmful code, and the Met says it shares no case data with Oxygen. [12] Romania has begun dropping Oxygen, Latvia's police have suspended it, and a London court refused bail to the Russian partner, Oleg Davydov. [12]

4. 05

   Google tests letting Gemini run a Mac

   Google is testing a setting that would let Gemini, its AI assistant, open any file on a Mac, use apps and browse the web, BleepingComputer reports. [13] The setting was found hidden in the Gemini Desktop app; it is not switched on, and Google has not confirmed it. [13] With it on, Gemini could read, change or delete files anywhere and act through Mail and Messages without asking each time. [13] It would still ask before buying things, moving money or accepting legal terms. [13]

   Why it matters — It comes as Apple considers making it harder for AI helpers to read people's private files on a Mac. [13] It is not known when Google plans to switch it on. [13]

5. 06

   Meta's Muse keeps a page on everyone a user knows

   A researcher, Karan Joshi, got Muse, Meta's new AI assistant, to share its own instructions, and passed them to Wired. [14] One instruction tells Muse to build a page for every person in the user's life, updated every hour. [14] A page can hold where a friend lives, dates that matter, past arguments and what the relationship seems to need. [14] Meta says Muse gathers this from public information and from what users choose to share. [14]

   Why it matters — Meta says users can wipe Muse's memory and see a log of what it does. [14] The friends and relatives these pages describe are not the people who installed Muse. [14]

6. 07

   Fortra fixes three critical flaws in BoKS

   Fortra has fixed eight flaws in BoKS, software that large organisations use to control who can log in to their Linux and Unix servers. [15] Three of the flaws are rated critical. [15] In the worst one, BoKS made passwords for some service accounts from the time on the clock, so an attacker who could guess the time could rebuild a short list of possible passwords. [15] Fortra reported no attacks using any of them. [15]

   Why it matters — BoKS decides who may log in across a whole fleet of servers, so a flaw in it reaches all of them. [15] The three critical ones are rated between 9.1 and 9.9 out of 10 for how severe they are. [15]

7. 08

   Start-up raises $38m to fence in AI agents

   doxx.net, a Miami company founded in 2025 by Barrett Lyon, has raised $38 million in a round led by the investment firm Andreessen Horowitz. [16] It opened a test version of a private network for AI agents, the programs that browse and act on a person's behalf. [16] The network is meant to stop agents reaching known harmful websites, malware and fake login pages. [16]

   Why it matters — The company says agents act with their user's accounts but cannot always tell a safe page from an unsafe one. [16] CyberScoop reports that AI agents breaking out of tests and into organisations went from unheard of to routine within weeks. [19]

8. 09

   US agency lists two help-desk flaws as used in attacks

   CISA, the US cyber-defence agency, has added two flaws in Zammad to its list of holes known to be used in attacks. [17] Zammad is free software that organisations use to handle help-desk requests. [18] The two flaws were used together against DIVD, a Dutch volunteer group that reports security holes, in an attack it noticed on 24 September. [18] US federal agencies must now fix them ahead of less risky flaws. [17]

   Why it matters — DIVD asks everyone running Zammad to update to version 7 or take it offline. [18] CISA urges every organisation, not only US agencies, to fix the holes on its list first. [17]