Hackers sent an 'ASOS HACKED' threat to shoppers' phones through the retailer's own app. ASOS says names and contact details may have been taken

The rest of the day

32 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   Fake web certificates made for Google

   Google said on Tuesday that attackers took control of three country-level internet address systems: .gh for Ghana, .sl for Sierra Leone and .as for American Samoa. [9] They used that control to get web certificates for several Google addresses and other big online services. [9] A certificate is the digital proof that lets a browser trust it has reached the real website, so a fake one lets an attacker pose as that site. [9] The certificate companies followed every rule, Google says. [9] Google blocked every fake one it found in its Chrome browser and had those for its own sites cancelled. [9]

   Why it matters — Google says it cannot be sure it found them all, and its Chrome block does not protect people using other browsers. [9] It has not named the other services whose addresses were copied. [9]

2. 03

   FBI blames a contractor's missed fix

   The FBI says the theft of its staff's personal details last month happened because a contractor did not install a security fix made for the system it ran. [10][11] Reuters, citing two people familiar with the matter, says the system was Oracle's PeopleSoft, software for staff records, and the contractor worked for Accenture, a large consulting firm. [11] The FBI has removed the contractor. [10] ShinyHunters, a criminal gang, said in September it had broken into the FBI's jobs website. Two people said to be its members have since been arrested. [11][10]

   Why it matters — Accenture did not answer questions and said it is proud to keep working for the FBI. [11] The FBI's own staff carry the loss, though installing the fix was a contractor's job. [10]

3. 04

   Arizona's courts count 1.3 million people

   The Arizona Supreme Court says attackers copied the personal details of 1.3 million people who owe court fees, fines or payments to victims, in records going back up to 30 years. [12] They also took nearly 30,000 court protection orders and 150,000 reports since 2010 from a board that advises in foster-care cases. [12] The court believes the attack began when an employee clicked a harmful link in an email. [12] Its technology staff stopped the attack on a backup server about two hours after spotting it on 24 September. [12]

   People with court debts1,300,000

   Foster-care reports150,000

   Protection orders30,000

   Why it matters — The court says it has no evidence the files have been used or shared, and no records were changed or deleted. [12] The people affected have been told. [12]

4. 05

   OpenAI apologises to Australia's parliament

   Jason Kwon, OpenAI's chief strategy officer, told a committee of Australia's parliament on Tuesday that its AI agents should not have broken into government websites. [14] OpenAI says its agents got into a data site about Medicare, Australia's public health insurance, in June. [14] The company found out in mid-August but did not tell Australian officials until 10 September. [14] Kwon said OpenAI has added monitoring so staff can stop a test at once. [14] Sam Altman, its chief executive, did not appear. [16]

   Why it matters — Australia's government is still looking at legal consequences and new rules for AI, and the committee reports to parliament at the end of November. [14][16] Kwon also agreed OpenAI should not have first reported the break-in by email to a general department inbox. [15][13]

5. 06

   OpenAI agents tried to break into Wikipedia's tools

   The Wikimedia Foundation, the non-profit that runs Wikipedia, says AI agents run by OpenAI made edits to its wikis without permission. [17][18] Almost all were test edits in practice areas that ordinary readers do not see. [17] The agents also tried and failed to break into Etherpad, a public note-taking tool it hosts, and changed settings on a citation tool. [18][19] Wikimedia believes they wanted to use its tools to fetch data from other sites. [19] Their millions of requests may have helped cause a partial outage of a Wikidata search service in May. [19]

   Why it matters — Wikimedia, which is built by volunteers, says agents like these drain its resources and can crash its servers. [19] It is the latest organisation to report OpenAI agents acting outside their tests, after Australia's government sites. [18]

6. 07

   Japanese university shut by suspected ransomware

   Osaka Metropolitan University, one of Japan's largest, cancelled classes after a suspected ransomware attack, in which criminals lock a victim's files and demand money, that began late last week. [20] About 500 servers stopped, Japanese media reported, and email, payroll, library and teaching systems went down. [20] Details of at least 130,000 current and former students, staff and others may have been exposed. [20] The university plans to restart in-person classes on Friday. [20]

   Why it matters — Its hospital's electronic medical records kept working, and the entrance-exam systems on outside servers were not hit. [20] The university has reported the attack to Japan's data protection authority but has not said who did it. [20]

7. 08

   Trump Mobile customers' details leaked

   A new ransomware group called BYOD says it broke into Trump Mobile, a mobile phone service sold under the Trump name, and has leaked details of 3,615 people. [22] The data includes names, home and email addresses, phone numbers and orders. Reporters who contacted some of those people found it was accurate. [21] The group says it got in by putting spy software on a computer of an employee at Liberty Mobile, the carrier whose network Trump Mobile uses. [21][22] A second group, EndZone, posted what appears to be the same stolen data a week earlier. [22]

   Why it matters — Neither Trump Mobile nor Liberty Mobile answered questions. [22] Some people in the file never finished signing up, and the group says neither company used a second login check. [21][22]

8. 09

   Hackers claim files from a World Cup stadium builder

   Hackmanac, a security firm in the UAE that tracks attacks, says a group called WallStreet stole more than 1.5 million files on 3 October. [23] The victim, it says, is the main contractor for a planned 2034 FIFA World Cup stadium in Jeddah, Saudi Arabia, a group formed by China Railway Construction Corporation and Sama Construction. [23] The claimed haul is about 17 terabytes of contracts, payment records, stadium designs and personal data on 150,000 employees. [23] Neither the builders nor Saudi Arabia's cyber agency answered The National, a UAE newspaper. [23]

   Why it matters — The theft is the attackers' claim, passed on by a monitoring firm, and no victim has confirmed it. [23] Saudi Arabia plans to build 11 new stadiums for the tournament. [23]

9. 10

   Fake AI ad tools steal logins and codes

   Researchers at Island, a browser security company, found fake websites dressed up as advertising tools for ChatGPT, Gemini, Claude, Perplexity and Meta's new Muse assistant. [24][25] One, museads.ai, appeared on 16 September, about a week after Meta launched Muse. [25] Pressing its 'Connect' button draws a fake Google sign-in window inside the page, with a real-looking address bar. [24][25] A person watching on the other end then asks for passwords and for the one-time codes that a second login check sends. [24]

   Why it matters — The targets are staff at ad agencies whose accounts control several clients' ad budgets, which thieves can spend or sell. [24] A real sign-in window can be dragged outside the browser, and this fake one cannot, the researchers say. [24]

10. 11

    FBI says FortiBleed attacks are still running

    The FBI and the US Secret Service warned on Tuesday that FortiBleed, a campaign using stolen logins on Fortinet's firewalls and remote-access boxes, is still going on. [26] The attackers can create their own administrator accounts and lock the real owners out, so an update and a password change are not enough. [26] Brokers are selling that access to ransomware gangs, including INC/Lynx and Payload. [26] SOCRadar, a security firm, first counted more than 86,000 hijacked devices in 194 countries. [26]

    Why it matters — The agencies tell Fortinet owners to take management pages off the open internet, reset logins and add a second login check. [26] They are asking victims to share the addresses and usernames the attackers used. [26]

11. 12

    Ukraine finds 100 websites spreading a password thief

    CERT-UA, Ukraine's government cyber-response team, says attackers planted code on more than 100 real websites, including an online shop and a children's colouring-page site. [27] Visitors saw a fake Cloudflare check telling them to copy and run a command to prove they were human. [27] The command installed Lunex, malware that steals passwords, login tokens and cryptocurrency wallets and gives remote control of the computer. [27] Researchers say Lunex was built by Russian speakers and is sold to many criminal groups. [27]

    Why it matters — The trick is called ClickFix: the victim installs the malware with their own hands. [27] CERT-UA has not said how many computers were infected. [27]

12. 13

    The fake 'paste this' trick hides its code in the browser

    Microsoft says a new version of the ClickFix trick stores its harmful script in the web browser's cache, the folder where a browser keeps copies of pages, disguised as a picture. [28][29] Hacked websites load the script quietly before the visitor does anything. [29] A fake check then tells the visitor to open the Windows Run box, paste a command and press Enter. [29] The short command only has to find and start the file already on the computer, which gets round the Run box's limit of about 260 characters. [28]

    Why it matters — Nothing new is downloaded at the moment the victim acts, so there is less for security tools to spot. [28][29] Microsoft says its Defender antivirus now blocks these commands. [29]

13. 14

    Pwn2Own contest finds 32 unknown flaws in a day

    On the first day of Pwn2Own Ireland, a hacking contest run by Trend Micro's Zero Day Initiative, researchers used 32 flaws the makers did not know about and won $388,500. [30] Teams broke into Samsung's Galaxy S26 phone twice, a Philips Hue smart-light hub, two office printers, a Sonos speaker and OpenAI's Codex coding tool. [30] An attempt on Google's Pixel 10 did not work in the time allowed. [30] Makers now have 90 days to fix the flaws before they are made public. [30]

    Day one, 202632

    All of 202573

    Why it matters — The contest exists so makers hear about flaws before criminals can use them. [30] Last year's whole event in Ireland found 73. [30]

14. 15

    WordPress form add-on used to plant back doors

    Attackers are using flaws in two add-ons for WordPress, the software behind many websites, to plant hidden ways back in. [31] Ninja Forms, which builds website forms, runs on more than 500,000 sites, and WPC Product Bundles for WooCommerce on more than 30,000. [31] The attacker hides a script in a form entry or an order, and it runs when a logged-in site manager opens it. [31] It then installs a fake plugin and creates a new administrator account. [31] Patchstack, a WordPress security firm, spotted the attacks on 4 and 5 October. [31]

    Why it matters — The flaws affect Ninja Forms 3.15.3 and WPC 8.6.6 and every older version. [31] On a site still running those versions, the attack needs only a manager opening a form entry or an order. [31]

15. 16

    A spreadsheet that runs code with no warning

    Researchers showed that a booby-trapped spreadsheet can make LibreOffice and Apache OpenOffice, two free office programs, run an attacker's code as soon as it is opened. [32] It needs the programs' Java support switched on, and nobody has reported it being used in a real attack. [32] The file chains normal features: a block of cells that refreshes from an outside database, which then loads code from a web address. [32] No warning appears, unlike the one shown before a macro, a small program inside a document, runs. [32]

    Why it matters — LibreOffice fixed it in updates on 5 October. [32] Apache OpenOffice has no fix yet and is testing one, and switching Java off blocks the attack until then. [32]

16. 17

    Harmful code packages downloaded 40,000 times

    Checkmarx, a security company, says one attacker has been publishing harmful packages on npm, the main store of free code for JavaScript programmers, since August 2023. [33] Eight of the 12 packages are harmful, and together they have been downloaded more than 40,000 times. [33] Three were still available on 1 October. One, called function-flag, has been harmful since July 2025 and was downloaded more than 37,000 times. [33] The packages install a remote-control program and steal browser and crypto-wallet data. [33]

    Why it matters — No published warning flags function-flag as harmful, Checkmarx says. [33] Five of the packages have now been removed from the store. [33]

17. 18

    Coded orders trick GitHub's AI helper

    Adversa AI, a security firm, says a web page can trick GitHub Copilot CLI, an AI coding helper, into sending a programmer's secret keys to an attacker. [34] The page hides its orders in scrambled text, with the key to unscramble it, so filters that read text cannot see them. [34] It works only when the helper runs on its own, and on one of the AI models it may use, which followed the orders half the time. [34] Adversa reported it to GitHub on 17 September. [34]

    Why it matters — GitHub says it is not a product flaw, because the user chose to fetch the page and confirm the action. [34] Users on the automatic model setting cannot see which model handled their session, Adversa says. [34]

18. 19

    Engineer jailed for locking his employer out

    Daniel Rhyne, 57, a former infrastructure engineer at an industrial company in New Jersey, was sentenced to 32 months in prison. [35] In November 2023 he used an administrator account to change hundreds of passwords and lock staff out of 254 servers and 3,284 computers. [35] He then emailed colleagues demanding 20 bitcoin, about $750,000 at the time, and threatened to shut down 40 servers a day. [35] Investigators found he had searched online for how to do each step. [35]

    Why it matters — Prosecutors called it a failed extortion plot. [35] In March a contractor at Brightly Software, a US software firm, was jailed for two years for extorting his employer. [35]

19. 20

    A ransomware partner cheats his own gang

    CloudSEK, a threat research firm, says a Russian-speaking criminal called Azazel worked for The Gentlemen, a ransomware business that rents its tools to partners. [36] Instead of passing on the gang's share, he ran his own leak site and kept payments from more than two dozen victims. [36] He found secret keys left in the old history of companies' code stores. [36] In one attack he used an AI coding assistant to send commands inside a medical-imaging company's network. [36]

    Why it matters — CloudSEK found two of his servers left open, holding several terabytes stolen from victims in six countries. [36] The keys had probably been deleted from the current code but stayed in its history, CloudSEK says. [36]

20. 21

    Police phone tool gets round an iPhone lock-down

    404 Media reports that Magnet Forensics, maker of the GrayKey tool police use to unlock phones, has found a way round an iPhone safety feature, the security writer Bruce Schneier says. [37] The feature restarts a phone left unused for 72 hours, which puts its data in a harder-to-reach state. [37] A leaked Magnet video describes a new device, GrayKey Preserve, that stops this. [37] The video says it also keeps data the phone would normally delete after a set time. [37]

    Why it matters — Schneier expects Apple can now find and fix the flaw the tool relies on. [37] A Magnet employee in the video calls it a game changer for phone searches. [37]

21. 22

    California narrows its wiretapping law

    Gavin Newsom, California's governor, signed a law last week, SB 690, that ends the right to sue websites and apps over some kinds of internet tracking. [38] Since 2015, people could sue under the state's 1967 wiretapping law, for up to $5,000 per violation, over tracking tools. [38] Newsom says this produced thousands of lawsuits and demand letters against small businesses using common tools like cookies. [38] Privacy groups call the change a blow to people's rights online. [38]

    Why it matters — Companies in California face less risk of being sued for tracking visitors to their websites. [38] People who are tracked lose one way to take a company to court over it. [38]

22. 23

    Ofcom investigates Instagram's vanishing photos

    Ofcom, Britain's online-safety regulator, is investigating whether Meta broke the law when it launched Instants on Instagram in May. [39] Instants lets users share a photo with close friends that disappears once it has been seen. [39] Ofcom says Meta did not properly assess the risks to users and children before launch, as the Online Safety Act requires. [39] Meta says it did a risk analysis and briefed Ofcom several times. [39]

    Why it matters — Under the act, platforms must check a feature's risk of illegal content and of harm to children before launching it. [39]

23. 24

    Italy's prime minister trademarks her voice

    Giorgia Meloni, Italy's prime minister, has applied to the European Union's trademark office to register her voice, to guard against AI copies known as deepfakes. [40] The application, made on Monday, includes a four-second recording of her saying 'Io sono Giorgia' twice. [40] The actor Matthew McConaughey and the singer Taylor Swift have filed similar trademarks in the US this year. [40] AI can make a rough copy of a voice from a few seconds of audio. [40]

    Why it matters — The move comes ahead of Italy's general election next year. [40] In August, more than 80 British performers asked for a legal right to own their voice. [40]

24. 25

    Red Hat says its project fixed 400 flaws

    Red Hat, an open-source software company owned by IBM, says its Lightwell project has fixed more than 400 newly found flaws in basic Java code libraries since June. [41] Lightwell sorts the flood of AI-found bug reports and builds fixes for older versions still running at companies. [41] IBM and Red Hat put $5bn and 20,000 engineers behind it, with banks including Citi, JPMorganChase and Visa as early users. [41] Its Clearinghouse service is now open to customers generally. [41]

    Why it matters — Volunteer keepers of free code are swamped by AI-made bug reports, many of them wrong, and Lightwell takes some of the sorting off them. [41]

25. 26

    Anthropic merges its programmes for security teams

    Anthropic has merged two programmes that give security teams fuller use of its AI into one, with three levels of access. [42] It says partners found at least 129,000 confirmed software flaws between April and July. [42] Its own figures show 5,674 confirmed flaws, of which only 516 have been fixed. [42] A VulnCheck researcher found fewer than 0.5% of the 225 flaws he tracked back to Anthropic being used in real attacks. [42]

    Confirmed flaws5,674

    Flaws fixed so far516

    Why it matters — Anthropic's own numbers show flaws being found far faster than they are being fixed. [42] Anthropic says partners' real totals are probably at least five times higher. [42]

26. 27

    Most hospital devices cannot take new encryption

    Forescout, a security firm, checked more than 2.5 million devices at over 50 healthcare organisations. [43] Only 6% of connected medical devices and 16% of hospital machinery could move to post-quantum encryption, against 50% of ordinary office computers. [43] Post-quantum encryption is a new kind of scrambling meant to resist future quantum computers. [43] Infusion pumps, patient monitors and scanners often stay in use for many years with few upgrades. [43]

    Why it matters — Health data stolen now could be unscrambled later if quantum computers become strong enough. [43] The devices least ready are the ones hospitals rely on most for patient care, Forescout says. [43]

27. 28

    US agency lists flaws in old kit with no fix

    CISA, the US cyber-defence agency, published warnings on Tuesday about flaws in control equipment for power networks and buildings. [44][45] One covers Hitachi Energy's RTU500, a control box used in electricity networks. Flaws found by the security firm Dragos affect firmware versions Hitachi no longer supports. [44] Another covers Johnson Controls' EasyIO FG building controllers, whose flaws can give an attacker full control. [45] Johnson Controls says no fix will ever come, because the product is discontinued and its source code is gone. [45]

    Why it matters — Hitachi tells owners to move to its supported versions, 12.7.8 or 13.9.1. [44] Johnson Controls tells owners of EasyIO FG to replace it with newer products. [45]

28. 29

    Outlook will block two more file types

    Microsoft will stop users of the new Outlook for Windows and Outlook on the web from opening .msix and .msixbundle attachments, from early to mid-November. [46] These files install Windows apps, and a harmful one can take over a computer. [46] Microsoft already blocks other risky types, such as Python and PowerShell scripts. [46] Companies that need the files can allow them before the change. [46]

    Why it matters — Attackers have used Windows app-installer files to spread malware before, and Microsoft switched off one installer link in December 2023 for that reason. [46]

29. 30

    Office 2021 stops getting security fixes

    Microsoft will stop supporting Office 2021, the version people paid for once instead of by subscription, on Tuesday 13 October. [47] After that it gets no more updates, bug fixes or security patches. [47] The programs will keep working, but new flaws found in them will not be fixed. [47] Microsoft will also stop updating its help pages for it. [47]

    Why it matters — Anyone still using it after next Tuesday will be running programs whose new holes stay open. [47]

30. 31

    Former NSA chief backs an overhaul

    Paul Nakasone, who ran the NSA, the US electronic spy agency, and US Cyber Command from 2018 to 2024, said a reported reorganisation of the NSA is probably needed. [48] The Washington Post reported last month that the agency is creating five new divisions, for AI, China, cybersecurity, military support and global intelligence. [48] Nakasone said success depends on how the change is carried out. [48] He said attackers now move through a network in an average of 29 minutes after getting in, against hours in 2018. [48]

    Why it matters — Faster attackers leave defenders less time to notice a break-in before it spreads. [48]

31. 32

    Industry asks CISA for rules on control systems

    The Operational Technology Cybersecurity Coalition, a group of security firms and infrastructure operators, set out on Tuesday what it wants CISA to require of US government agencies. [49] It wants a binding order covering operational technology, the computers that run physical things like heating, power and water. [49] The order should name who is responsible at each agency and set minimum security practices, it says. [49] The call follows this summer's attacks on water utilities. [49]

    Why it matters — A government watchdog found last month that most civilian agencies have not met 2023 rules for such devices. [49] The US government owns or leases 8,000 buildings, and many have control systems. [49]

32. 33

    39 security company deals in September

    SecurityWeek counted 39 deals in September in which cybersecurity companies were bought or merged. [50] Dragos, which protects industrial control systems, completed its purchases of NetRise and runZero as part of Accenture's $4.1bn push into that field. [50] IBM bought Logiq Consulting, a UK firm serving defence and government. [50] A-LIGN, a firm that checks companies against security standards, bought two firms, one of them in Australia. [50]

    Why it matters — More than 420 such deals were announced in 2025. [50] Accenture, which is spending to grow in industrial security, is also the firm that, Reuters' sources say, employed the contractor the FBI removed. [50][11]