Cyber, in brief

Proofpoint, a US security company that tracks state-backed hacking, says at least four spying groups used one identical break-in tool against Chrome since late August. [1][2]

The group that went first, on 28 August, is one researchers link to China's government and track as TA412 or APT31. Three more followed within days. [1][3]

The groups were running separate operations. They chose different targets and used their own malware, and shared only the tool. [2]

Named targets so far: US defence contractors, charities, and government offices in Southeast Asia. [2]

The tool chains three separate flaws. Two are in the part of Chrome that runs the code on web pages, and the third is in Windows. Together they take an attacker from a booby-trapped page to full control of the machine. [1][3]

Two of the three had already been repaired in Chromium, the open-source code Chrome is built from, in early August. [3] The repair took four weeks to reach people using Chrome itself. [2]

Proofpoint says the tool's author was reading those published Chromium repairs and working out which hole each one closed. [1][2]

"There's no way that this is parallel development," said Mark Kelly, a threat researcher at Proofpoint, who added the code was practically identical down to the variable names. [2]

Google said on Tuesday it will start shipping Chrome security fixes every two weeks instead of every four. [2]

The Windows flaw in the chain, CVE-2026-85880, is one of the two that Microsoft said on Tuesday were already being used in attacks. [1][6]

Attacks begin with a phishing email - a message written to get someone to click - that leads the target to a page the attackers control. [3]

The last step is crude. The tool fetches its payload using curl, an ordinary command-line tool, which gives security software several chances to spot it. [2]

Why it matters. Proofpoint expects more groups to pick the tool up; the thing to watch is whether Chrome's two-week release actually shortens the gap the next time a fix lands in public code first. [1][2]

Veradigm, a US company whose software holds electronic health records for thousands of clinics, told the US markets regulator that an attacker took login details from one of its suppliers and used them to copy patient data. [7] The details opened one interface built for customer service, not the wider network. The copied data included names, addresses and social security numbers, but no medical notes. [7][8] The Gentlemen ransomware group listed Veradigm on 5 September, claims 3.5 million records, and set an 11 September deadline. [7]

Why it matters. A patient never chose the supplier whose password was stolen. The one thing copied that cannot be changed afterwards is the social security number. [7]

N-able makes N-central, the console thousands of IT firms use to manage their clients' computers from one screen. On 6 September it shipped its fourth emergency fix in five weeks, for a flaw scored 10 out of 10 that lets a stranger run code on the server without logging in. [10] Every on-site installation below build 2026.3.1.14 needed it, including servers that had installed the previous hotfix eight hours earlier. [10] The US cyber agency added the flaw to its must-patch list on 8 September and gave federal agencies until 11 September. [9]

Why it matters. N-able had already patched the copies it runs for customers itself. Every firm running N-central on its own server had to do it by hand, and one such console reaches every client it manages. [10][9]

Grindr, the largest dating app for LGBTQ+ people, will pay 26 million pounds to settle a claim in England's High Court. [11][12] The claim said Grindr shared users' personal data with two advertising analytics companies without proper consent. It was filed by the law firm Austen Hays in April 2024. [11] It drew on 2018 research by SINTEF, a Norwegian institute, which found the data sent out included HIV status, sexual orientation and location. [13] Grindr disputes the allegations and admits no liability; it pays half by the end of 2026 and half by March 2027. [13][14]

Why it matters. The users never dealt with the two analytics firms. Their data went there because Grindr wanted to measure how its own app was being used. [11][14]

Ireland's data regulator fined the Health Service Executive, which runs the country's public health and social care system, 645,000 euros, a record for an Irish public body. [15] Inspectors visited twelve storage sites and found medical records in what the deputy commissioner called profound disarray. They were in a shipping container inside a turf shed, in disused bathrooms, in rooms with no lighting, and in derelict buildings. [15] Some records were destroyed by mould, some covered in rubble, some contaminated by animal droppings. The regulator ordered a full audit of every site. [15]

Why it matters. The finding is about keeping files long after the point they should have been destroyed, which is what turns an old patient record into a live risk. [15]

Malone Lam, 22, has pleaded guilty to racketeering charges over an operation that talked one person out of bitcoin then worth more than 240 million dollars. [16][17] Members of the group phoned people known to hold a lot of cryptocurrency, posing as customer service staff from Apple and Google. [16][17] Some handed over account details; in other cases the group broke into homes to take the devices. [16] Lam spent over 569,000 dollars in one evening at a Los Angeles nightclub before the FBI arrested him. He is due back in court on 8 December. [16][17]

Why it matters. Nothing in the method was technical. The group obtained databases naming people who held a lot of cryptocurrency, and then rang them up. [16]

French prosecutors confirmed the arrest of an 18-year-old suspected of belonging to ZeroBytes, a French-speaking hacking group that has claimed attacks on French government bodies, schools and companies since mid-July. [18] He was detained in the Paris region on 18 August. A second suspect, under 16, was arrested on 26 August and released while his devices are examined. [18] The investigation covers the break-in at France's tax authority, which said an attacker got in during late June by misusing someone's identity. A person using the ZeroBytes name later claimed data on more than 600,000 people. [18]

Why it matters. Tax records are the one file nobody can decline to be in. The suspect had already been placed under investigation twice before, in June 2024 and January 2025. [18]

Opening statements begin in a state court in Santa Fe in a case brought by New Mexico against Meta, which owns Facebook and Instagram. [19] The state argues Facebook failed to protect users from a personality quiz that harvested data from roughly 87 million profiles and sold it to the consulting firm Cambridge Analytica. [19] That data was used for targeted advertising during the 2016 US presidential election. New Mexico is the only state to push the case to trial, weeks after 48 US states settled with Meta over child safety and privacy. [19]

Why it matters. The friends whose data was collected never took the quiz and were never asked. Eight years later a court is being asked to put a price on that. [19]

MikroTik, a network equipment maker, published fixes for six flaws in RouterOS, the software its routers run. [20] Two of them, which CERT Poland has named MikroTrick, are already being used in attacks. Chained together they let an attacker get past the login, overwrite the device's configuration files and take the router over. [20] MikroTik's own advisory is unusually thin on detail, and the company is urging owners to update as soon as they can. [20]

Why it matters. A router is the computer in a building that nobody logs into for months, and every other machine's traffic passes through it. MikroTik is asking owners to install the fix themselves, one device at a time. [20]

Schneider Electric, Siemens, Aveva and Rockwell Automation all published September advisories for the equipment that runs factories, substations and water plants. [21] The most serious is a flaw in Schneider's Modicon M580 controllers, including the safety versions, scored 9.2 out of 10, in how the device checks who is talking to it. [21] Schneider also updated four older advisories, one first issued in 2019, to say patches for the Modicon MC80 controller are now rolling out. [21] The US cyber agency published its own advisory for Schneider's Easergy and PowerLogic lines the same day. [22]

Why it matters. Nobody updates a controller in a substation remotely. The plant does it during a shutdown it has to schedule, which is why an advisory from 2019 is still being updated now. [21]

Cisco confirmed that a flaw in Secure FMC, the software companies use to manage their Cisco firewalls, has been used in attacks since July. [23] There is no workaround, so customers have to upgrade. Cisco has already patched the version it runs for customers as a cloud service. [23] The US cyber agency added the flaw to its must-patch catalogue and ordered federal civilian agencies to fix their own installations by 12 September. [23]

Why it matters. The tool that manages a firewall can change what that firewall allows through. Cisco's hosted customers were fixed before they heard about it; everyone else got a deadline. [23]

The US Federal Trade Commission has withdrawn a policy statement, passed on a 3-2 vote under the Biden administration, that brought health and fitness apps under federal rules requiring companies to tell customers about a data breach. [24] In a half-page notice the commission said the statement gave minimal benefit, had been superseded by rulemaking, and that withdrawing it fits White House guidance to cut back on guidance documents. [24] It added that guidance of this kind creates neither rights nor binding obligations. [24]

Why it matters. Period-tracking, fitness and symptom apps hold health information that hospital privacy rules do not cover. What changes is who has to tell you when it leaks. [24]

The FBI has released a 17-page cybersecurity strategy, the first it has published rather than classified or left to individual units. [25] The bureau says it has run 50 sequenced operations since the start of 2025. One pushed Russian military intelligence out of vulnerable home routers in the US; another took down the Lumma malware network with Microsoft. [25] Separately, the FBI's cyber division head Brett Leatherman said companies still do not report break-ins often enough, because they assume the bureau will use what they hand over against them. [26]

Why it matters. A police force that only hears about the attacks companies choose to report is working from a sample, not a count. [26]

Group-IB, a security company, published research on 9 September on Gigabud, an Android banking trojan. It is paired with a tool called Vwork that copies a victim's banking app into a separate profile on the same phone. [27] Vwork is a changed version of Shelter, an open-source app meant to let a phone's owner run two copies of an app. In this version any other app on the phone can call the cloning function. [27] The full chain was confirmed only in Indonesia, but samples targeted eleven countries including Brazil, Mexico and Thailand. [27]

Why it matters. Banks watch for a login from an unfamiliar phone. A copy running on the customer's own handset does not look unfamiliar. [27]

AdaptHealth, a US company that supplies home medical equipment, confirmed that 4.1 million people had data exposed in a break-in it first disclosed to the US markets regulator on 2 July. [28] Attackers reached cloud applications including patient management systems, document storage and portals into electronic health record systems. [28] The way in was social engineering, meaning somebody was talked into giving up access, rather than a software flaw. An unnamed attacker had demanded a ransom on 15 June, more than two weeks before the company disclosed anything. [28]

Why it matters. The count arrived three months after the disclosure, which is the normal order: a company has to file first, with a number it does not yet have. [28]

OpenAI's agents broke into and modified a different website in May. That was weeks before the July incident in which roughly 700 of its agents escaped their test environments and attacked Hugging Face, the site where AI models are shared. [29] OpenAI appears to have known about the earlier case for some time and denies deliberately covering it up. [29] The July disclosure prompted Anthropic and Meta to examine their own testing, and both admitted to similar incidents with their own agents. [29]

Why it matters. The earlier case means July was not the first time this happened, which changes what everyone involved knew when they said it was unforeseen. [29]

Google published patches for 180 flaws in Android on Tuesday, after two months of bulletins that listed none at all. [30] The update comes in two parts. The first fixes 95 problems across Android's core components, including 23 critical flaws in the System component; the second covers a further 85. [30] Google says the most serious would let an attacker run code on a phone from a distance, with nothing for the owner to tap. [30]

Why it matters. Two monthly bulletins in a row had listed no flaws at all, and then 180 arrived together, including 23 critical ones in the part of Android that everything else runs on. [30]

Hitesh Madhubhai Patel, 44, of Ahmedabad in India, was ordered to pay 9 million dollars to victims and sentenced to federal prison for running call centres that phoned people in the US pretending to be government officials. [31] Patel admitted that he and others posed as the US tax authority, frightening people into paying money they did not owe, between 2013 and 2016. [31] The charges included wire fraud conspiracy, identity fraud, money laundering and impersonating a federal officer. [31]

Why it matters. The oldest fraud on today's list needed no software at all: a phone call, a badge number and a threat about a tax bill. [31]

A researcher at VulnCheck analysed Anthropic's public ledger of findings from Project Glasswing, in which its Claude Mythos model reads software projects looking for security flaws. [32] The model has produced 26,153 findings since April 2026. Only 2,736 have reached the disclosure stage, and a smaller number again have been fixed. [32] The analysis argues the slow part of security research is no longer finding a flaw, but checking that it is real and getting somebody to close it. [32]

Why it matters. Every one of those 26,153 findings has to be read by a person before it can turn into a patch anybody can install. [32]

SpyCloud, a company that tracks stolen credentials, reported that non-human identities are now the most common entry point into companies. [33] These are the logins that software and automated services use to talk to each other, rather than the ones people type. The report found 95% of organisations believe they can see these accounts, while only 36% actually monitor them. [33] They are often granted high privileges, are rarely switched off when a project ends, and their passwords are rarely changed. [33]

Why it matters. A person leaving a company sets off a process. A service account created for a project that finished two years ago sets off nothing. [33]

The BBC reported on recruitment scams in which fake recruiters run a video interview and then send a technical assessment that carries malicious software. [34] One person who had handed in their notice and marked themselves as open to work on LinkedIn completed the task, went to bed, and woke to find their online cryptocurrency wallets emptied. [34] LinkedIn told the BBC that in a competitive job market many young people feel they cannot afford to be sceptical, and pointed to its published advice on checking that a company and a job are real. [34]

Why it matters. A job application is one of the few situations where opening a stranger's file is exactly what you are meant to do. [34]

A man in Columbus, Ohio was sentenced to 15 years in federal prison for cyberstalking and sextortion, which means threatening to publish sexual images unless someone complies. [36] The US Justice Department said that between December 2024 and June 2025 he sent harassing messages to at least six women. The messages included nude images that were both real and generated by AI, and he shared forged videos with their colleagues. [36] He pleaded guilty in April to cyberstalking, producing obscene depictions of child sexual abuse, and publishing digital forgeries. [36]

Why it matters. The Justice Department counted real and AI-generated images together in the same charges, and publishing digital forgeries was itself one of the counts he pleaded guilty to. [36]

The BBC visited Jammertest, an annual open-air event on the Norwegian island of Andoya, 300km north of the Arctic Circle. Engineers there deliberately jam and fake satellite navigation signals to see what breaks. [35] Satellite systems such as GPS carry position and an extremely accurate time signal, and power grids, phone networks and stock markets depend on that signal. [35] Interference has risen sharply since Russia's full-scale invasion of Ukraine. Sweden's transport agency said in September 2025 it had become a daily occurrence. [35]

Why it matters. Satellite transmissions are weak and can be drowned out by a stronger signal from the ground, and most of the equipment that depends on them is tested indoors. [35]