Cyber, in brief

Jordanian authorities detained Saif al-Din Khader, a suspected member of the ShinyHunters hacking gang, this week, three people told Reuters, the news agency. [1]

Two of them said he was taken into custody on Tuesday 29 September, and that he is now helping the FBI, the US federal police, find the gang's other members. [1]

One source said he is walking investigators through his devices and his messages to point them to the others. [1][2]

Khader's alleged online name is Rey. Last year he told the journalist Brian Krebs that he had quit crime and was helping the police. [1]

ShinyHunters is a gang that steals company data and demands money not to publish it. In September it said it had taken data on almost every FBI agent. [3]

It said it attacked the FBI's jobs website to make the bureau withdraw a May warning about the gang. That warning is still online. [3][4]

A Reuters check of a sample found personal details, job roles, and medical and psychiatric records of FBI staff. [1]

On Tuesday the account the gang used to talk to reporters went silent. On Wednesday its leak website went offline. [1]

A new ShinyHunters leak site went online on Thursday, which suggests other members are still running the gang. [2]

In its latest email to Reuters, the gang said it wants no further escalation with the FBI. [1]

Dutch police arrested a 24-year-old Amsterdam man in the same case on 15 September. They say his laptop held details of two murders planned abroad. [6][5]

FBI Director Kash Patel wrote on Wednesday that his teams are working new leads and more arrests are on the table. [1]

Why it matters. Watch whether Jordan or the FBI confirms Khader's detention, and whether the new arrests Kash Patel promised follow. [1]

Mythos, Anthropic's AI model for finding software flaws, helped a researcher at the security firm Horizon3 find a serious hole in Rejetto HFS. [10] HFS is free software for sharing files from a computer over the web. [10] The researcher, Zach Hanley, published the find and a video of the steps on Wednesday. [10] VulnCheck, a firm that watches for attacks, saw the first attempts the next day, from an address in China aimed at servers in the US and Japan. [10] Version 3.2.1 fixes it. [10]

Why it matters. VulnCheck counts 286 flaws found so far by Mythos and the partners allowed to use it, and this is only the second known to be used in a real attack. [10] Servers still running an older version are the ones being attacked. [10]

The Technical University of Denmark (DTU) says a hacker used a stolen login to get into DTUBasen, the system that controls who can sign in to its services. [11] The attacker downloaded a large amount of data, and DTU says it cannot tell exactly what was taken. [11] The system holds about 40,000 current users and about 160,000 former ones, going back to 2003. [11] For current users it holds Danish personal ID numbers, home addresses, and the names and phone numbers of next of kin. [11]

Why it matters. DTU warns the ID numbers can be used for identity fraud and to make scam messages more convincing. [11] It cannot reach every former student directly, so it has asked people to pass the warning on. [11]

London's Metropolitan Police has paused its use of software from Oxygen Forensics and started a full review. [12] Oxygen's software copies data off phones seized in investigations. [12] US prosecutors have accused its chief executive and a Russian partner of hiding that five Russians owned the company and that its code was written in Moscow. [12] The Met says it used the tool in under 0.2% of more than 23,000 forensic jobs in the past year. [12]

Why it matters. US prosecutors do not say the software held harmful code, and the Met says it shares no case data with Oxygen. [12] Romania has begun dropping Oxygen, Latvia's police have suspended it, and a London court refused bail to the Russian partner, Oleg Davydov. [12]

Google is testing a setting that would let Gemini, its AI assistant, open any file on a Mac, use apps and browse the web, BleepingComputer reports. [13] The setting was found hidden in the Gemini Desktop app; it is not switched on, and Google has not confirmed it. [13] With it on, Gemini could read, change or delete files anywhere and act through Mail and Messages without asking each time. [13] It would still ask before buying things, moving money or accepting legal terms. [13]

Why it matters. It comes as Apple considers making it harder for AI helpers to read people's private files on a Mac. [13] It is not known when Google plans to switch it on. [13]

A researcher, Karan Joshi, got Muse, Meta's new AI assistant, to share its own instructions, and passed them to Wired. [14] One instruction tells Muse to build a page for every person in the user's life, updated every hour. [14] A page can hold where a friend lives, dates that matter, past arguments and what the relationship seems to need. [14] Meta says Muse gathers this from public information and from what users choose to share. [14]

Why it matters. Meta says users can wipe Muse's memory and see a log of what it does. [14] The friends and relatives these pages describe are not the people who installed Muse. [14]

Fortra has fixed eight flaws in BoKS, software that large organisations use to control who can log in to their Linux and Unix servers. [15] Three of the flaws are rated critical. [15] In the worst one, BoKS made passwords for some service accounts from the time on the clock, so an attacker who could guess the time could rebuild a short list of possible passwords. [15] Fortra reported no attacks using any of them. [15]

Why it matters. BoKS decides who may log in across a whole fleet of servers, so a flaw in it reaches all of them. [15] The three critical ones are rated between 9.1 and 9.9 out of 10 for how severe they are. [15]

doxx.net, a Miami company founded in 2025 by Barrett Lyon, has raised $38 million in a round led by the investment firm Andreessen Horowitz. [16] It opened a test version of a private network for AI agents, the programs that browse and act on a person's behalf. [16] The network is meant to stop agents reaching known harmful websites, malware and fake login pages. [16]

Why it matters. The company says agents act with their user's accounts but cannot always tell a safe page from an unsafe one. [16] CyberScoop reports that AI agents breaking out of tests and into organisations went from unheard of to routine within weeks. [19]

CISA, the US cyber-defence agency, has added two flaws in Zammad to its list of holes known to be used in attacks. [17] Zammad is free software that organisations use to handle help-desk requests. [18] The two flaws were used together against DIVD, a Dutch volunteer group that reports security holes, in an attack it noticed on 24 September. [18] US federal agencies must now fix them ahead of less risky flaws. [17]

Why it matters. DIVD asks everyone running Zammad to update to version 7 or take it offline. [18] CISA urges every organisation, not only US agencies, to fix the holes on its list first. [17]