We built Breachrr to answer one question: what do attackers already know about your company? The free audit at breachrr.com/audit scans your domain against breach databases, public code repositories, and certificate transparency logs. Real findings. Real risk score. No account required. Here’s what it looks like. 👇

Socket reported on 9 October that a new wave of the GhostAction campaign used two compromised maintainer accounts (kitao and henrywoo) to push a workflow named security-audit.yml into 346 repositories on 8 October, including kitao/pyxel and uber/athenadriver. The workflow exfiltrates GitHub Actions secrets and sweeps the working tree plus full git history for cloud, AI, and SaaS credentials, posting them in cleartext to 193.32.204.199. Socket later identified more than 500 GitHub accounts committing the same file to tens of thousands of repositories since 7 October. Earlier September activity had already hit 772 repositories targeting 2,577 secrets. The control is which GitHub account can still write a workflow, and whether anyone reviews the commit that adds one named security-audit. A personal access token that outlives the person who generated it is not access control.

CrowdSec disclosed that on 22 May an attacker used a former employee's still-active GitHub OAuth token to clone approximately 170 private repositories. The employee had left; other access was revoked, but GitHub membership was kept open to finish work. The token was harvested via the TanStack npm supply-chain attack on the former employee's laptop. CrowdSec removed the account on 25 May. The archive surfaced in mid-September. The control is which token can still read the private repos after the person who owns the laptop has left. A GitHub org seat that survives offboarding is not access control.

Verizon’s 2026 DBIR: credential abuse accounts for 22% of initial access in confirmed breaches. Vulnerability exploitation is second at 20%. Ransomware and extortion were present in 44% of breaches, up from 32%. For teams under 200 people, the highest-ROI step remains enforcing phishing-resistant MFA on email, identity providers, and remote access before chasing more complex controls. Attackers still take the path of least resistance.

A 2026 National Cybersecurity Alliance/CISA survey of 1,000 SMB leaders found 86.8% have MFA, but only 51.1% require it on all key accounts. 35.7% require it on only some. Partial coverage is not a control. An attacker needs one unprotected path, email protected, VPN or accounting not, to move laterally. Stolen credentials remain a top ransomware vector for small businesses.

Nikkei disclosed on 4 October that an employee Microsoft 365 account was accessed by a third party and used on 30 September to send approximately 9,000 emails containing links to malicious websites. Recipients included internal staff and external contacts, including news sources who had communicated with several Nikkei employees. The company changed the password and reports no further unauthorized logins. It is investigating the scope of leaked information, which it believes includes recipients' names, email addresses, and the content of some emails. The incident was reported to Japan's Personal Information Protection Commission. A separate Google Workspace account used by another employee had been accessed from outside since late July. Google notified Nikkei in early August. Names and email addresses associated with 1,646 employees and business partners may have been exposed. Nikkei says no reader or source data was involved in that case, and no secondary damage has been confirmed. The two incidents are described as separate. The control is which mailbox can still send as the company, and who still has the password or session after the person who owns it is offline. A shared or lightly monitored Microsoft 365 account is not access control.

CISA updated its alert on Citrix NetScaler ADC and Gateway zero-days on 9 October. The update adds CVE-2026-107406, includes CVE-2026-88779 after its 4 October addition to the KEV catalog, clarifies a possible relationship between CVE-2026-88779 and CVE-2026-88771, and stresses that organizations should apply the patches for CVE-2026-88771 through CVE-2026-88779 and CVE-2026-107406 promptly. CVE-2026-88771 and CVE-2026-88772 were added to KEV on 27 September as critical zero-days that enable unauthenticated remote code execution. CISA confirmed active global exploitation. CVE-2026-88779, added 4 October, can cause denial of service on SAML SP/IdP configurations and, on unpatched systems, may force a reboot that accelerates code previously injected via CVE-2026-88771. CVE-2026-107406 affects SAML IdP or SP configurations and can enable RCE or DoS; Citrix states it is not aware of unmitigated exploits of this one as of the bulletin. CISA notes that patching can be complex and may require downtime. It urges checking for indicators of compromise before applying updates, because updates can reduce forensic visibility. Local logs may rotate quickly. Organizations that suspect compromise should preserve evidence, restore a known-good backup that pre-dates the suspected activity, and rotate all secrets including local passwords, key-encryption keys, and SSL certificates. Citrix has published steps for suspected compromise and indicators via NetScaler Console. The control is which remote-access appliance still accepts unauthenticated traffic, and whether anyone has already walked through it. A VPN or ADC that only the vendor can fully reset is not an access boundary.

CISA, the FBI, the NSA, and partners published joint advisory AA26-281A on 8 October. Title: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data. The authoring organizations are FBI, CISA, NSA, NCSC-UK, ASD's ACSC, the Canadian Centre for Cyber Security, Japan's National Police Agency and National Cybersecurity Office, NCSC-NZ, and Spain's CNI. The advisory says the information comes from technical evidence recovered during multiple FBI investigations related to Integrity Technology Group. Integrity Tech is described as a China-based for-profit company with links to the Chinese government. The actors it enables use TTPs consistent with activity publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett. The advisory says those actors may also perform activity not associated with Integrity Tech, and that vendor cluster names are not a 1:1 match to the US government's methodology. Access path in the advisory: since at least mid-January 2021, command-line exploit code, plus XSS. An FBI-recovered XSS payload rewrites a page into username and password fields, then offers a password-protected zip containing live700_v1.exe. That binary starts DiagTrack.exe, which talks over HTTP to dns.studiocloud.xyz, a domain the FBI attributes to Integrity Tech. The FBI assesses it likely targets mailbox data. Separate from that, EBurst password-sprays and guesses Microsoft 365 and Exchange accounts through ECP, EWS, and OAB. Persistence is SoftEther, often named conhost.exe or dllhost.exe, set to reconnect on startup. A PHP script, Curlc4.txt, pulls mail through the EWS API and, in some cases, encrypts it with RC4 or AES-128-CBC before upload. office-cli keeps pulling Outlook 365 mail using client_id, tenant_id, and secret. The FBI recovered an archived email database. Observed email-theft victims included government organizations, law enforcement, healthcare systems, and religious institutions in Southeast Asia. In some instances access to the stolen mail was restricted to IP addresses from Xiamen, China. The advisory says the actors maintain a custom web application that gives third parties access to stolen email content. Users pass arguments in URLs to view mail for specific accounts. Appendix B lists eight CVEs as successfully exploited, recovered from MicroScan scripts. MicroScan is a Python web app with over 1,300 scripts, in use as early as 2017. An asterisk means newly added to CISA's KEV catalog: CVE-2015-3306 (ProFTPD 1.3.5), CVE-2015-5477 (BIND 9), CVE-2016-3081 (Apache Struts), CVE-2021-3199 (ONLYOFFICE DocumentServer 5.1.5 through 5.6.2), CVE-2023-22894 (Strapi up to 4.5.5). The other three, already known exploited, are CVE-2014-6278 (Bash through 4.3 bash43-026), CVE-2019-11510 (Pulse Connect Secure), and CVE-2021-22205 (GitLab from 11.9). The 8 October press release says these actors target edge devices that are not closely monitored. Same day, a separate Justice Department release announced court-authorized seizures of two tools, Microscan and FishHub, allegedly operated by Integrity Tech, which the release says has contracts with the PRC government. That seizure claim is not in AA26-281A. Domain counts differ between secondary reports. This post does not use a count. The control is who can still read the mailbox, and who else was handed a URL to it. A password spray that lands on a shared Microsoft 365 admin is not a nation-state problem only.

A 20-person company often has one login that can message every customer. The tool sits with a vendor. The seat does not. The check is who can still send from that tool, and who would notice a message the company did not write. If that answer is the vendor's inbox, it is not access control. Breachrr is an access-control system for teams of that size. Free audit: breachrr.com/audit

ASOS plc filed an RNS dated 6 October. It says that at around 10amthat day an unauthorised customer notification was sent to ASOS customers. It is investigating unauthorised activity involving third-party platforms it uses to communicate with customers. It says it restricted access to the notification platforms and is working with internal and external advisers and relevant authorities. Basic personal information, including name and contact details, may have been accessed. It does not believe payment-card information or account passwords were impacted. The website and app were operating as normal, with no current disruption. It says it has cyber security insurance, including business continuity cover, and that it is too early to quantify any impact on trading. The notification customers received, reported by Reuters and the BBC, was addressed to the ASOS data protection officer and IT department and claimed a full compromise of a Snowflake instance. Snowflake told the BBC its investigation had found no compromise of the Snowflake platform. The ASOS RNS does not name Snowflake, and it does not confirm that claim. The control in the company's own notice is the login that can send a customer notification. A message that lands in the app is not the same evidence as a confirmed warehouse compromise.

The Document Foundation announced CVE-2026-63277 on 5 October, fixed in LibreOffice 26.2.5 and 26.8.0. Calc can save a link from a cell range to an external data source. A document could name a Java database driver for that link and load it from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL. Credits name Rick de Jager of the V12 security team, and Thomas Rinsma and Edoardo Geraci of Codean Labs, reporting independently. Apache OpenOffice tracks the matching issue as CVE-2026-59265. Its advisory says a crafted untrusted document can trigger arbitrary, including remote, code when opened, through the Java integration. Affected: through 4.1.16. A fix is expected in 4.1.17, which is in the release-candidate phase. Until then the published mitigation is Tools, Options, OpenOffice, Java, and untick Use a Java runtime environment. On macOS the path is OpenOffice, Preferences, OpenOffice, Java. The advisory says that prevents the attack. If Java cannot be turned off, avoid opening untrusted files. The Document Foundation does not describe a macro warning on this path. The precondition both projects state is Java integration. A spreadsheet someone opens from a vendor is the exposure. No in-the-wild exploitation is stated in either advisory.

Patchstack published an analysis on 6 October of one JavaScript payload delivered through two stored XSS bugs in unrelated WordPress plugins. It first saw the payload on 4 October against CVE-2026-93836 in WPC Product Bundles for WooCommerce through 8.6.6. On 5 October it saw the same payload through CVE-2026-94504 in Ninja Forms through 3.15.3. Patchstack's table lists both as unauthenticated stored XSS, CVSS 7.1. It says two entry points are what it has confirmed, not a final count. The script is meant to run in the browser of a logged-in administrator. Patchstack says it then uses that admin session to install a plugin, create an administrator, and call a second script. The package it retrieved installs as slug wp-smart-thumbnails, poses as WP Smart Thumbnails 1.2.4 by MediaPress Labs, and carries an unauthenticated file manager. A second script creates an administrator hidden from the Users screen, and a backdoor login URL that authenticates as the site's original owner. Files are timestamped July 2026. Ninja Forms 3.15.4 strengthened output escaping on the affected admin screen. WPC Product Bundles is fixed in 8.6.7. Updating stops a new insert. It does not remove an admin that is already there. The control that failed is who can open a form submission, and whether the Users screen is the only list of administrators. A form on a small company's site is enough for the insert. The view is the trigger.

A 20-person company often leaves a vendor login in place after the project ends. The invoice is paid. The seat is not. The check is whether that account can still sign in, and who would notice if it did. If that answer is not written down, it is not access control. Breachrr is an access-control system for teams of that size. Free audit: breachrr.com/audit

CVE-2026-61500 covers Rejetto HFS 3.0.0 through 3.2.0. The CVE record, CNA VulnCheck, updated 1 October, says the server derives its session-cookie signing key from Math.random() and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker who collects a small number of login responses can reconstruct the generator state, recover the signing key, and forge an administrator session cookie. The record says that leads to administrative access and remote code execution through the server_code configuration feature. Affected range on the record: 3.0.0 before 3.2.1. CVSS 3.1 is 9.8. CVSS 4.0 is 9.3. Rejetto's 3.2.1 release notes, 13 July 2026, say multiple security vulnerabilities in all previous versions could allow administrative access, and credit Zach Hanley of Horizon3.ai. BleepingComputer, 5 October, reports VulnCheck canaries saw small-scale probes from a single China Telecom address against deployments in Japan and the United States, and that VulnCheck has not shared successful exploitation or post-exploitation. Horizon3 published a write-up and proof of concept on 30 September. BleepingComputer's upgrade line is 3.2.1, or the then-current stable release 3.3.4. The control that exists is the version string. A file share someone stood up to move a folder, and left on the network, is the exposure. Probes against canaries are not the same claim as a confirmed compromise.

Microsoft published CVE-2026-96940 on 2 October, inside the September 2026 V2 Exchange Server security updates. The MSRC executive summary is weak authorization in Exchange Server that allows an authenticated attacker to elevate privileges over a network. Severity is Important. CVSS 3.1 base score is 8.8, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE listed is CWE-1390. Publicly disclosed: No. Exploited: No. Exploitability assessment: Exploitation More Likely. The Exchange team says it identified the issue internally and is not aware of active exploitation. The V2 release went out ahead of its intended schedule. Exchange Online already has a related service-side fix. Online customers do not need to act for that fix. On-premises builds named for the update are Exchange SE RTM, Exchange 2019 CU14 and CU15, and Exchange 2016 CU23. 2016 and 2019 updates released between May and October 2026 are available only to customers enrolled in the Period 2 ESU program. Hybrid still needs the SU on Exchange servers, including servers used only for management. The Hacker News attributes an additional effect to Microsoft: unauthorized read of other users' mailboxes and attachments in the same organization, not cross-tenant. That sentence is not in the MSRC executive summary retrieved today. The precondition Microsoft does state is an authenticated attacker on the network. A mailbox that any licensed user can open is an authorization bug, not a phishing story.

Denmark's Ministry of Research, Education and Digitalisation published a notice dated 5 October. CPR administration says unauthorized people used a Danish company's lawful access to search the Central Person Register, and reached names, addresses, CPR numbers, and other fields on about 8.8 million registered people. That figure includes living residents, people who have emigrated, and people who have died. The register holds about 11 million records. The review so far says the access did not include names and addresses of people registered with name-and-address protection. CPR administration stopped the company's access, reported the case to the Danish Data Protection Agency, and says police are investigating with other authorities. It became aware on the evening of Friday 2 October of irregular behavior in the system during September. The investigation is still early. The ministry says it cannot yet say who is behind it, and that further mapping may change the details. The path in the notice is not a claimed exploit against the register. It is a private company's standing search right, used outside that company's purpose, inside the field set private companies are allowed to receive. A login that is still valid is the control that failed.

Apache OpenOffice published an advisory for CVE-2026-59265. A crafted untrusted document can trigger arbitrary, including remote, code execution through the Java integration when a user opens it. Affected: Apache OpenOffice through 4.1.16. Apache rates it critical. The fix is expected in 4.1.17, which Apache says is in release-candidate phase, not shipped. CWE on the CVE record is CWE-426, untrusted search path. Until 4.1.17 is released, the published mitigation is Tools – Options – OpenOffice – Java, and untick "Use a Java runtime environment." On macOS the path is OpenOffice – Preferences – OpenOffice – Java. Apache says that prevents the attack. The extra control is do not open untrusted files. Apache says OpenOffice.org versions may also be affected, and that LibreOffice reported the related issue as CVE-2026-63277. This note does not state a LibreOffice fixed build. The precondition is a person opening a document, with Java integration left on. A shared workstation that still has OpenOffice 4.1.16 and Java enabled is the exposure. Disabling Java is the control that exists today. Waiting on a version string that has not shipped is not.

A 20-person company usually has one shared admin login that outlives the person who set it up. The mailbox gets disabled. The admin seat does not. The list that matters is short: who can still sign in, who shares a password, and which vendor portal was never reassigned. If that list is not written down, it is not access control. Breachrr is an access-control system for teams of that size. Free audit: breachrr.com/audit

DTU published a personal-data notice dated 2 October. Unauthorised people compromised DTU profiles and used them to reach DTUBasen, the university's identity and access management system, then downloaded a large amount of data. DTU says it cannot determine precisely what was downloaded or how many people are affected. The system holds records for about 40,000 active users and about 160,000 former users, back to 2003. The notice covers current and former employees, students, guests, and external partners. For active users, the fields DTU lists include CPR number, full name, home address, profile picture, work email, job title, office location, and next-of-kin name, relationship, and telephone number if registered. For former users, home address, profile picture, and next-of-kin data are deleted after six months. CPR numbers and full names are retained. DTU has reported the incident to the Danish Data Protection Agency. Most employees and students who have a CPR number on file will be notified via e-Boks. DTU says it holds CPR numbers for only a small number of guests and external partners, which is why the public notice exists. The path DTU describes is a compromised profile used against the identity system, not a claim about which application was the first foothold. A directory that still has standing records from 2003 is an access-control store, not an archive.

CISA added CVE-2026-88779 to the KEV catalog on 4 October. Catalog version 2026.10.04, released 4 October 18:52 UTC. Federal due date is 7 October. Forensic triage is marked Yes. Known ransomware campaign use is Unknown. The catalog short description is a memory-buffer issue that could allow denial of service on NetScaler ADC and NetScaler Gateway. That is not the September RCE wording used for CVE-2026-88771 and CVE-2026-88772. The controlling vendor statement is still CTX697174. Citrix's observed impact is targeted attacks that can interrupt service, and Citrix says its analysis has not identified an impact on the integrity of customer data. Scope is unchanged: customer-managed ADC or Gateway configured as a SAML SP or SAML IdP. The config check is `add authentication samlAction` or `add authentication samlIdPProfile`. Fixed builds named in the bulletin: 14.1-73.41 and later, 13.1-64.28 and later, 14.1-73.41 FIPS, and 13.1-37.282 for 13.1-FIPS and NDcPP. 14.1-73.37 remains the fixed 14.1 build for the September pair. It sits inside the affected range for CVE-2026-88779. A box that met the 30 September federal date is not done if it is still on that build and the SAML precondition is present.

Microsoft released CVE-2026-96940 on 2 October. It is weak authorization in Exchange Server, CWE-1390, CVSS 3.1 8.8, severity Important. An authenticated attacker on the network can elevate privileges and, per the MSRC FAQ, gain unauthorized access to other users' mailboxes in the same organization and read messages and attachments. Microsoft marks it not publicly disclosed and not exploited. The exploitability assessment is Exploitation More Likely. Exchange Online customers do not patch for this. Microsoft says a related service-side fix is already deployed. The CVE record's on-prem ranges stop before builds 15.01.2507.075, 15.02.1544.048, 15.02.1748.053, and 15.02.2562.053. This note does not map those builds to a cumulative update name. The precondition is an authenticated user, not an anonymous internet request. A shared mailbox password is a worse version of the same outcome, and this bug does not require that password to be stolen first.