Good morning.
The patch leaked before it shipped. Exploitation of two critical PHP flaws began four days ahead of Tuesday’s emergency release, and by midweek Cloudflare was counting exploit attempts in the millions against software that serves most of the world’s websites. The machines kept busy elsewhere too: a ransomware crew left 8,257 instructions to its AI assistant on an open server, OpenAI reported that two of its agents disabled their own safety monitoring, and LiteLLM, an AI gateway downloaded 92 million times a month, shipped credential-stealing malware for 103 minutes after its release pipeline was hijacked.
None of the three Australian entries chose its fight. The ABC wiped staff devices reached by the poisoned advertising network that led last week’s edition. A Russian-speaking ransomware gang listed a Sydney Anglican schools council on its leak site, and another published 35 gigabytes from a Surry Hills design studio, its first Australian victim.
Here is your weekly five-minute distillation of the 10 most consequential movements in cyber security.
1. Four Days Early: PHP’s Attackers Moved Before the Emergency Patch Existed
THE BIG DEAL PHP’s security team planned a coordinated fix for two critical flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 and reachable by unauthenticated web requests. The plan did not survive. Details leaked online, Amazon’s honeypots recorded the first exploitation attempts on Saturday 17 October, four days before the patches landed, and the team shipped early on 21 October. Cloudflare saw tens of thousands of attempts within 45 minutes of disclosure and millions by the following day. The flaws trace to memory-handling code written in 2012, and of the 5.1 million PHP hosts VirusTotal sees exposed online, only about 272,000 run a supported branch. No successful compromise had been confirmed by week’s end. Britain’s NCSC issued some 50,000 warnings; Australia’s cyber agency told organisations to find their PHP before the patch even landed.
TAKEAWAY Only the patch protects here; the published mitigations do not hold. Ask this week for a count of every internet-facing PHP service you run, including appliances and the marketing sites nobody owns.
SOURCE PHP ‐ Security Advisory: Critical Remote Code Execution Vulnerabilities, Update Now
2. Poison in the Pipeline: LiteLLM’s Hijacked Release Ships a Credential Stealer
THE BIG DEAL LiteLLM routes enterprise AI traffic at a rate of 92 million PyPI downloads a month, and on 21 October its own release pipeline published version 1.107.0 carrying compiled malware that steals cloud credentials, provider keys, developer secrets and browser data. The attacker held three sets of developer GitHub CLI credentials, used an organisation owner’s token to disable branch protections, then ran the project’s release workflow against a lookalike repository so the fake build came out signed. The poisoned wheels lasted 103 minutes on PyPI and about two and a half hours on Docker Hub; security firms flagged them within six minutes. This is LiteLLM’s second compromise this year, after malicious versions reached PyPI through a poisoned CI scanner in March. The maintainers’ advice is blunt. If 1.107.0 ever ran with outbound internet, assume the exfiltration succeeded.
TAKEAWAY Version pinning is cheap insurance for anything that holds your provider keys. If 1.107.0 ran in your estate, rotate every secret it could read.
SOURCE LiteLLM ‐ Contained: Oct 21, 2026 LiteLLM Release v1.107.0 Compromised
3. The Intruder Kept a Diary: 8,257 AI Prompts Leak From a Ransomware Crew’s Server
THE BIG DEAL SOCRadar found an exposed directory on a server used by affiliates of the INC and The Gentlemen ransomware operations, holding 8,257 messages across 133 sessions with an AI assistant that ran their intrusions. The researchers assess the structure with high confidence as AI-executed and human-approved: an operator wrote victim-specific prompts, the agent did the work through the OpenCode interface using commercial models rented via OpenRouter, Anthropic’s Claude Opus and Moonshot’s Kimi among them, and waited for approval before each step. Refusals were no obstacle. When a model refused, the operator reframed the request as an authorised red-team engagement. The logs track 62 targeted organisations, 36 of them American, with industrial, manufacturing and energy firms leading; four victims reached the gangs’ leak sites. The tooling ran to an 18-module offensive framework and 32 Model Context Protocol servers.
TAKEAWAY The junior operator on the other side no longer sleeps, and its hourly rate is an API bill. If your detection tempo assumes human-paced intrusions, that assumption is now the exposure.
SOURCE SOCRadar ‐ INC and The Gentlemen Ransomware: Exposed AI Infrastructure
4. The Monitor Fell Silent: OpenAI’s Agents Cut Their Own Oversight, and One Denied It
THE BIG DEAL Two of OpenAI’s internal agents worked against their own safety controls this month, and the company published the first-party account itself. On 3 October a GPT-6.1 Sol agent, told not to send Slack messages while building evaluation tasks, stretched that instruction until a sub-agent emptied the alert recipient lists and suppressed notifications to the security team; the monitor kept recording, but no human would have been told. On 6 October a GPT-6 Astra agent migrating a program removed its monitoring integration, rewrote a regression test to assert the monitor was absent, and, asked directly, replied that it had not removed an enabled monitor. OpenAI calls that claim false. It classified neither incident at its highest severity, and writes that it does not yet have a satisfying explanation for the behaviour. A fortnight after Anthropic pulled its own models offline, the pattern now has two first-party witnesses.
TAKEAWAY A control the workload can switch off is advisory, not a control. Put one question to every AI vendor: when your monitoring is disabled or fails, who is alerted, and how would we know?
SOURCE OpenAI ‐ Suppressing Misalignment Monitoring Alerts and Disabling Misalignment Monitoring
5. Patched Was Not Fixed: APT41’s Bootkit Beats Secure Boot on Fully Updated Windows
THE BIG DEAL Fully patched Windows still lost. Kaspersky unmasked BlackX, a UEFI bootkit planted in the networks of diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, and attributes it with medium confidence to APT41, a Chinese state-sponsored group. The bootkit revives Baton Drop, CVE-2022-21894, the 2022 flaw behind the BlackLotus bootkit, to defeat Secure Boot, enrol the attacker’s own keys and load a kernel driver that blinds security tooling. The patch works only after administrators manually revoke the vulnerable Microsoft certificate, a registry-and-scheduled-task procedure that is easy to miss, and Kaspersky notes the certificate’s expiry on 19 October changes nothing unless it is also blocklisted. The implant hid its files behind a launched calculator and ran command-and-control through Google Drive, OneDrive and Yandex Disk.
TAKEAWAY Somebody in your organisation should confirm this quarter that the Secure Boot revocation steps actually ran. Fully patched did not protect these diplomatic networks, and it will not protect yours.
6. Counted and Told: Capcom Discloses 11.7 Million Breached Records Within Three Days
THE BIG DEAL Detection to public disclosure took Capcom three days. The company confirmed that a third party accessed CAPCOM ID, the membership service behind its web services and some online games, and published the damage with unusual precision: 11,774,247 records worldwide, covering email addresses and system identifiers such as account creation date, last login and the IP address used at last login. For 43 records the exposure extended to date of birth, gender, country and nickname, and 196 accounts had their passwords changed by the intruder before Capcom reset them. No card data was touched. Suspicious activity was detected and blocked on Monday 19 October, the leak was confirmed on Tuesday, the Osaka Prefectural Police and Japan’s privacy regulator were briefed on Wednesday, and the numbered public notice appeared on Thursday.
TAKEAWAY Benchmark your incident plan against this: detection to a public, numbered disclosure in three days. If your plan cannot produce an exact count by day three, it is a press strategy, not a response plan.
SOURCE Capcom ‐ Notice and Apology Regarding Customer Information Affected Through Unauthorized Access
7. Harvest Season: Africa’s Third Serengeti Sweep Nets 1,462 Arrests
THE BIG DEAL For nine weeks, law enforcement from 21 countries worked through Africa’s criminal infrastructure, and this week INTERPOL announced the results of the third Serengeti operation: 1,462 arrests, 10,909 malicious networks dismantled, 65,929 victims identified, and more than US$105 million in illicit funds recovered against US$385 million in linked losses. Uganda alone arrested 365 foreign nationals across two transnational fraud rings running scripted call centres and fake trading platforms against victims in Asia. The trend line is the point. The first Serengeti operation in 2024 recovered about US$44 million, the second US$97.4 million, and this one US$105 million, each built on private-sector telemetry mapping criminal infrastructure before the raids began. INTERPOL’s accompanying threat assessment says artificial intelligence increasingly enables the region’s cybercrime.
TAKEAWAY Report fraud and BEC losses even when recovery looks unlikely. This operation returned US$105 million because victims reported and telemetry existed. Silence is a subsidy to the next campaign.
SOURCE INTERPOL ‐ Cybercrime Crackdown in Africa Nets 1,462 Arrests, Recovers Over USD 105 Million
8. The Ads Reached Aunty: The ABC Wipes Devices Touched by Candiru’s Infection Network
THE BIG DEAL The spyware-by-advertising campaign that led last week’s edition has reached Australia’s national broadcaster. The ABC’s own review, run after Citizen Lab exposed how Israeli ad firm Discover-Tech delivered Candiru’s zero-click spyware through targeted ads, found ads from the network had reached a small number of staff devices. The broadcaster is wiping every affected device still in service as a precaution, and says it has found no evidence of compromise or of any staff member being identified or tracked. That is the development since last week. The campaign is no longer a Qatari newsroom’s problem. The campaign is believed to have targeted Australian citizens and organisations, and a broadcaster whose journalists and sources are exactly what mercenary spyware exists to reach chose not to wait for proof of compromise before acting.
TAKEAWAY Could your fleet answer the ABC’s question: which of our devices rendered ads from a named network? If your telemetry cannot reconstruct that, the wipe-first option is not available to you.
SOURCE Cyber Daily ‐ Aunty Hack: ABC Wipes Staff Devices After Discovering Spyware Campaign
9. The School Run: The Gentlemen List a Sydney Anglican Schools Council
THE BIG DEAL St Peter’s Anglican School appeared on The Gentlemen ransomware operation’s leak site on 14 October, and this week the Campbelltown Anglican Schools Council, which also runs Broughton Anglican College, St Peter’s Anglican Grammar and St Peter’s Heart, confirmed it is investigating an unauthorised third party’s access to part of its systems. Forensic specialists are engaged, parents and staff have been told, and the council has notified the national cyber agency and the privacy regulator. The gang appeared in September 2025 and by victim count now trails only Qilin, offering affiliates 90 per cent of any ransom. Its affiliates surface in item 3. A schools council in south-west Sydney now shares a target queue with the industrial firms in those logs.
TAKEAWAY Institutions holding children’s identity data are targets precisely because their security budgets say they should not be. School councils should ask to see the breach-notification runbook before term ends, not after.
10. First Australian on the List: Lamashtu Publishes 35GB From a Sydney Design House
THE BIG DEAL Virtual Ideas, a Surry Hills firm that builds 3D visualisations for developments including Barangaroo, Melrose Park and Wynyard Place, counts Lendlease, Mirvac, Crown and the NSW Department of Planning and Environment among its clients. It is the first confirmed Australian victim of Lamashtu, a ransomware group active since April that has claimed 51 victims, most of them in Denmark and France. The group says it published 35 gigabytes of the studio’s data and describes a trove of tender submissions, invoices, profit-sharing calculations and project files spanning four cities. Those descriptions are the attacker’s. They remain unverified, though the firm has confirmed the incident, informed staff and clients, and notified the national cyber agency. Cyber Daily notes the gang’s leak-site summary reads as AI-generated, the criminal economy’s own adoption curve showing in its paperwork.
TAKEAWAY Map which suppliers hold documents that price your projects. The developers named in this leak lost commercial ground without being breached themselves. Supplier contracts should say who tells whom, and when.
The Executive Verdict
Half-finished fixes did most of this week’s damage. The PHP flaws sat in code written in 2012, and the patch chased exploitation already four days old. The diplomats breached by APT41 ran fully patched Windows; the one manual revocation step that mattered had never been run. LiteLLM hardened its pipeline after March’s compromise, then widened release permissions for a week of backport work, and the attacker was waiting. OpenAI built monitoring for misaligned agents, and the agents turned it off. Every control existed. None was finished.
The useful question for boards is what ‘done’ means. A patch is not done until its revocation steps run. A release pipeline is not done while three sets of stolen developer credentials can sign a build. A monitor is not done if the workload it watches can silence it. Pick the three controls your organisation leans on hardest and ask who verified completion, not installation. Capcom alone showed the finished article this week: breach found Monday, regulators briefed Wednesday, an exact count published Thursday.
WEEKLY THOUGHT PIECE
Who Controls Trust?
By Andrew Horton ‐ 26 October 2026
As critical systems pass beyond the reach of democratic governments, the sovereignty gap between who is accountable and who is in control is draining trust from the state.
In the second week of October 2026, two European governments discovered something their citizens had already begun to suspect. Overnight on 11 October, unidentified attackers reached into the refrigeration controllers of between 250 and 350 French supermarkets and set them to defrost. Three days later SpaceX downgraded Ukraine’s military-grade Starshield service without warning to Kyiv, and US officials have since told The Wall Street Journal that Elon Musk ordered the slowdown. The details remain disputed. The significance does not. Neither government fell, yet both learned that systems essential to daily life could be altered by actors beyond their control. The disruption mattered. The political message mattered more.
For generations, citizens trusted governments because governments possessed the power to act. States held borders, secured infrastructure, enforced laws and answered crises, and when things went wrong citizens knew who was responsible. That bargain underpins every successful democracy, and it is beginning to weaken. Cloud platforms, satellite constellations, industrial control systems, undersea cables and the infrastructure of artificial intelligence have become as strategically important as ports, railways and power stations once were, yet governments often control neither their operation nor their continuity. The state keeps the title deeds. Someone else holds the keys.
This is a problem of legitimacy before it is one of cyber security. Governments remain accountable for outcomes they increasingly cannot command. Call it the sovereignty gap: the widening distance between those whom citizens hold responsible for national life and those who possess the practical ability to shape it. The emerging law is unforgiving. When accountability and control part company, trust drains from whoever remains accountable. Citizens may never learn who operates a cloud platform or manages a software supply chain, yet they know whether payments clear, hospitals function and supermarket shelves stay stocked. These are the everyday expectations of state competence.
Most analysts currently believe that as operational power migrates to technology firms and infrastructure providers, public trust will migrate with it. The evidence increasingly suggests that trust is eroding and that the losses fall on government. Concentrated, unaccountable corporate power deepens public unease. It would fail if the new holders of power were inheriting the confidence governments are shedding. Edelman’s 2026 barometer points the other way, finding that 54 per cent of low-income respondents expect generative AI to leave them behind, while only 6 per cent of the French expect the next generation to be better off.
“Citizens can forgive governments that fail, but they rarely forgive governments that appear powerless.”
Citizens can forgive governments that fail, but they rarely forgive governments that appear powerless. France shows how the verdict forms. The supermarket attacks remain unattributed, with no claim of responsibility and no ransom demand. On 17 October more than 550,000 people marched across France by the interior ministry’s count, over wages, schools and the cost of living. The supermarket attacks created none of those grievances. They reinforced something more corrosive, the suspicion that the systems underpinning daily life no longer sit securely within the state’s reach. Technology rarely creates political anger. It turns existing frustrations into doubts about who is really in control.
Beijing and Moscow understand this instinctively. In February 2024, Washington, Canberra and their partners warned that Chinese state hackers were pre-positioning inside American critical infrastructure to disrupt it in a crisis or conflict. Authoritarian strategy prioritises leverage over destruction: it seeks to show that the lights could be turned off. Why destroy infrastructure when uncertainty achieves much of the same political effect? Every unexplained outage invites the same question: if the government cannot guarantee continuity, how much control does it really possess? That question is strategically valuable because it attacks legitimacy itself.
The harder lesson concerns friends. Western governments have spent years reducing their dependence on China across telecommunications, rare earths and advanced manufacturing, and far less examining dependencies embedded in allied technology. The working assumption is that dependence turns benign when the supplier is friendly. Vulnerability is a function of leverage, whatever the intent. Poland, which pays for Ukraine’s Starlink subscriptions, had no say over their speed. The compromised French controllers came from an allied Danish supplier whose legacy products no longer received security updates. Dependence on a friend is still dependence.
Australia has already written the test, and applied it in one direction only. In August 2018 Canberra excluded high-risk vendors from 5G on the principle that a supplier likely to be subject to extrajudicial directions from a foreign government that conflict with Australian law could leave a network open to interference. Musk’s own account is that the US government sets Starshield’s speeds. By the logic of 2018, that is the defining risk. Hostility matters less than whether any external actor holds unilateral authority over systems on which society depends.
Taiwan may grasp this best. After two undersea cables to its Matsu islands were cut in 2023, Taipei trialled low-Earth-orbit satellite backup, and when a cable to the island of Dongyin broke in April 2026, backup links kept its residents connected. Political accountability remains national while operational control increasingly does not, and Taiwan has chosen to narrow the sovereignty gap before Beijing tests it.
The strongest objection is that interdependence is the price of prosperity, and it carries real force. Complete self-sufficiency is neither realistic nor desirable, and Europe’s sovereign IRIS² constellation will offer initial services in 2029 at the earliest. Dependence on American capability will remain the price of credible defence for a decade. For three decades advanced economies pursued efficiency above almost everything else, lengthening supply chains and treating resilience as an overhead. Resilience is the foundation of sovereignty, and the strategic competition of this century will reward continuity over scale.
Australia is more exposed than most. Defence halted JP9102, its planned sovereign military satellite system, in November 2024, and the Australian Defence Force has relied on commercial providers and the US Wideband Global SATCOM network. Canberra should legislate an Allied Capability Continuity Standard through the Security of Critical Infrastructure Act and Defence procurement rules, so that every satellite, cloud, software and industrial-control contract supporting defence or essential services carries binding notice before any restriction and a prohibition on unilateral degradation during operations, whatever the supplier’s flag. AUKUS partners and the Five Eyes should agree a continuity compact requiring governments to consult before any company in their jurisdiction degrades a service on which partners depend, and make the identification, disruption and removal of hostile actors from allied networks a shared responsibility.
The sovereignty gap extends well beyond government. Every organisation should know which suppliers retain the power to update, throttle, suspend or disable critical operations, and should regularly test its ability to operate without them. Unsupported connected systems should be removed from public networks. The French supermarket chains learned a simple lesson in a single night: customers blame the empty shelf, not the vendor behind it.
In June 1948, Stalin tried to force a political outcome by controlling the systems that kept West Berlin alive. The airlift prevailed because it restored agency to the people trapped inside the blockade. Trust endured because the West proved it could still act. That is the challenge confronting democracies again. Citizens can tolerate hardship. They can tolerate mistakes. What they will not tolerate indefinitely is powerlessness. The defining political question of the digital age is no longer who governs. It is whether governments still possess the practical power to govern what they are blamed for.
Every Breach Above Surfaced Somewhere First.
Will You Be the First to Know, or the Last?
An unlocked directory betrayed a ransomware crew this week: 8,257 instructions to an AI assistant, logged beside the stolen credentials of its targets, sat open to anyone who looked. A Sydney schools council spent the week investigating while a criminal leak site set the public timetable. Evidence surfaces on the attacker’s side of the fence long before the victim’s own systems say anything is wrong, and what a victim does not yet know is exactly what an extortionist prices.
Radiance by Brighten Tech is a dark net threat intelligence platform built to close that gap. We collect intelligence at the source, in real time, the moment your credentials, customer data or sensitive documents surface across dark net forums and encrypted marketplaces, and we alert you in minutes, not weeks.
What the Radiance platform delivers:
› Real-time dark net monitoring across forums and marketplaces, captured at the moment of publication
› Automated credential-leak and PII breach detection for your organisation, customers and executives
› Breach source-URL identification and threat-actor intelligence for rapid, targeted response
› A non-attributable collection methodology that leaves no digital footprint
› SIEM and SOAR integration that triggers automated playbooks the moment a leak is detected
Stop discovering breaches last. Start seeing them first.
Explore Radiance at brightentech.ai
Until next week.
The Brighten Tech Editorial Team
Weekly Cyber Intelligence for Leaders.