Top 10 Cybersecurity News (October 12, 2026): ccTLD Registry Hijacks Yield Fake Certificates for Google, FBI Seizes Chinese Hacking Tools Targeting Infrastructure, and More

WEEKLY TOP TEN: October 12, 2026, 16:00 GMT

1. Atlassian Data Center Flaw Exploited Hours After PoC
   
   Threat actors are exploiting CVE-2026-21589, a critical 9.3-rated flaw Atlassian disclosed on October 5 in self-hosted Data Center editions of Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. The bug lets unauthenticated attackers read specific files from the web root when they know the exact path. Researchers who released proof-of-concept code on October 6 showed that Jira deployments integrated with Crowd expose plaintext Crowd application credentials, which they used to create a new Jira administrator. Honeypots logged 190 exploitation attempts from 32 IP addresses within two days. Organizations should patch now or cut instances off from the internet and apply Atlassian’s firewall rules.
2. Max-Severity SonicWall SMA1000 Flaw Now Exploited
   
   Attackers began targeting CVE-2026-102255, a maximum-severity server-side request forgery flaw in SonicWall SMA1000 secure access gateways, just three days after SonicWall released hotfixes on October 6. The bug sits in the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models and lets unauthenticated attackers force the appliance to send requests that reach internal functions. Honeypot sensors recorded crafted requests aimed at the appliance’s internal CouchDB service using default admin credentials. More than 400 SMA1000 devices remain exposed online. Because MSPs, large enterprises and government agencies rely on these gateways for VPN access, and earlier SMA1000 zero-days fed ransomware operations, patching should be immediate.
3. AhsayCBS Backup Server Flaws Exploited Before Patch
   
   Attackers are chaining two AhsayCBS vulnerabilities, CVE-2026-105133 and CVE-2026-105134, to gain unauthenticated remote code execution as SYSTEM on the Ahsay Cloud Backup Server management console, a platform used heavily by managed service providers and system integrators. Exploitation began October 7, and at least five organizations were targeted within a day. Post-exploitation activity includes JSP webshells, an XMRig cryptominer disguised as Microsoft Edge, a fake Edge update service for persistence, and the vulnerable WinRing0 kernel driver. Versions through 10.3.4 are affected and no fix is yet available. Ahsay customers should restrict management interface access to trusted IPs or VPN and re-image any compromised hosts.
4. FBI Seizes Chinese Hacking Tools Targeting Infrastructure
   
   The Justice Department and FBI seized domains supporting Microscan and FishHub, two tools operated by Beijing-based Integrity Technology Group, a government contractor linked to the Flax Typhoon espionage group. Microscan, active since 2017, ran more than 1,300 exploit scripts powered by a Mirai-based IoT botnet that once tracked over 1.2 million infected devices. Targets included a South Carolina power company, airports in Japan and Poland, and Taiwanese natural gas and power firms, while FishHub spear-phishing hit about 20 Taiwanese universities. Cybersecurity agencies from seven countries issued a joint advisory naming Integrity Tech as a for-profit enabler of state-backed intrusions against critical infrastructure worldwide.
5. Southern Company Breach Hits 400,000 Utility Accounts
   
   Southern Company is notifying about 400,000 customers of Georgia Power and Alabama Power that an unauthorized party accessed account information through its online customer portal. Roughly 300,000 affected accounts belong to Georgia Power customers and about 100,000 to Alabama Power, while Mississippi Power is also named without a figure. Exposed data includes names, mailing addresses, phone numbers, email addresses, the last four digits of Social Security numbers and other account details. The utility says bank account, payment card and driver’s license numbers were not accessed. Southern Company has not disclosed when or how the portal was breached and is offering one year of free credit monitoring.
6. AI-Assisted Attacker Breached Five South Korean Banks
   
   CrowdStrike linked a wave of attacks on South Korean lenders, including Shinhan Bank, KB Kookmin Bank, Hana Bank, Yegaram Savings Bank and BNK Busan Bank, to a suspected Chinese-speaking, financially motivated attacker who used the ARTEX agentic penetration testing tool alongside Claude Code. Researchers found exposed AI session logs, configuration files and memory files on attacker servers, including a resume-writing prompt that may identify the operator. The attackers reportedly breached a loan progress inquiry service and a mobile work-support system. Shinhan reported about 25,000 affected customers. Police are investigating, and lawmakers will summon the heads of five major banks to an October 19 parliamentary audit.
7. ccTLD Registry Hijacks Yield Fake Certificates for Google
   
   Attackers compromised third-party operators of the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) country-code top-level domains and altered authoritative DNS records, allowing them to obtain valid TLS certificates for domains they did not own, including several Google domains. The hijacks let the attackers impersonate trusted brands without triggering browser certificate warnings. Google said its own systems were not compromised, blocked the rogue certificates in Chrome through CRLSets, and worked with issuing authorities to revoke them. Certificate Transparency logs revealed other major brands were also affected. Google urged domain owners to monitor CT logs across their full portfolios and publish restrictive CAA records.
8. Cisco Patches Over a Dozen Critical Product Flaws
   
   Cisco released fixes for 35 vulnerabilities, including more than a dozen critical-severity bugs across Meraki, License On-Prem, NX-OS and Application Policy Infrastructure Controller (APIC). NX-OS received 14 fixes, among them CVE-2026-76471 and CVE-2026-76465, which let remote unauthenticated attackers execute code as root or crash Nexus switches. Three other NX-OS flaws affect Nexus 3000 and 9000 series switches with Next Generation OAM enabled. License On-Prem fixes cover unauthenticated access and denial-of-service bugs, while the APIC flaws involve access control, OS injection and memory issues. Cisco reports no in-the-wild exploitation, but data center switching and licensing infrastructure should be prioritized for patching.
9. Shai-Hulud Worm Compromises Tensorlake AI SDK on npm
   
   Version 0.5.144 of the tensorlake npm SDK, used to manage sandboxes for AI agents and downloaded about 12,000 times a week, was compromised in the ChainDrop/Shai-Hulud supply chain campaign on October 8. A preinstall hook launches an obfuscated payload that harvests npm, GitHub, AWS, HashiCorp Vault and Kubernetes credentials, SSH keys and AI coding tool configurations, then spreads by republishing packages tied to the victim’s npm identity. The malware resolves its command server through an Ethereum contract and plants a dead-man switch that can wipe the user’s home directory if the stolen GitHub token is revoked. Tensorlake users must remove the token monitor before rotating credentials..
10. PoeLLM Malware Hijacks 3,000+ Exposed AI Servers
    
    Lumen’s Black Lotus Labs uncovered PoeLLM, malware that has compromised more than 3,000 servers, mostly in the US and Western Europe, since April by exploiting internet-facing LiteLLM and Ollama deployments, along with Gotenberg, Gitea and possibly Ivanti Sentry. The suspected Italian operator hides command-and-control addresses inside an AI-written poem posted to GitHub, and infected systems parse specific words to derive the current server IP. Compromised GPU hosts mine cryptocurrency with XMRig and are conscripted to scan for and exploit new victims, peaking at more than 800 active infections per day. The campaign shows how hastily deployed AI infrastructure is widening enterprise attack surfaces.