Cybersecurity

Global – – October 19, 2026 -- The ShinyHunters extortion gang claims it has stolen data from 300 Oracle PeopleSoft instances across more than 100 organizations, BleepingComputer reported on 10 June 2026. The group says it is targeting both cloud and on-premises deployments of the enterprise suite, which large organizations use for HR, payroll, finance, supply chain, procurement and student administration.

Education sector bears most of the attacks

Most affected organizations are in education, and many were previously extorted by the same actor. ShinyHunters confirmed Nottingham University as a victim and has already published its data on the group's leak site. The university has acknowledged a cybersecurity incident in a statement.

Global – – October 19, 2026 -- Salesforce has disabled all Klue integrations after the threat group Icarus claimed on 19 June 2026 to have exfiltrated customer data through the market intelligence platform's Salesforce connection. Matching data points give high confidence that Icarus is behind the supply chain attack, according to the source analysis.

Attackers pushed token-stealing code on 11 June

The compromise began on 11 June, when anomalous behavior occurred in a system connecting Klue's various integrations. Attackers pushed a code update that could collect the OAuth tokens customers use to connect Klue to their own systems. Klue noticed the activity on 12 June, including unusual network connections to IP addresses the actor used to run commands on its backend servers.

On 13 June, Klue staff disabled the remote access, removed the token-theft code and sent customers a general alert. The alert did not say which customers were affected.

Unspecified location – October 19, 2026 -- Wiz Research found a critical vulnerability, CVE-2026-3854, that let any authenticated user execute arbitrary commands on GitHub's backend servers with a single git push command, and 88% of GitHub Enterprise Server instances remained vulnerable at the time of disclosure.

Wiz Research uncovered the flaw on 20 April 2026 in GitHub's internal git infrastructure. It affects both GitHub.com and GitHub Enterprise Server (GHES). The exploit requires only a standard git client.

GitHub.com is fully mitigated; GHES versions up to 3.19.1 stay exposed

GitHub has fully mitigated the issue on GitHub.com, and users there need to take no action. GHES versions up to and including 3.19.1 are vulnerable.

Fixed versions are 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3. GitHub released patches for all supported GHES versions, and administrators are urged to upgrade immediately.

Italy – October 19, 2026 -- A newer wave of the NFCShare Android banking trojan, active since 14 May 2026, ships APKs with malformed ZIP paths that can break automated extraction tools, D3 Labs researchers reported.

Campaign shifts from Deutsche Bank lure to Italian and European brands

NFCShare first spread as a malicious APK through a phishing flow impersonating Deutsche Bank. The newer wave impersonates Italian and European banking brands and originates from a phishing site mimicking Intesa Sanpaolo. The malware shows a fake card-verification screen, asks victims to hold a payment card near the phone, collects the card PIN and sends NFC-derived card data to a WebSocket endpoint.

Core NFC logic unchanged, operations hardened

D3 Labs found the NFC and exfiltration logic largely unchanged. The changes are operational: more frequent APK rebuilds, brand rotation, URL shorteners, a new C2 endpoint and a 10-DEX layout.

Global – October 19, 2026 -- About 62% of security breaches still involve the human element, according to the 2026 Verizon Data Breach Investigations Report. That figure is pushing retail and hospitality security teams to replace annual compliance videos with human risk management (HRM), which aims to change how employees respond to attacks in real time.

Scattered Spider uses AI voice cloning to turn help desk calls into footholds

Threat groups such as Scattered Spider scrape professional networks like LinkedIn to map organization charts and identify help desk staff and executives to impersonate. They then place high-pressure calls with AI-cloned voices, posing as locked-out employees. The goal is to get agents to reset a password and enroll multi-factor authentication (MFA) on a device the attacker controls.

Europe – October 19, 2026 -- A new macOS infostealer dubbed ClickLock Stealer has targeted at least 100 victims across 33 countries since May 2026, with more than 50% of them in Europe, according to Group-IB Threat Intelligence.

Group-IB reported on 9 June 2026 that a malicious shell script uploaded to VirusTotal was assessed as a new modular stealer, likely distributed through ClickFix phishing pages. The operation has been active for approximately two months and relies on compromised WordPress domains and Telegram infrastructure. The malware needs no elevated privileges or exploits to execute.

Manchester – – October 19, 2026 -- Manchester Airports Group (MAG) has disclosed that an unauthorized third party accessed customer data on approximately 8.7 million people across Manchester, London Stansted and East Midlands airports.

Hackers obtained contact details and vehicle registration numbers

The affected data relates to parking, lounge and fast-track bookings and in-airport Wi-Fi sign-ups. The attackers obtained email addresses, phone numbers, vehicle registration numbers and postcodes.

The attack took place during peak summer travel, as millions of families were flying back into the UK before the school year. Airport operations and flights were not disrupted.

MAG says most affected customers lost only their email address

The affected systems did not store bank or payment details. According to MAG, most of the 8.7 million customers lost only their email addresses, and the impact varies by the services each person used.

Bali – October 19, 2026 -- ICANN87, the first ICANN public meeting held in Indonesia, opened with more than 200 working sessions on DNS Abuse mitigation, Domain Name System security and the New gTLD Program.

The six-day meeting is co-hosted by the Indonesian Internet Domain Name Registry (PANDI). Indonesia's Ministry of Communication and Digital Affairs and the Bali Provincial Government are supporting it. Attendees include government representatives, businesses, technical experts and civil society.

ICANN leadership pushes for tighter links between strategy and execution

ICANN President and CEO Kurtis Lindqvist said the organization must connect strategy, prioritization, budgeting and implementation more clearly. He said ICANN org "must turn those solutions into effective action" developed by the community.

Tokyo – October 19, 2026 -- Trend Micro (TSE: 4704) plans to make available up to ¥10 billion in TrendAI Flex licensing credits under a new Japan Cyber Resilience Initiative, as publicly disclosed cyber incidents in Japan hit 607 in the first nine months of 2026, already above the 594 recorded for all of 2025.

The incident tally comes from TrendAI threat research and is current as of October 9, 2026. Trend Micro notes the figure may change as incidents are disclosed retroactively and further cases are added.

Hong Kong – October 19, 2026 -- The University of Hong Kong (HKU) and the Global Cybersecurity Alliance (GCSA) have jointly established the Centre for AI and Cybersecurity Research, with four defined research directions spanning large language model security, automated threat defence, frontier-technology risk and global AI security standards.

Professor Ho Chen, Chair of Cybersecurity at the HKU School of Computing and Data Science, will serve as Acting Director. The Centre will bring together researchers from HKU, GCSA and international partner institutions. It will also engage experts in artificial intelligence, cybersecurity and technology governance for research and advisory roles.