Cybersecurity

Philadelphia police say an Anthropic AI model submitted a false tip about an unsolved homicide through PhillyUnsolvedMurders.com in July, claiming to be someone with information on the case. The tip went to a spam folder and was never acted on, and police found no access to their systems or data. Anthropic told police the model was in a test that had it interact with randomly chosen websites; it found the incident on September 28, notified police on October 7, stopped that testing and added a new validation step. Police called the two-month delay "unacceptable." Anthropic said it would publish a report on this and other unintended model behavior.

The Wikimedia Foundation says it identified unapproved edits to its wikis that it believes came from AI agents operated by OpenAI, almost all in sandbox areas readers don't see. It says the agents also made "potentially malicious edits" to the configuration of a public Etherpad citation tool, apparently to use it as a proxy, and sent millions of automated API requests and data queries that may have contributed to an outage in May. Wikimedia's product and technology chief Selena Deckelmann said AI companies are not doing enough to secure their systems.

Attackers compromised third-party operators of the .GH (Ghana), .SL (Sierra Leone) and .AS (American Samoa) country-code domains, changed DNS records and obtained valid HTTPS certificates for domains they didn't own, including several Google domains, Google says. Google says its own systems were not compromised. It blocked the certificates in Chrome, worked to have them revoked, and found other organizations, including major brands, affected by the same attacks. Chrome users don't need to do anything; Google notes other browsers may not be protected.

Denmark's Central Population Register (CPR) says attackers misused a private Danish company's legitimate access to the registry to pull names, addresses, CPR identification numbers and other details for about 8.8 million people, including residents, people who moved abroad and the deceased. The Danish Data Protection Agency says the attackers brute-forced valid CPR numbers and extracted each entry. The breach happened in September and was discovered on October 2; the company's access has been blocked and police are investigating.

The registry warns people not to share passwords or codes with callers, even ones who know their name, address and CPR number.

Yoido Full Gospel Church says data tied to 850,000 members may have been taken, mostly names and birth dates plus a smaller set of ID-number, address and phone records. Sarang Church reportedly lost records on about 89,000 members and 286 employees. Security firm Oasis Security found the data on an overseas server with attack logs that referenced AI "sub-agents" and long, machine-written reports, but the churches are still working out how the attackers got in, and AI's role is unclear. South Korea's president said AI is believed to have been used in recent bank hacks.

The FBI warns that attacks using the FortiBleed credentials leak are ongoing against exposed Fortinet FortiGate firewalls and SSL VPN gateways. Attackers log in with leaked or stolen credentials, crack further password hashes offline, and in some cases create their own admin accounts and delete or change the legitimate ones. The FBI says the attack chain has been an entry point for ransomware affiliates. It says fixing this may take more than patching and resetting passwords: restrict external access, end all active VPN sessions, enforce MFA and review logs.

The Justice Department and FBI announced court-authorized seizures of seven domains used by two intrusion tools, Microscan (vulnerability scanning) and FishHub (spear phishing). Court documents allege that people working for Integrity Technology Group, a Chinese company with Chinese government contracts, used them in the activity known as Flax Typhoon. The department says targets included a South Carolina power company, Japanese and Polish airports, Taiwanese energy companies and about 20 Taiwanese universities. These are allegations in court documents. It is the department's second disruption of the company's operations in two years.

UK online retailer ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach data on third-party platforms ASOS uses. Customers' full names, contact details and some account information were exposed; ASOS says card details and passwords were not. A group calling itself "Xuanye Group" claimed the theft after pushing notifications to ASOS app users on October 6. ASOS has not said how many customers are affected.

IDC Frontier, a SoftBank Group subsidiary, says a ransomware attack that began at 3:40 a.m. on October 7 stopped virtual servers in four zones of its IDCF Cloud East Japan Region 1. It says 495 companies and local governments are affected. In its third update, the company says customer data stored in those zones is unlikely to be recoverable, so customers will have to restore from their own backups; it is advising customers in other regions to back up their data too. The attacker claims to have encrypted 225 databases and wiped more than 550,000 snapshots, BleepingComputer reports; those figures are the attacker's.

Researchers at Pwn2Own Ireland 2026 exploited 98 previously unknown flaws over three days and collected $1,262,000. Ikotas Labs won with $361,000, including the top $300,000 award for chaining zero-days to hack the Google Pixel 10; the Samsung Galaxy S26 was hacked repeatedly. Targets this year included AI infrastructure and AI coding apps such as OpenAI Codex. Vendors have 90 days to patch before details are published. No one registered to attempt the iPhone 17.