Here are today’s top cybersecurity stories for Monday, October 12, 2026.
Canadian Cybersecurity Executive Arrested in Federal Extortion Case
Edward Dubrovsky, 54, a co-founder of the Canadian firm CYPFER, was arrested in Pennsylvania while attending a cyber risk conference. Court records list conspiracy to commit extortion and Hobbs Act extortion charges in the Eastern District of Texas. The complaint is sealed, and the FBI has not confirmed a link to the ShinyHunters investigation, though multiple sources tie the two. BleepingComputer
GitLab Warns of Maximum-Severity Code Execution Flaw CVE-2026-97229
An integer overflow in GitLab’s CI/CD Regular Expression Compiler lets an unauthenticated user run code on the server through a crafted expression. Versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2 are affected. GitLab.com already runs the fix, and no exploitation is reported. BleepingComputer
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Defused Cyber and Previdian saw first exploitation of CVE-2026-102255 on October 8, two days after SonicWall shipped fixes. The pre-authentication server-side request forgery flaw scores 10.0 in CVSS. Previdian logged 135 attempts from two U.S. IP addresses. The Hacker News
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw
Patchstack first detected exploitation of CVE-2026-85097 on October 7. The flaw lets unauthenticated attackers upload and run PHP code on sites running Bricksforge 3.1.8.9 and earlier. Patchstack counted 63 unique source IP addresses, and the pattern points to automated attacks. The Hacker News
Retail Giant Ahold Delhaize Takes Systems Offline After Cyberattack
Ahold Delhaize confirmed a cybersecurity incident and took some systems offline. Stores remain open, though Stop & Shop staff reported trouble reaching schedules and pay stubs, and Dutch and Belgian customers lost access to apps and websites. The company has not said whether any devices were encrypted. BleepingComputer
Ledger Finds Hardware Implant in Wallet Sold by Reseller CryptoBilis
Ledger confirmed an unauthorized hardware implant in a device sold through CryptoBilis and paused sales through the reseller. A blockchain investigator reports losses above $86 million, a figure Ledger has not confirmed. Ledger tells buyers from the last 90 days to avoid setup or move assets to a new signer with a new seed. The Hacker News
CyberXero Uses Claude Code in Campaign Stealing 628,000 Ukrainian Records
SOCRadar found an exposed server belonging to CyberXero, a Russian-speaking initial access broker active since July. The actor ran 51 specialized agents through Claude Code and the PentAGI tool alongside Cobalt Strike. One automated run scanned 4,708 targets and deployed 32 web shells in 61 seconds. The Hacker News
iRhythm Data Breach Impacts at Least 360,000 People
Attackers took patient data from third-party-hosted business applications between June 3 and June 8. The data includes names, addresses, dates of birth, and insurance numbers. The hackers contacted iRhythm on June 9 and threatened to leak the files. SecurityWeek
Nippon Columbia Malware Incident Exposes Karaoke Fan Records
Malware infected a computer at Nippon Columbia, a contractor for Japanese karaoke maker Daiichi Kosho. The data covers 8,631,000 customers and 93,000 employees, with names, dates of birth, email addresses, and phone numbers. Daiichi Kosho has not confirmed any theft or leak. BleepingComputer
Let’s Encrypt Cuts Default Certificate Validity to 64 Days
Starting February 10, 2027, newly issued Let’s Encrypt certificates default to 64 days. A move to 45-day certificates follows in 2028. Let’s Encrypt advises customers to test in its staging environment and to set renewals at about two-thirds of certificate lifetime. SecurityWeek
Canonical Websites Disrupted in Second DDoS Attack This Year
Canonical confirmed on October 8 a sustained distributed denial of service attack on ubuntu.com, canonical.com, and related sites. Downtime ran a little over four hours, and no group has claimed responsibility. Launchpad and the Snap Store did not appear affected. SecurityWeek
Stay tuned for today’s in-depth analysis posts.
