Director Kash Patel announced the arrest of a suspected ShinyHunters co-conspirator on Oct. 9; sources identify the suspect as Edward Dubrovsky, co-founder of Canadian cybersecurity firm CYPFER. The FBI has not publicly confirmed the link.
Incident Reports
A running file of verified security incidents — confirmed against primary sources before publication.
Breaches
The retailer says an attacker impersonated a trusted contact to steal employee login credentials, then accessed information on third-party platforms. Customer names and contact details were exposed — but not passwords or payment data. This is distinct from an earlier August breach.
Threats
A joint advisory says the global FortiBleed campaign remains active against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways — and that compromised organizations may need remediation well beyond patching and password resets.
Vulnerability Watch
High-severity flaws that defenders need to act on — verified identifiers, affected versions, and remediation status.
Vulnerabilities
Three stack-based buffer overflows in the NGOAM feature let unauthenticated attackers run arbitrary code with root privileges on Nexus 3000 and 9000 Series switches. Cisco says there are no workarounds — patching is the only remediation.
Vulnerabilities
One URL-encoded letter lets ShinyHunters walk around web application firewall rules blocking its favorite attack path — re-targeting servers that blocked the endpoint with WAFs instead of patching. Mandiant confirmed the flaw was exploited as a zero-day in May and June.
Vulnerabilities
CVE-2026-21589 lets unauthenticated attackers read files in an Atlassian application’s web root — including plaintext credentials in Crowd-integrated Jira deployments. Honeypot operators saw exploitation attempts begin within about two hours of a public proof-of-concept.
Threat Research
Campaign analysis, malware and tooling coverage, and threat-actor tracking — built on verifiable technical evidence.
Research
Ikotas Labs took Master of Pwn with $361,000 after a $300,000 Pixel 10 exploit chain on day three. Apple’s iPhone 17 was eligible but saw no attempts — and vendors now have 90 days to ship patches before the Zero Day Initiative discloses.
Threats
A new variant of the DarkSword iOS exploit kit shrinks its on-device footprint while adding on-device keychain and crypto-wallet theft, per iVerify’s Oct 8 report — and the toolkit appears to be circulating on a second-hand commercial market.
Industry
Funding, M&A, executive moves, and the economics of the security market — reported with numbers you can check.
Industry
Florida, Iowa, Montana, and Nebraska filed consumer-protection suits on Oct. 6, joining Texas in alleging the router maker misled buyers about security and its separation from China. TP-Link denies the claims — and a day later, 21 attorneys general wrote to the FCC.
Featured Investigation
HackedWire’s investigations desk will pursue deep, document-backed reporting on the security industry. The first file is in production — nothing is listed here until the reporting is verified and ready to publish.
Company Profiles
Independent profiles of the companies shaping security — what they build, what they claim, and what the record says. No pay-to-play placements, no sponsored rankings.
Conversations
On-the-record conversations with the people who build, break, and defend systems — published in full, in their own words. The first conversations are in production; nothing is listed here until a conversation has actually been recorded.
Intelligence
Reference material for practitioners — maintained, dated, and corrected when the facts change.
CISA, the NIST National Vulnerability Database, FBI IC3, and MITRE ATT&CK — the public resources our newsroom uses most.
What to do in the first 24 hours, per CISA’s #StopRansomware guide.
How security bugs go from report to patch — coordinated disclosure, explained.
Sponsored
Clearly labeled, plainly separated from the newsroom. Sponsors never influence reporting.
Available at launch.
Available at launch.
