Company
The Cyber Express is a cybersecurity news outlet (thecyberexpress.com) covering data breaches, vulnerabilities, patches, and threat intelligence.
Australian Signals Directorate has launched ASD Essentials, a principles-based framework that evolves the Essential Eight for IT, OT and cloud. Compliance obligations stay unchanged for now, The Cyber Express reported.
Reality
Hackers pushed fridge and freezer temperatures to as high as 50 degrees Celsius in hundreds of French supermarkets overnight, The Cyber Express reported. The attack used no new exploit and hit ageing devices still online years after their manufacturer ended support.
Reality
Seoul National University told a lawmaker that 1,130 of the 1,132 records leaked in 28 hacking incidents since 2021 came from a single 2021 attack. Departmental systems were hit most often, so attack frequency and data loss need separate explanations.
Reality
Tabung Haji resumed services after its Oct 8 cyberattack, but three THiJARI functions remain offline. Its assurance that depositor savings are safe comes from its own statement, as relayed by The Cyber Express.
Reality
Splunk fixed 22 Enterprise CVEs on October 7, led by a 9.8 unauthenticated command flaw in the Patroni REST API. Sites without Edge Processor, OpAmp or SPL2 pipelines can switch off the PostgreSQL sidecar now, but a second 9.8 still needs the upgrade.
Reality
Australia's Signals Directorate says attackers are using stolen AI API keys, tokens and hijacked sessions to get into organisations' AI services. Its guidance tells customers to protect those credentials themselves. In one reported case, a stolen key ran up about US$600,000 in model credits over three weeks.
Reality
The 90-day action plan drafted by Pakistan's Cyber Security Working Committee dates guidance for provincial CERTs, a critical infrastructure declaration framework and a cyber warfare escalation matrix. The federal CERT itself gets three years.
Reality
Apple's September 14 releases close 273 unique vulnerabilities across ten advisories, with no exploitation reported. Fleet managers have to pick which lane to patch on, and the 26.7 build leaves out about 56 of the fixes that ship in iOS 27.
Reality
The Australian Signals Directorate has published guidance placing agentic AI's enforcement point in the harness, the software layer that decides which tool calls run and with what permissions. Its remedies are configuration and logging.
Reality
CVE-2026-69836 scored 10.0 and allowed unauthenticated remote code execution against Microsoft's identity service, and because the fix landed server-side, no customer ever had a version to check or a window to schedule.
Reality
The breach notice rules out credit card details and confirms names, mobile numbers, order totals and postcodes. The second list is the one that makes a refund-scam call work.
Reality
Guild Group's Mohammad Arif argues enterprise AI security is an access and accountability problem, not a working-group task. The published interview never names who owns the outcome.
Reality
France's DGFiP confirmed tax and property data exposure for 678,000 filers while GitLab fixed an unauthenticated project-deletion bug. Both arrived with figures a team can act on.
Reality
This week's disclosures turned on human trust and third-party exposure: social engineering at Levi Strauss, warehouse disruption at CEVA Logistics, and an AI agent that walked through an auth gap.
Reality