CISA Mandates Patches for Exploited Flaws; Nation-State Actors Breach F5 and Prosper Suffers Massive Data Leak

Further investigation into the Prosper data breach has revealed that the compromised data set is far more extensive and sensitive than initially reported. In addition to names, emails, and phone numbers, the breach now includes the exposure of Social Security Numbers, physical addresses, and income levels for all 17.6 million affected users. This critical update significantly elevates the risk of identity theft, sophisticated financial fraud, and targeted phishing campaigns, as attackers now possess the necessary information to open new lines of credit or file fraudulent tax returns. Users are strongly advised to freeze their credit immediately.

The Clop ransomware attack on Harvard University has been confirmed to stem from the exploitation of a critical zero-day vulnerability, CVE-2025-61882, in Oracle's E-Business Suite. This complex RCE flaw served as the initial access vector for the breach. The vulnerability is now being actively and widely exploited by Clop, with mass scanning reported across the internet. In addition to Harvard, another victim, Envoy Air, has also been linked to this exploit. Organizations using Oracle EBS are at immediate and significant risk and are urged to apply mitigations, including restricting access and deploying WAF/IPS, as an official patch is not yet available. This update provides crucial technical details and expands the scope of the incident.

A new report further emphasizes the F5 breach as a critical supply-chain attack preparation by a nation-state actor. The analysis reiterates the severe future risk of new zero-day vulnerabilities being discovered and exploited due to the stolen BIG-IP source code. Check Point Research noted that a small number of F5 customers were also impacted by the data theft, aligning with previous disclosures. The incident continues to highlight the urgent need for organizations to implement CISA's directive and harden F5 product configurations against potential future exploitation.

New details reveal the 'Scattered Lapsus$ Hunters' group demanded a ransom from Qantas, setting an October 11 deadline. Upon non-payment, the group proceeded to leak the personal information of 5.7 million Qantas customers. This confirms the use of double-extortion tactics, where data is stolen and then leaked if a ransom is not paid, escalating the threat to affected individuals and highlighting the full materialization of the threat.

A new ISACA report reveals that 63% of IT and cybersecurity professionals now consider AI-driven social engineering the top cyber threat for 2026, surpassing ransomware. Despite this consensus, only 13% of organizations feel 'very prepared' to manage generative AI risks. The report highlights the urgent need for updated defense strategies, training, and a shift towards behavioral analysis to counter hyper-personalized lures and deepfakes, indicating a significant preparedness gap in the face of evolving AI-powered attacks.