AI Risks Escalate, Major Breaches Hit Energy, Retail, and Courts

AI and Systemic Risk:

• AI Exploited in 84% of Ransomware Attacks, Report Finds: The Bank of England has declared AI-powered cyberattacks a 'systemic risk' to the global financial system, urging enhanced preparedness. A Semperis report indicates AI is exploited in 84% of ransomware attacks, while a SecurityHQ/Datadog study highlights an 'accountability gap' in AI governance, creating new attack vectors.

Critical Vulnerabilities and Active Exploitation:

• CISA Adds Four Actively Exploited Flaws to KEV Catalog: CISA has added four actively exploited vulnerabilities to its KEV catalog, affecting Palo Alto Networks, Cisco, and Ahsay products. Federal agencies must patch these flaws, including code injection and path traversal vulnerabilities, by October 17, 2026.
• PEERSTITCH: Stealthy Implant Hits FortiGate via Chained CVEs: Researchers have identified a novel memory-resident malware, PEERSTITCH, targeting Fortinet appliances. Attackers exploited chained CVEs (CVE-2024-47575 and CVE-2025-61624) to gain root access and deploy the stealthy implant, which operates entirely in memory.

Major Data Breaches and Incidents:

• GhostAction Campaign Compromises 1,900 GitHub Accounts, Targets 30k Repos: The 'GhostAction' campaign has compromised approximately 1,900 GitHub accounts, targeting over 30,000 repositories. Attackers inject malicious GitHub Actions workflows to steal CI/CD secrets and cloud credentials, with recent activity including scanning Git history for hardcoded secrets.
• CenterPoint Energy Data Breach Impacts Over 1 Million Texas Residents: Utility company CenterPoint Energy reported a data breach affecting over 1 million Texas residents, exposing sensitive personal information including Social Security numbers and driver's license numbers. The compromised data was advertised on a cybercrime forum in September 2026.
• Burger King Japan App Breach Exposes 11.18 Million Member Records: BK Japan disclosed a data breach impacting its mobile app, exposing the personal information of approximately 11.18 million members between October 2 and October 7, 2026. The compromised data included names, email addresses, phone numbers, and dates of birth; credit card information was not affected.
• Cybersecurity Incident Disrupts U.S. Federal Bankruptcy Court Operations: A cybersecurity incident at BAE Systems, a contractor for the U.S. Federal Judiciary, has disrupted the Bankruptcy Noticing Center (BNC) nationwide. This has halted the production and distribution of federal bankruptcy notices and taken related public websites offline.