Infosecurity Magazine

Rogue AI agents have been caught again doing things they shouldn’t be on the open web, this time on platforms run by Wikimedia. The non-profit giant, which operates Wikipedia and several other open-knowledge platforms, revealed the news in a blog post published on October 5. Chief product and technology officer Selena Deckelmann said that her team investigated potential unauthorized agent activity after reading recent reports about this kind of behavior.

For years, cybersecurity followed a predictable pattern. A vulnerability appeared, security teams investigated it, a patch was eventually released, and organizations worked to close the gap before attackers could take advantage. That model was never perfect, but it was built for a world where change moved more slowly. That world no longer exists. Artificial intelligence has changed the game for cyber-attacks.

Ransomware attacks reached their highest ever quarterly volume in the third quarter of 2026, according to an analysis by Comparitech. The firm identified a total of 2627 claimed attacks during the three-month period from July to September 2026. This is a 27% increase on the previous quarter, Q2 2026, and a 61% rise compared to Q3 2025. Number of claimed ransomware attacks by quarter, Q1 2024 to Q3 2026.

The US, UK and several allied countries have issued a joint alert detailing the tactics, techniques and procedures (TTPs) associated with a sanctioned Chinese organization. The work of Integrity Technology Group has in the past enabled prolific Beijing-backed groups such as Flax Typhoon (aka Ethereal Panda, Red Juliett) according to the advisory, published on October 8.

AI is rapidly becoming embedded in enterprise operations, yet many organizations still lack the skills and governance frameworks needed to manage the technology effectively. In response, training and certification body ISACA plans to launch an AI governance certification, currently accepting applications in beta phase, in early 2027. This will complete a series of AI-focused credentials designed to help professionals manage the technology securely and responsibly.

Ten major AI companies have made, or committed to make, changes to their UK data protection policy after the Information Commissioner's Office (ICO), the British privacy watchdog, urged them to strengthen transparency in how they process personal data. These include Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI.

Attackers have compromised three country-code top-level domain (ccTLD) registries and obtained unauthorized HTTPS certificates covering several Google domains and sites belonging to other organizations. The incidents affected the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) namespaces, according to a post published by Google's Chrome Secure Web and Networking Team on October 6.

UK fashion retailer ASOS has notified customers the threat actor had accessed personal and customer account data following the October 6 data breach. In the email to customers on October 8, shared with Infosecurity, ASOS also confirmed that payment information was not compromised and that the incident has not affected operations.

A Russia-aligned cyber espionage group has steadily upgraded its MATCHBOIL downloader over two years, adding stronger obfuscation, sandbox checks and changes to its execution and payload persistence. In new research published on October 8, ESET documented MATCHBOIL versions compiled or observed between April 2024 and April 2026, finding that each version was more sophisticated than the one before it.

A suspected China-based threat actor leveraged AI tooling in a campaign that successfully exfiltrated data from South Korean financial organizations, CrowdStrike has revealed. The cybersecurity firm discovered that the attacker used ARTEX, a recently released open-source agentic pentesting tool developed in China alongside Anthropic’s Claude AI model during the campaign, which ran from late September to early October 2026.