> ## Content Index
> Fetch the complete content index at: https://www.metacurity.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# FBI uproots over 40 of North Korea’s US laptop farms
- URL: https://www.metacurity.com/fbi-uproots-over-40-of-north-koreas-us-laptop-farms/
- Published: 2026-10-14T13:46:14.000Z
- Updated: 2026-10-14T13:46:14.000Z
- Description: Authorities dismantled more than 40 Texas laptop farms supporting fraudulent IT hires whose paychecks allegedly financed Pyongyang’s nuclear and missile programs.
- Author: Cynthia B Brumfield
- Tags: News, Cybersecurity, #no-feature-image

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/Flag_of_North_Korea_-March_2026---present-.svg-1.png)

*Don't miss my latest* [*CSO piece*](https://www.csoonline.com/article/4234854/ai-agents-arent-going-rogue-frontier-labs-are-skipping-security-basics.html?ref=metacurity.com) *on how those rogue AI agents are, in fact, mostly fundamental cybersecurity mistakes made by the frontier labs.*

### The FBI last month disrupted a widespread network of American facilitators accused of aiding the North Korean government in securing remote information technology jobs that helped fund the reclusive country’s nuclear and ballistic weapons programs.

The operation included the dismantling of more than 40 so-called laptop farms across Texas and the seizure of nearly 200 computer devices, the officials said, marking one of the largest efforts to date by US authorities to block a key revenue stream that has helped North Korea evade harsh international sanctions and generate billions in cash in recent years.

The Justice Department separately unsealed indictments in Ohio against two US nationals and 10 China-based North Koreans accused of committing identity theft to earn paychecks from unwitting American companies that hired them. Prosecutors said that scheme bilked 70 companies out of more than $3 million and ran from 2019 to 2025\. The identities of two additional defendants remained under seal.

North Korea is deploying “thousands of state-controlled I.T. workers to infiltrate companies in the United States and allied countries,” Brett Leatherman, the head of the FBI’s cyber division, said in an interview. “Every one of these jobs is funding a stream for a nuclear and ballistic missiles program obtained with the stolen identity of an American and the trust of an American employer.”

The bureau worked closely with the US-based cybersecurity firm CrowdStrike to identify and disrupt the network, Mr. Leatherman said. He added that the coordinated actions were an early example of the FBI’s new cyber strategy, which was unveiled last month and promised closer collaboration with the private sector to target hackers in ways that impede or thwart malicious activity. The strategy is part of a broader effort across the Trump administration to work more closely with American companies to strike hackers with cyberattacks, a pivot cautiously welcomed by some security experts.

US officials and cybersecurity analysts have said the North Korean IT worker scheme is among the most serious ongoing digital threats facing businesses today, and that it remains underappreciated as a risk. Adam Meyers, who oversees counteradversary operations at CrowdStrike, said the North Korean schemes to get hired for jobs have been “increasing both in prevalence and complexity.” ([Dustin Volz / New York Times](https://www.nytimes.com/2026/10/13/us/politics/north-korea-it-workers-fbi.html?unlocked%5Farticle%5Fcode=1.IVE.Hd6z.VaFEYJD7BNi%5F&smid=nytcore-ios-share&ref=metacurity.com))

**Related:** [*Department of Justice*](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker?ref=metacurity.com)*,* [*Department of Justice*](https://www.justice.gov/opa/media/1465576/dl?inline&ref=metacurity.com)*,* [*IC3*](https://www.ic3.gov/PSA/2026/PSA261013?ref=metacurity.com)*,* [*CrowdStrike*](https://www.crowdstrike.com/en-us/blog/fbi-disrupts-famous-chollima-operation-with-crowdstrike-assistance?ref=metacurity.com)*,* [*iTnews*](https://www.itnews.com.au/news/us-raids-40-laptop-farms-for-north-korean-it-workers-629641?ref=metacurity.com)*,* [*TechCrunch*](https://techcrunch.com/2026/10/13/justice-department-says-north-koreans-have-infiltrated-dozens-of-u-s-companies/?ref=metacurity.com)*,* [*IC3.gov News*](https://www.ic3.gov/PSA/2026/PSA261013?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/legal/government/doj-arrests-two-seizes-187-devices-north-korean-laptop-farm-crackdown-texas-2026-10-13/?ref=metacurity.com)*,* [*The Cyber Express*](https://thecyberexpress.com/fbi-warns-north-korean-it-workers/?ref=metacurity.com)*,* [*US Department of Justice*](https://www.justice.gov/usao-ndtx/pr/operation-lonestar-roundup-dismantles-north-korean-it-worker-network-used-penetrate-us?ref=metacurity.com)*,* [*The Record*](https://therecord.media/north-korea-laptop-farms-worker-scams-doj-raids-texas?ref=metacurity.com)*,* [*crypto.news*](https://crypto.news/north-korean-it-fraud-case-cites-crypto-transfers-3m/?ref=metacurity.com)*,* [*Nextgov/FCW*](https://www.nextgov.com/cybersecurity/2026/10/fbi-disrupts-north-korean-laptop-farm-used-infiltrate-us-companies/416570/?ref=metacurity.com)*,* [*NextGov/FCW*](https://www.nextgov.com/cybersecurity/2026/10/fbi-disrupts-north-korean-laptop-farm-used-infiltrate-us-companies/416570/?oref=ng-author-river&ref=metacurity.com)

### OpenAI engineer Abdulrahman Alfozan, a Saudi national and US permanent resident, allegedly concealed an audio recording device in a piece of toilet paper and attached it behind a monitor inside an executive conference room at one of the company’s San Francisco offices, according to a criminal complaint.

Alfozan allegedly spent several weeks querying an unspecified “productivity agent” and an “AI chatbot” to plan his alleged surveillance operation. He used an internal OpenAI tool to ask about meetings scheduled in the targeted conference room.

He also appears to have used a chatbot account associated with his spouse to ask various technical questions about setting up a covert audio recording device, according to prosecutors and the court filing.

OpenAI’s security team also allegedly found an additional recording device in Alfozan’s bag at the office.

Alfozan couldn’t be immediately reached for comment. He made an initial appearance in US District Court in San Francisco on Tuesday on one charge of “use of an electronic, mechanical, or other device to intercept oral communications.” If convicted, Alfozan faces up to five years in prison. He joined OpenAI in July 2025 and was fired last Friday to coincide with his arrest.

FBI director Kash Patel said that Alfozan aimed “to secretly capture sensitive communications about the company’s super intelligence technology,” but neither prosecutors nor OpenAI have offered any information so far about a potential motive.

OpenAI discovered the bug—which was allegedly “concealed in toilet paper” and “inserted into a USB port on the back of a television” in the conference room—on September 30 during a countersurveillance sweep.

Alfozan previously worked at a cargo logistics startup and at Meta, according to a purported LinkedIn profile for him. In a recent podcast interview, Alfozan said he was also part of a group of Saudi engineers in Silicon Valley who offered consulting services to Saudi organizations. ([Paresh Dave, Maddy Varner, Caroline Haskins / Wired](https://www.wired.com/story/an-openai-employee-allegedly-used-a-chatbot-to-help-plant-a-recording-device-at-the-office/?mid=1&ref=metacurity.com#cid=3755919))

***Related:*** [*Justice Department*](https://www.justice.gov/opa/pr/saudi-national-arrested-installing-surreptitious-audio-recording-device-openai?ref=metacurity.com)*,* [*TechCrunch*](https://techcrunch.com/2026/10/13/fbi-arrests-openai-employee-accused-of-planting-hidden-recording-device-in-conference-room/?utm%5Fsource=dlvr.it&utm%5Fmedium=bluesky)*,* [*WSJ.com: WSJD*](https://www.wsj.com/tech/ai/saudi-national-charged-with-bugging-openais-office-7e960aad?mod=rss%5FTechnology&mid=1&ref=metacurity.com#cid=3756626)*,* [*The Guardian*](https://www.theguardian.com/technology/2026/oct/13/openai-employee-arrested-hidden-recording-device?mid=1&ref=metacurity.com#cid=3756546)*,* [*Security Week*](https://www.securityweek.com/employee-arrested-after-listening-device-found-in-openai-conference-room-fbi-and-the-company-say/?mid=1&ref=metacurity.com#cid=3756817)*,* [*CNBC Technology*](https://www.cnbc.com/2026/10/13/openai-employee-arrested-recording-device.html?mid=1&ref=metacurity.com#cid=3756230)*,* [*PCMag.com*](https://www.pcmag.com/news/openai-employee-arrested-for-spying-on-execs-using-hidden-recording-device?mid=1&ref=metacurity.com#cid=3756099)*,* [*Business Insider*](https://www.businessinsider.com/openai-security-threats-hidden-recording-device-planted-offices-2026-10?mid=1&ref=metacurity.com#cid=3756492)*,* [*Implicator.ai*](https://www.implicator.ai/openai-engineer-charged-recording-device-conference-room/?mid=1&ref=metacurity.com#cid=3756832)*,* [*The Desk*](https://thedesk.net/2026/10/saudi-man-arrested-for-bugging-chatgpt-developer-offices/?mid=1&ref=metacurity.com#cid=3755937)*,* [*Politico*](https://www.politico.com/news/2026/10/13/openai-employee-arrested-and-charged-over-hidden-recording-01117275?mid=1&ref=metacurity.com#cid=3756986)*,* [*New York Times*](https://www.nytimes.com/2026/10/13/technology/openai-worker-arrested-bugging.html?campaign%5Fid=9&emc=edit%5Fnn%5F20261014&instance%5Fid=183519&nl=the-morning®i%5Fid=67424004&segment%5Fid=228082&user%5Fid=6638171cf8692ca6fdd39a90eeca255f&ref=metacurity.com)*,* [*Wall Street Journal*](https://www.wsj.com/tech/ai/saudi-national-charged-with-bugging-openais-office-7e960aad?mod=djemCybersecruityPro%26tpl%3Dcs&ref=metacurity.com)

### Microsoft and Japan’s National Police Agency (NPA) discovered a massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries that has been disrupted by law enforcement agencies and partners worldwide.

They discovered "a sprawling Chinese-language cybercrime marketplace," with tools and services for phishing campaigns, and more than 750 million malicious messages aimed at Microsoft customers via email and SMS texts.

The investigators traced the malicious activity to YAM Store (Storm-3119), an underground infrastructure marketplace, then linked it to the CoGUI, Haozi, and Iron Man System phishing kits, collectively tracked as Storm-2990.

Microsoft says that YAM Store sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage.

Its operators acquired expired domains of real organizations, rebuilt websites to make defunct entities appear active, and then used those identities to obtain cloud accounts.

Another observed method was to generate fake organizations, complete with content and documentation, using AI tools.

Microsoft says that CoGUI targeted victims in the United States and Japan, but Iron Man, which offers over 2,300 templates impersonating banks, retailers, delivery services, and government agencies, pushed it aside by mid-2026.

Cybersecurity company Resecurity also participated in the investigation and shared more details about Iron Man after analyzing exposed infrastructure, including a publicly exposed Git/container registry with 911 published builds and eight registered accounts.

Under an order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man.

The tech giant also deactivated over 20,000 accounts associated with the YAM Store and blocked 100,000 domains the cybercriminals used for impersonation and fraud.

Currently, more infrastructure is being removed based on the findings of the investigation, which also involves the Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs. ([Bill Toulas / Bleeping Computer](https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/?ref=metacurity.com))

**Related:** [*Microsoft*](https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations/?ref=metacurity.com)*,* [*Resecurity*](https://www.resecurity.com/blog/article/iron-man-yamstore-powering-a-global-phishing-as-a-service-ecosystem?ref=metacurity.com)*,* [*CyberScoop*](https://cyberscoop.com/microsoft-disrupts-chinese-language-phishing-kit-ecosystem/?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-41.png)

Operational overview. Source: Microsoft

### The US Justice Department announced it had arrested 28 individuals in Nigeria and Ghana allegedly responsible for scamming hundreds of Americans.

"These criminal operations are increasingly sophisticated, organized and linked to human trafficking," Jeanine Pirro, the US attorney for Washington, DC, told reporters on a call. "The losses from these cyber-enabled scams continue to rise sharply, with billions stolen annually. Law enforcement and the private sector have been and must continue to work together because criminals exploit global platforms and borders."

She said they used "real-time intelligence" with other international law enforcement and private industry partners to make the arrests.

The disrupted schemes announced Tuesday included law enforcement impersonation scams, digital “arrest” extortion schemes, cryptocurrency investment fraud and a variety of other online fraud operations, the DOJ said.

Rob Cochran, the director of intelligence, safety, and signals for Meta, said on the call it had taken down 3.7 million accounts, pages and groups on Instagram and Facebook tied to scammers.

In Ghana, the DOJ said 19 people were arrested, and 303 electronic devices were seized in a scam that victimized 89 people out of $8.3 million. It also reported that authorities identified 117 victims of human trafficking who are pending repatriation to Nigeria.

The methods the alleged scammers used included offering fake employment opportunities to trick victims, impersonating the military, and romance scams that target primarily elderly victims, according to the FBI.

The Justice Department says it froze $11 million in assets of the alleged scammers and potentially saved the lives of those victims who were allegedly human trafficked by the scam groups.

The operation included members of the US Department of Justice, the Scam Center Strike Force under the US Attorney’s Office for the District of Columbia, FBI, US Secret Service, US Department of the Treasury, Homeland Security Investigations (HSI), Homeland Security Task Force (HSTF), the UK’s NCA, the Nigerian Joint Case Team on Cybercrimes, the Nigeria Police Force - National Cybercrime Center, Ghanaian Cyber Security Authority, and private sector partners. 

Additional participants included law enforcement agencies from Australia, Canada, Ghana, India, New Zealand, and Nigeria, along with INTERPOL and additional cybercrime units. Several tech giants also played a key role. The large-scale effort was hosted by the UK NCA in London. ([Luke Barr / ABC News](https://abcnews.com/Politics/justice-department-arrests-28-alleged-scammers-africa/story?id=137237224&ref=metacurity.com) and [Justice Department](https://www.justice.gov/usao-dc/pr/department-justice-announces-results-law-enforcement-and-private-industry-joint?ref=metacurity.com))

**Related:** [*Facebook*](https://about.fb.com/news/2026/10/meta-tech-companies-law-enforcement-crackdown-global-scam-networks/?ref=metacurity.com)*,* [*NCA*](https://www.nationalcrimeagency.gov.uk/news/nca-hosts-international-law-enforcement-and-tech-industry-crackdown-on-fraud-and-scams?ref=metacurity.com)*,* [*TVC News*](https://www.tvcnews.tv/us-uk-meta-to-unveil-crackdown-on-west-africa-based-online-scam-networks/?ref=metacurity.com)*,* [*Axios*](https://www.axios.com/2026/10/13/doj-west-africa-scam-center-arrests?ref=metacurity.com)*,* [*The Hill*](https://thehill.com/policy/technology/6146435-global-agencies-tech-firms-scam-network/?ref=metacurity.com)*,* [*CyberScoop*](https://cyberscoop.com/west-african-scammers-international-scam-crackdown-joint-disruption-week/?ref=metacurity.com)

### Meta is notifying roughly 1,500 people, most of them employees in the US, that their personal information was impacted after hackers got into some of the company’s GitHub repositories.

The intrusion was detected a few weeks ago. According to the tech giant, an outside group gained access to the repositories using an employee’s stolen credentials.

Meta’s security team shut down the attackers’ access and brought in GitHub and law enforcement. Notifications to the impacted individuals started going out on Tuesday.

Meta said that 99% of the data the hackers took was business data, in the form of software code related to some of its products. The remaining 1% was personal data.

That personal data had been added to the repositories by mistake and should not have been there, as storing it on GitHub went against company policy. Meta has not said what types of personal information were involved.

The company also noted that a significant portion of what looked like personal data was actually synthetic or anonymized test data. As a result, the attackers may not readily be able to tell genuine records apart from test data. ([Eduard Kovacs / Security Week](https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/?ref=metacurity.com))

**Related:** [*International Cyber Digest*](https://www.internationalcyberdigest.com/meta-github-breach-source-code-employee-data/?ref=metacurity.com)*,* [*The Verge*](https://www.theverge.com/tech/1010737/meta-says-its-github-was-hacked-exposing-1500-peoples-personal-data?ref=metacurity.com)

### In its October Patch Tuesday release, Microsoft issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. 

This epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.

Just one of the weaknesses patched this week is considered a “zero day,” or already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions.

Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended that support for another year (until October 2027).

At least 78 of the flaws fixed this month are rated “critical,” meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system.

While Microsoft said there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (CVE-2026-108398) was publicly disclosed prior to today, potentially giving attackers advance time to work out how to exploit the bug. ([Brian Krebs / Krebs on Security](https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/?ref=metacurity.com#cid=3755939))

**Related:** [*Bleeping Computer*](https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/?utm%5Fsource=dlvr.it&utm%5Fmedium=linkedin)*,* [*Cyber Security News*](https://cybersecuritynews.com/microsoft-october-patch-tuesday-2026/?mid=1&ref=metacurity.com#cid=3754927)*,* [*Rapid7*](https://www.rapid7.com/blog/post/em-patch-tuesday-october-2026?mid=1&ref=metacurity.com#cid=3756054)*,* [*Talos Intel*](https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/?mid=1&ref=metacurity.com#cid=3756416)*,* [*SANS Internet Storm Center*](https://isc.sans.edu/diary/rss/33422?mid=1&ref=metacurity.com#cid=3756798)*,* [*Cyber Insider*](https://cyberinsider.com/windows-11-october-updates-fix-zero-day-vpn-failures-and-black-screens/?mid=1&ref=metacurity.com#cid=3756889)*,* [*Microsoft Security*](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-96951?ref=metacurity.com)*,* [*CSO*](https://www.csoonline.com/article/4234759/october-patch-tuesday-roundup-over-1400-microsoft-holes-to-be-plugged-including-three-zero-days.html?ref=metacurity.com)*,* [*Ask Woody*](https://www.askwoody.com/2026/the-stats-for-october/?ref=metacurity.com)

### Artificial intelligence researchers called swarmchasers uncovered Chinese-made AI agents that had gone rogue this month, trying to bypass anti-robot protections on websites and using a security credential for an online mapping service that had been exposed on the internet.

It was believed to be the first time that sort of activity was connected to Chinese technology. The agents were traced to tests being run by the Chinese tech giant Tencent, according to logs the researchers uncovered and a person familiar with the investigation.

The discovery by swarmchasers who met at a coding event in San Francisco was a reminder that AI development by Chinese tech companies can be just as aggressive as the work of their American counterparts. ([Dylan Freedman / New York Times](https://www.nytimes.com/2026/10/14/technology/chinese-ai-agents-rogue.html?ref=metacurity.com))

**Related:** [*Swarmchasers*](https://swarmcha.se/posts/chinese-agent-fleet-full-report?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-37.png)

activity directed at amap.com and gaode.com, bucketed by hour. Source: Swarmchasers.

### After crypto wallet maker Ledger announced that a backdoor embedded in a handful of Ledger wallets sold in Southeast Asia allowed thieves to hijack around $102 million in crypto from their owners, news has emerged of other Ledger wallets sold in Germany also having implants.

The hardware implants were originally found on an unknown number of Ledger Nano X wallets sold by an authorized Ledger reseller called CryptoBilis based in Malaysia. Ledger said the implants were found on a limited number of devices, all sold by the same seller. But a Ledger device owner in Europe has since said that he found an implant on a Nano X that he purchased at a large European electronics chain store in August and a second one he purchased this weekend at another store in the same chain. He believes these indicate that Ledger’s supply chain has been compromised.

Since then, users and researchers have also reported finding implants in Ledger Flex and Ledger Stax devices – two of Ledger's more recent lines of devices used for securely storing keys used to access a device owner's crypto accounts.

The implants are not the first to be found on Ledger wallets. Famed hardware hacker Joe Grand found implants on several Nano X wallets earlier this year and notified Ledger about them in March, raising questions about Ledger's urgency in addressing the issue. Many of the implants discovered more recently appear to be more sophisticated iterations of the ones that Grand found.

A user going by the name Johannes wrote on X over the weekend that he had purchased a Ledger Nano X wallet in person from a MediaMarkt store that had an implant. MediaMarkt is Germany’s equivalent to BestBuy and has 1,000 stores in ten European countries. It’s listed as an authorized reseller of Ledger wallets in Austria, Germany, Spain and Turkey.

Johannes said he purchased the wallet in August in a MediaMarkt store in Germany but only took the device apart this weekend following reports that implants had been found. He posted photos of an antenna and implant in his device. Johannes said that he has had no crypto stolen. ([Kim Zetter / Zero Day](https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/?ref=metacurity.com))

**Related:** [*BleepingComputer*](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/?ref=metacurity.com)*,* [*ZERO DAY*](https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants/?ref=metacurity.com)*,* [*The Crypto Times*](https://www.cryptotimes.io/2026/10/14/ledger-halts-sales-in-7-asian-markets-as-tampered-flex-surfaces-in-singapore/?ref=metacurity.com)*,* [*CoinDesk*](https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network?ref=metacurity.com)*,* [*TheStreet*](https://finance.yahoo.com/markets/crypto/articles/ledger-spy-chip-scandal-raises-191236683.html?ref=metacurity.com)*,* [*Slashdot*](https://yro.slashdot.org/story/26/10/13/192236/ledger-confirms-spy-chip-implant-behind-wallet-crypto-thefts?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-38.png)

Images posted to X by Johannes, who says he found implants in two Ledger wallets he purchased in person from MediaMarkt stores in Germany. Source: Zero Day.

### France's anti-cybercrime unit has closed two ​websites alleged to be ‌selling stolen data and arrested three 17-year-olds suspected of ​running them, Paris ​prosecutor Laure Beccuau said.

The ​Reacher platform was created ​in March and offered stolen personal data from different sources ​to the public through ​different kinds of subscriptions, the statement ‌said

The ⁠service, which was renamed Stryx in June, claimed to store 730 million ​lines ​of ⁠data, including names, addresses and bank ​account numbers, and had ​received ⁠3.1 million requests.

The three male teenagers could face ⁠up ​to 10 years ​in prison if convicted. ([Inti Landauro / Reuters](https://www.reuters.com/legal/litigation/french-police-arrest-three-17-year-olds-suspected-running-stolen-data-websites-2026-10-09/?ref=metacurity.com))

**Related:** [*Tribunal de Paris*](https://www.tribunal-de-paris.justice.fr/sites/default/files/2026-10/2026-10-09%20CP%20Stryx.pdf?ref=metacurity.com)

### GitLab warned users to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.

Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the 'joaxcar' handle and reported via GitLab's HackerOne bug bounty program.

CVE-2026-97229 stems from an integer overflow weakness in GitLab's CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in projects' pipeline configuration files.

"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company explained in a Monday advisory.

GitLab fixed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, and urged users to patch their servers immediately. ([Sergiu Gatlan / Bleeping Computer](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/?ref=metacurity.com))

***Related:*** [*GitLab*](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/?ref=metacurity.com#cve-2026-97229---integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee)*,* [*Cyber Security News*](https://cybersecuritynews.com/gitlab-vulnerability-code-execution/?ref=metacurity.com)*,* [*Cyber Kendra*](https://www.cyberkendra.com/2026/10/cve-2026-97229-gitlab-regex-rce.html?ref=metacurity.com)*,* [*Help Net Security*](https://www.helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229/?ref=metacurity.com)*,*[ *Security Affairs*](https://securityaffairs.com/200868/security/gitlab-patches-max-severity-vulnerability-cve-2026-97229.html?ref=metacurity.com)

---

**Spend less time finding cybersecurity news. Get more out of it.**

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

**A paid subscription gives you:**

- **The full Metacurity archive:** Every newsletter, searchable and browsable.
- **Our weekly long-reads roundup:** The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
- **Specialized reports and analysis:** Periodic deep dives that go beyond the daily headlines.
- **A direct role in sustaining independent journalism:** Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

**Subscribe today—and thank you for reading and supporting Metacurity.**

[Upgrade my subscription](#/portal/account/plans)

---

### Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.

Formerly known as Pulse Connect Secure and originally Juniper Pulse, the enterprise-grade ICS SSL VPN provides remote employees, contractors, and hybrid workforces with secure access to corporate and cloud resources.

Tracked as CVE-2026-104935, this high-severity authentication bypass zero-day affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.

Remote threat actors without privileges can exploit CVE-2026-104935 in low-complexity attacks that don't require user interaction to execute arbitrary commands on targeted ICS appliances.

"At the time of disclosure, Ivanti is aware of limited exploitation in the wild. We are working directly with those organizations while making information, updates and remediation available to the broader customer community. If you are running one of the impacted versions, Ivanti recommends you act immediately," Ivanti said. ([Sergiu Gatlan / Bleeping Computer](https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/?ref=metacurity.com))

**Related:** [*Ivanti,*](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en%5FUS&ref=metacurity.com)[*Volexity*](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/?ref=metacurity.com)*,* [*Security Week*](https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/?ref=metacurity.com)*,* [*CyberScoop*](https://cyberscoop.com/ivanti-connect-secure-zero-day-actively-exploited/?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/ivanti-connect-secure-zero-day/?ref=metacurity.com)*,* [*Bank Info Security*](https://www.bankinfosecurity.com/ivanti-vpn-zero-day-exploited-in-active-attacks-a-33094?ref=metacurity.com)*,* [*Help Net Security*](https://www.helpnetsecurity.com/2026/10/14/ivanti-zero-days-gain-root-patched-vpn-appliances/?ref=metacurity.com)*,* [*Shattered*](https://shattered.io/ivanti-connect-secure-cve-2026-104935-zero-day/?ref=metacurity.com)*,* [*Decipher*](https://decipher.sc/2026/10/13/ivanti-patches-connect-secure-zero-day-exploited-in-attacks/?mid=1&ref=metacurity.com#cid=3756296)*,* [*Security Affairs*](https://securityaffairs.com/200887/security/u-s-cisa-adds-ivanti-connect-secure-flaw-to-its-known-exploited-vulnerabilities-catalog.html?mid=1&ref=metacurity.com#cid=3755983)*,* [*Forkast*](https://forkast.news/ivanti-connect-secure-ships-authentication-that-can-be-spoofed-cisa-says-thursday/?mid=1&ref=metacurity.com#cid=3755112)

### The UK Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday.

Established under the Housing Act 1996, the Housing Ombudsman is an executive non-departmental public body sponsored by the Ministry of Housing, Communities, and Local Government.

The watchdog settles disputes between social housing residents and social landlords in England, including housing associations, landlords, managers, and letting agents.

On Tuesday, the service added an alert to its official website, warning that it's working with the affected service provider to assess the incident's impact and that social housing residents cannot file new complaints until systems are back online.

Those who must raise new complaints are advised to call the Housing Ombudsman's phone line or email the watchdog at info@housing-ombudsman.org.uk. ([Sergiu Gatlan / Bleeping Computer](https://www.bleepingcomputer.com/news/security/uk-housing-ombudsman-service-investigates-security-incident/?ref=metacurity.com))

***Related:*** [*Housing Ombudsman*](https://www.housing-ombudsman.org.uk/2026/10/13/housing-ombudsman-service-statement-it-security-incident/?ref=metacurity.com)*,* [*Housing Today*](https://www.housingtoday.co.uk/news/housing-ombudsman-service-hit-by-cyber-attack/5144614.article?ref=metacurity.com)

### Digital Forensics Corporation (DFC), an Ohio-based company, allegedly collected at least $60 million by tricking panicked customers facing sextortion threats into buying help the firm didn’t provide, according to a Federal Trade Commission (FTC) complaint.

DFC owner Dmitry Belkin and several affiliated companies are behind the scheme, which allegedly ran from February 2023 through July 2026, the FTC said. A federal court has temporarily ordered the “sextortion assistance” company from doing business until a decision is reached, the agency said.

Desperate defendants receiving threats from sextortionists who said they will share naked photos or other sensitive sexual information with family members and employers have turned to DFC for help only to be manipulated into spending thousands, the FTC said.

The company would lure victims into paying between $1,499 and $20,000 in exchange for so-called Phase 1 services that it claimed included stopping the attack, pinpointing the sextortionist’s location with a “tracking campaign,” providing a detailed investigative report, notifying law enforcement and sending a cease-and-desist letter, the complaint said.

In reality, DFC did none of these things, according to the FTC. 

“Instead of communicating with the sextortionist through the victim's account, defendants routinely change the victim's account settings simply to block the sextortionist's communications,” the complaint said. “Instead of obtaining investigative information, defendants fabricate chat transcripts.” ([Suzanne Smalley / The Record](https://therecord.media/sextortion-assistance-company-alleged-fraud-ftc-complaint?ref=metacurity.com))

***Related:*** [*Federal Trade Commission*](https://www.ftc.gov/news-events/news/press-releases/2026/10/ftc-sues-operator-sextortion-relief-scheme-misleading-consumers-believing-it-would-identify?utm%5Fsource=govdelivery)*,* [*US Today*](https://www.usatoday.com/story/life/health-wellness/2026/10/13/ftc-halts-company-accused-of-sextortion-recovery-scams/92236884007/?ref=metacurity.com)*,* [*Techlicious*](https://www.techlicious.com/blog/ftc-says-sextortion-help-firm-scammed-victims-out-of-60m/?ref=metacurity.com)

### According to a report from South Korean cybersecurity firm Genians, North Korean hackers have been targeting Ukrainian experts in diplomacy, security and international policy amid Pyongyang’s growing military cooperation with Russia.

As part of the campaign, the hacking group Kimsuky used fake conference invitations, research collaboration requests and malicious documents designed to steal information, South Korean cybersecurity firm Genians said in a report published Monday. 

North Korea has provided troops to fight in the war in Ukraine as well as other military support to Russia since 2024\. 

"Kimsuky’s attacks against Ukraine may be aimed at collecting information on the war, the extent of North Korean troop losses, developments in the questioning and handling of prisoners of war, and the details of consultations between South Korea and Ukraine,” researchers said, adding that most of the observed attacks were unsuccessful.

Genians said the transfer of two North Korean soldiers captured by Ukrainian forces to South Korea in September could also be of intelligence interest to Pyongyang, particularly what the prisoners might disclose about North Korean military operations and casualties. ([Daryna Antoniuk / The Record](https://therecord.media/north-korea-hackers-russia-ukraine?ref=metacurity.com))

**Related:** [*Genians*](https://www.genians.co.kr/en/blog/threat%5Fintelligence/operation-gitpower?ref=metacurity.com)

### OpenAI is reportedly holding early-stage discussions to acquire Trail of Bits, a New York-based software security firm known for identifying and remediating vulnerabilities in open-source projects.

The talks, reported by The Information and which remain unconfirmed by either company and could still fall through, align with OpenAI’s broader push to develop a sizable cybersecurity business. Trail of Bits, founded in 2012 and employing more than 40 people, has worked with OpenAI since June on an open-source security initiative. ([Gopal Solanky / Crypto Times](https://www.cryptotimes.io/2026/10/14/openai-in-early-talks-to-acquire-trail-of-bits-as-cybersecurity-efforts-expand/?ref=metacurity.com))

**Related:** [*Crypto Briefing*](https://cryptobriefing.com/openai-talks-acquire-trail-of-bits/?ref=metacurity.com)*,* [*The Information*](https://www.theinformation.com/articles/openai-early-talks-buy-security-startup-trail-bits?ref=metacurity.com)

### Best Thing of the Day: Better Security Researchers Find This Stuff Before Bad Actors Do

Researchers at XBow [found three flaws](https://www.forbes.com/sites/the-wiretap/2026/10/13/how-an-off-the-shelf-openai-model-found-three-google-chrome-zero-days/?ref=metacurity.com) in Chrome that would enable a hacker to take over a user’s computer by using GPT-5.6 and collected a nice $250,000 bounty.

### Bonus Best Thing of the Day: Some of Us Need Patch Tuesday Self-Care

According to research conducted by UK-based cybersecurity firm Socura, one in five UK cybersecurity leaders, including CSOs and CISOs, [reportedly take sick leave or holidays](https://www.cybersecurity-insiders.com/cybersecurity-leaders-take-time-off-to-escape-patch-tuesday-pressure-and-ai-driven-concerns/?ref=metacurity.com) to avoid the stress associated with Patch Tuesday.

### Worst Thing of the Day: What's to Stop Musk From Pulling This Kind of Stunt on the US

Four days after Elon Musk tweeted that "Ukraine has gone too far," Ukraine's Starlink access [has been restricted](https://kyivindependent.com/this-cannot-be-a-coincidence-ukraines-starlink-access-restricted-without-warning-zelensky-adviser-says/?ref=metacurity.com) without warning, severely disrupting "several" military missions, presidential adviser Serhii "Flash" Beskrestnov said.

### Bonus Worst Thing of the Day: Of Course Meta Would Go There

Meta is defending its cuddly AI agent Muse [generating smut](https://www.wired.com/story/i-got-my-muse-ai-agent-to-sext-me-and-meta-says-thats-totally-fine/?ref=metacurity.com) as “legal adult behavior.”

### Closing Thought

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-40.png)