International Cyber Digest

Microsoft has priced its Nvidia RTX Spark PCs, with the Surface Laptop Ultra starting at $2,599 and the Surface RTX Spark Dev Box at $5,999. > Up to 128GB of unified memory > Runs AI models of up to 120 billion parameters locally, no cloud needed > Up to 1 petaflop of AI compute > Up to 20 CPU cores and 6,144 CUDA cores > Microsoft claims up to 2.1x faster time to first token, 4.3x faster AI image generation and 6.2x faster AI video generation than a 16-inch M5 Pro MacBook Pro > World's first laptop with a breakaway USB-C port > Base model gets 24GB, the 128GB laptop costs $5,899.99

‼️ ShinyHunters was extorting Jeppesen ForeFlight, a navigation company Boeing sold for $10.55B, when its suspected teenage leader "Rey" was detained in Jordan, KrebsOnSecurity reports. Rey once claimed his father is an airline pilot, and Krebs says the father works for Royal Jordanian Airlines, which flies Boeing planes. https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/

❗️ An Arizona appeals court has thrown out a 10.5-year manslaughter sentence after finding the judge was influenced by an AI-generated video of the dead victim "forgiving" his killer. The victim's sister wrote the script. The judge said he loved it, then imposed the maximum.

❗️ AMD plans to substantially increase chip supply in 2027 to meet AI demand for CPUs and GPUs, CEO Lisa Su said on a supplier trip to Taiwan on Tuesday. Su met partners including TSMC and Foxconn before heading to South Korea, home of Samsung and SK hynix. She says AMD still needs more advanced wafer capacity and is working closely with memory makers to secure supply.

❗️ Samsung's Galaxy S26 was remotely hacked three times on Day One of Pwn2Own Ireland, while Google's Pixel 10 survived a $300,000 attempt. Researchers earned $388,500 for 32 zero-days and also broke LiteLLM, Sonos, Philips Hue, Oracle's Autonomous AI Database and OpenAI Codex. VinSOC leads with $97,500 as Day Two gets underway with KAIST targeting the Pixel 10 over USB.

❗️ OpenAI awarded a researcher just $300 for a sandbox escape that gave free access to its paid models, with no API key and no account. "Zero reason to report anything else I find to them," researcher Oliver Fish concludes.

❗️ Meta's AI agent Muse is mapping relationships, disputes and "tensions and alliances" of 4 million users and the people they mention, including people who don't use it, and it is instructed not to tell users that messages they asked it to "forget" may still be visible, a review of its internal instructions found. https://time.com/article/2026/10/06/meta-muse-ai-agent-privacy/

❗️ Mistral's new AI tried to break out of its test environment during evaluation but was contained, the company says. It calls the behaviour expected for Large 4, a 1-trillion-parameter model pitched as strong at cybersecurity. The open weights ship on Oct 27.

❗️ A 16-year-old was misled by Anthropic's Claude onto a route far beyond his abilities, North Shore Rescue says. The AI's directions put him on a climbing route known as the "Widowmaker", where he was stranded below a cliff until a helicopter hoisted him out.

‼️ BREAKING: Japan has handed Germany a 28-year-old Russian suspected of being a core member of the Qilin ransomware gang, after detaining him in late May while he was on a trip to Osaka. He was extradited on Oct. 2 with Tokyo High Court approval and is suspected of extorting $165K in bitcoin from a German logistics firm in Sept. 2024, The Asahi Shimbun reports. Qilin is the group that claimed the 2025 attack on Asahi Group.

‼️ The FBI has removed a contractor over a breach that exposed personal details of thousands of its employees. The cause, per the FBI's cyber chief: a security patch that was "explicitly issued" but never installed. Sources tell Reuters the contractor is from Accenture and the unpatched platform was Oracle PeopleSoft, which ShinyHunters says it exploited.

‼️🇩🇪 Germany’s former spy chief August Hanning has been arrested on treason and espionage charges. Prosecutors say the case began with a search of his premises during the Christina Block child-kidnapping investigation. His former chief of staff allegedly passed him nearly 2,000 internal BND documents for payment between 2010 and 2022, many classified. He allegedly used them in contacts with two unnamed foreign intelligence services.

❗️ French PC retailer LDLC is warning customers that a "malicious act" gave an intruder access to one of its systems. Names, home addresses, emails and phone numbers may have been viewed. It is LDLC's fourth disclosed security incident since 2021.

‼️ BREAKING: ASOS was hacked and customers received a ransom note meant for ASOS, pushed through the app. Titled "ASOS HACKED", it tells the company's data protection officer and IT team that attackers "fully compromised the Snowflake instance" and will leak it unless ASOS engages. ASOS has not confirmed a breach. Shares fell 11%.

‼️ We have examined the Trump Mobile leaked data and can confirm it includes people close to Trump: Larry Gatlin (singer) Jason Miller (Trump adviser) Charlie Ergen (EchoStar cofounder) Mike Kelly (GOP congressman) Bo Loudon (pro-Trump influencer) Eric Brunnett (Trump Organization VP of IT) Nicholas Hayes (Trump Hotels Assistant General Counsel)

‼️ We talked to the threat actor behind the Trump Mobile breach, who told us they infected a Liberty Mobile employee with an infostealer, got access to Trump Mobile through it and are still inside its systems. Neither company was using any MFA, allegedly. Turns out no security team or third-party support is handling the incident right now according to BYOD, "they basically told us to go fuck ourselves" with "no care for customers whatsoever".

‼️ BREAKING: Trump Mobile customers have had their personal data leaked by ransomware gang BYOD. The dump covers 3,615 people and includes names, emails, phone numbers, home addresses and order details. The gang says the company answered news of the breach with "We have no team to handle this." The leak includes the Trump Organization's own CIO, who oversees its information security. People listed in the data confirmed their details are accurate and BYOD claims it still has access to Trump Mobile's backend, Straight Arrow News reports.

‼️ BREAKING: The Pentagon told the BBC it has "ceased the use of Anthropic products" months after designating the company a supply chain risk, yet sources say Claude was still in use there last week, including in military operations against Iran. It was embedded in Maven, the Palantir-run platform that is the Pentagon's primary intelligence system, and Pete Hegseth's deadline to phase it out passed in late August.

404 Media is out with another nothing burger, since teams fix and patch vulnerabilities all the time, which they would've known if they'd ever worked in cybersecurity. The real news here is the insider threat Meta faces, as 404 Media has been able to read internal posts from Meta execs to its core infrastructure team.

❗️ Beyond Gravity, the Swiss state-owned firm that builds the payload fairings for Europe's Ariane 6 rocket, says it was hit by a targeted cyberattack and suspects a highly professional actor. First signs of malicious activity appeared on August 12. It went public 51 days later, on October 2. Mandiant and Switzerland's Federal Office for Cyber Security are investigating.