China's Academic Spies, a Reformed Hacker Who Wasn't, and 543K Leaked Passwords
Saturday, October 3, 2026 · 5-minute read
MI5 issued a formal espionage alert on September 30 warning that a Chinese body called the China General Technology Research Institute (CGTRI) is a front company for China's spy service, the Ministry of State Security (MSS). More than 100 academics with UK ties have unknowingly — in some cases — helped fund research that improves China's ability to spy. The research topics include artificial intelligence, steganography, and covert communications.
↗ The Hacker NewsDutch police arrested Pepijn van der Stap, a 26-year-old previously convicted cybercriminal who had presented himself as a reformed security professional. Investigators believe he was helping the ShinyHunters crew pull off a major data theft targeting 6.2 million Dutch people. Within days of his arrest, ShinyHunters escalated — stealing data from the FBI and extorting the Russian ransomware gang Cl0p, apparently as a show of force.
↗ Krebs on SecurityThe Technical University of Denmark (DTU) confirmed that hackers broke into its identity and access management system and downloaded a large amount of personal data. Up to 200,000 students, staff, and alumni may be affected. DTU has not yet confirmed exactly what data was taken, but the breach involved the system that handles logins across the university.
↗ BleepingComputerA hacking group called Warlock — also tracked as Longlegs and Storm-2603 — is breaking into organizations by exploiting security flaws in Microsoft SharePoint. Once inside, they disable security tools and drop ransomware. In the past two months, Warlock has hit at least four victims — including a water utility, a telecom provider, a regional government, and a university — spread across Europe, Africa, and Latin America. The group is believed to have ties to China.
A newly discovered backdoor called Antino is targeting governments and policy organizations across Asia — including Taiwan, India, the Philippines, and Myanmar. What makes it sneaky: instead of using obvious hacker infrastructure, it sends stolen data through Microsoft Outlook and OneDrive, services that most organizations trust and rarely block. This makes the malicious traffic look completely normal. Cisco Talos researchers say at least 16 organizations across eight countries have been hit since late 2025.
A flaw in GitLab's AI Gateway — the service that connects GitLab to AI tools — could let any logged-in user run commands directly on the server. In plain terms: someone with a basic account could potentially take control of the machine running your company's GitLab AI setup. The score is 9.9 out of 10, making it about as serious as vulnerabilities get.
Who's affected: Only organizations that self-host their own AI Gateway. If you use GitLab.com or GitLab Dedicated, GitLab has already fixed it on your behalf. Self-hosted gateway operators need to update to versions 19.2.4, 19.3.2, or 19.4.1 right now.
Status: Patch available — update immediately if you run a self-hosted gateway.
Fortinet is warning that attackers are already actively exploiting a critical flaw in FortiMail, its email security product. The bug lets an attacker run unauthorized code or commands on a vulnerable device — without needing a valid login. This is a zero-day, meaning it was being used in real attacks before a patch existed.
Status: Fortinet has issued a patch. If your organization uses FortiMail, contact your IT or network security team to confirm it has been updated immediately.
Cisco has warned customers about a new SD-WAN zero-day vulnerability that is already being exploited in real attacks. SD-WAN is widely used by businesses to connect branch offices and remote employees. An attacker exploiting this flaw could gain unauthorized access to network infrastructure. Cisco has not yet assigned a CVE number but has issued an advisory urging customers to act.
Status: Check Cisco's advisory for workarounds. Ask your network team if your SD-WAN deployment is affected.
Microsoft has started enabling Windows settings backup automatically for enterprise customers — meaning employees' preferences, configurations, and some application settings will now sync to the cloud without anyone having to turn it on. The idea is to make it faster and easier to recover a work device after a failure or breach. From a security angle, it reduces the window where a compromised machine wipes out important configuration data. IT administrators can still disable or customize the feature, and the backup is tied to an organization's Microsoft account, not a personal one.
Researchers have discovered more than 543,000 valid, working credentials — real usernames and passwords — exposed in public code repositories on GitHub. Developers often accidentally paste login details into code they then share publicly. What makes this finding especially alarming: these credentials are still active, meaning attackers could use them right now to log into corporate systems, databases, or cloud services. This is a persistent problem in software development, and it shows no sign of slowing down.
↗ BleepingComputerIt reads like a crime thriller, but it's real. A Dutch man named Pepijn van der Stap spent years living a double life — working at a cybersecurity startup by day, extorting victims by night under the hacker handle "Umbreon." He was caught, convicted in 2023, and sentenced to four years in prison. He got out in late 2025. And then, apparently, he did it again.
Van der Stap gave journalist Brian Krebs an interview in September 2026, presenting himself as reformed — dealing with lawsuits, making amends, working as an offensive security professional. Less than two weeks later, he stopped responding to messages entirely. Dutch authorities had arrested him around September 16 on suspicion of helping ShinyHunters pull off a massive breach of Odido, the Netherlands' largest mobile telecom, stealing data on 6.2 million Dutch people. Investigators had released an audio recording of the social engineering call — where a Dutch-speaking hacker tricked an Odido employee into handing over access — and were asking the public to identify the voice.
What followed the arrest was almost theatrical. ShinyHunters publicly backed their arrested member, announced they had funded his lawyer, and called Dutch police "incompetent" and "irrelevant." Then, as if to prove a point, they escalated — reportedly stealing data from the FBI and extorting the Russian ransomware gang Cl0p. This is retaliation hacking, and it's a tactic increasingly used to intimidate law enforcement into backing off.
The story is a reminder that cybercriminals don't always look like criminals. Van der Stap had a LinkedIn profile, a respectable job title, and a compelling redemption narrative. For regular people, the lesson is harder to pin down — but for organizations, it underscores why background checks, ongoing monitoring of privileged access, and a culture of healthy skepticism matter. The next person with insider access to sensitive systems might be telling a very polished story about who they used to be.