Teen Hacker "Rey" Arrested — He Mocked the FBI and Targeted Boeing
Friday, October 9, 2026 · 5-minute read
A teenager from Amman, Jordan suspected of leading the ShinyHunters extortion gang has been detained and is reportedly cooperating with the FBI. The suspect, who goes by the handle "Rey," was caught while his group was trying to extort Jeppesen ForeFlight — a former Boeing subsidiary that handles digital aviation navigation tools. Investigators say the stolen data could pose real safety and security risks to aviation operations.
↗ Krebs on SecurityGerman authorities arrested a Russian national suspected of being a core member of the Qilin ransomware group. He was extradited from Japan earlier this month. Qilin has been linked to attacks on hospitals, schools, and businesses across Europe and beyond.
↗ BleepingComputerThe FBI seized seven web domains used by Flax Typhoon, a Chinese state-sponsored hacking group, to run two hacking tools called MicroScan and FishHub. These tools were used in attacks that broke into critical infrastructure — think power grids, water systems, and communications networks — across the US and around the world. This is part of an ongoing US government effort to disrupt Chinese cyber operations.
↗ BleepingComputerAttackers are actively exploiting two flaws in AhsayCBS, a popular backup management tool used by businesses. By chaining the two bugs together, criminals can skip right past the login screen and run any command they want on the server. They're using that access to install cryptocurrency mining software disguised as Microsoft Edge — so it looks harmless at a glance. The CVE numbers were only published on October 4th, and attackers were already hitting systems by October 7th — just three days later.
A maximum-severity flaw in SonicWall SMA1000 remote access appliances is already being exploited in the wild — just three days after SonicWall released a patch on Tuesday. This type of device sits at the edge of corporate networks, making it a high-value target: compromise it and you potentially have a door into the entire organization.
This flaw lets an attacker take full control of a SonicWall SMA1000 appliance without needing a username or password. Since these devices act as the gateway into corporate networks, a successful attack could give criminals access to everything behind it — internal files, emails, systems, you name it. Attackers are already exploiting it right now.
Status: Patch available — update immediately to the version released October 6, 2026.
This bug in AhsayCBS backup software lets a remote attacker run any command on the server — no login required. When chained with a second flaw (CVE-2026-105133), which bypasses the password check, an attacker has complete control over the machine. Criminals are already using this combo to install crypto miners on victims' servers.
Status: Patch available — update AhsayCBS immediately. CVE details were only published October 4, 2026.
Security researchers published a working exploit called "AnyPwn" for a flaw in the Linux version of AnyDesk remote desktop software. The bug lets an attacker connect to your machine and gain full root — or administrator-level — control before you've approved anything. AnyDesk quietly patched it back in June, describing it only as "a bug that could lead to a crash" with no security warning. Now that a working exploit is public on GitHub, the risk of real-world attacks just jumped significantly.
Status: Patch available — update AnyDesk Linux to version 8.0.3 or newer (latest is 8.1.0). No CVE was ever assigned by AnyDesk.
Anthropic — the company behind the Claude AI — launched a free tool called OSS Scanner to help find security flaws in open-source software. The tool automatically scans projects using Claude AI models, generates security reports, and does it all without needing a human to review every result first. That means faster, more frequent scans for projects that previously couldn't afford them. Anthropic says it will select projects using criteria similar to Google's existing OSS-Fuzz program, which already helps find bugs in critical open-source code. This matters because open-source software is the invisible plumbing beneath countless apps, websites, and services — keeping it secure protects everyone.
If you wrote this as a thriller plot, your editor would tell you to tone it down. A teenager in Jordan — whose father allegedly works for Royal Jordanian Airlines — built one of the world's most prolific data theft operations, hacked the FBI, tried to extort a Boeing aviation subsidiary, and then started posting taunting memes on Twitter while the feds closed in. This week, it all caught up with him.
The suspect, known online as "Rey" (Spanish for "king"), is believed to be the leader of ShinyHunters. The group made headlines for stealing data from dozens of organizations by exploiting a flaw in Oracle PeopleSoft — software companies use to manage HR, payroll, and hiring. ShinyHunters got so bold that they tried to break into the FBI's own systems. When that didn't fully work at first, they found a clever workaround to bypass the security rules put in place to stop them — and eventually succeeded, exposing sensitive data on more than 5,000 FBI personnel, including medical and psychiatric records. Rey then went on Twitter to mock both the FBI and a rival criminal gang called Cl0p, apparently believing he was untouchable. He was not. Jordanian authorities detained him while his group was actively trying to extort Jeppesen ForeFlight, a navigation software company that Boeing sold last year for over $10 billion.
For regular people, the ShinyHunters story is a reminder of how much sensitive data sits inside the HR and payroll software your employer uses every day. The vulnerability they used wasn't exotic — it was in widely used enterprise software, and many organizations were slow to apply the fix. When that data leaks, it isn't just names and email addresses. In the FBI's case, it included which unit agents worked in, plus medical and mental health records. That kind of detail can be used to spearphish or blackmail real people.
The FBI has already fired an Accenture contractor for failing to patch the FBI's recruitment website in time. Rey's arrest is a major win for law enforcement, but ShinyHunters operated as a loose network — not a tidy organization with a single leader. Watch for the FBI to use Rey's reported cooperation to identify and pursue other members. The group's infrastructure, brand, and methods won't vanish overnight just because its most visible figure is now in custody.