💥 BREACHES & INCIDENTS
- DTU breach via compromised credentials exposes data of up to 200,000 people
Hackers used compromised credentials to access DTU's identity management system and download personal data of up to 200,000 current and former users.- Affects current and former DTU employees, students, guests, and external partners connected to the university since 2003.
- Attackers logged into DTUBasen, DTU's identity and access management system, using compromised user profiles and downloaded a large amount of data spanning over two decades.
- Potentially exposed data includes Danish CPR numbers, full names, home addresses, profile pictures, work emails, job titles, office locations, and next-of-kin details for ~40,000 active and ~160,000 former users.
- DTU cannot determine exactly what was downloaded or how many people were affected; the attack was contained on October 2, 2026, and reported to the Danish Data Protection Agency.
- No threat actor has been identified; DTU warns the data could enable identity fraud and more convincing phishing attacks.
🕵️ RESEARCH & DEEP DIVES
- MI5 alert: China's MSS used CGTRI front to fund research by 100+ UK-linked academics
MI5 has issued a rare public espionage alert warning that a Chinese front organization funded research by more than 100 UK-linked academics to boost Chinese intelligence capabilities.- Applies to UK universities, academics, and research institutions collaborating with Chinese-funded projects.
- CGTRI (China General Technology Research Institute / China Academy of General Technology) is assessed as a front for China's Ministry of State Security (MSS).
- More than 100 UK-linked academics contributed to CGTRI-funded projects, in some cases unaware of the funding source.
- Targeted research areas include AI, cybersecurity, covert communications systems, and steganography.
- Continued collaboration could be prosecuted under the National Security Act 2023 (sections 3 and 17); China's embassy called the accusations 'imaginary and purely fabricated'.
📋 ADVISORIES
- NSA accelerates post-quantum cryptography timeline for National Security Systems to 2027
The NSA has announced an accelerated timeline requiring all National Security Systems to support post-quantum cryptography starting in 2027.- Applies to US government National Security Systems, including telecommunications, weapon systems, and intelligence platforms.
- Starting in 2027, all new commercial NSS must be capable of supporting quantum-resistant algorithms; legacy systems that cannot support PQC must be phased out by 2030.
- The move accelerates the prior CNSA 2.0 timeline and outpaces Cloudflare, Google, and Microsoft, which target 2029 for PQC adoption.
- The NSA warns of harvest-now-decrypt-later collection, where adversaries gather encrypted data today to decrypt once quantum computers can break RSA and ECC.
- The announcement is framed under Executive Order 14412 and restates CNSS Policy 15; no specific vulnerabilities or exploits were detailed.
📋 ADVISORIES
- 📄 Source for Microsoft reissues September 2026 Exchange Server V2 updates adding fix for CVE-2026-96940 — techcommunity.microsoft.com
🔓 CVEs & KEV
CVE-2026-105115 — OpenIdentityPlatform OpenAM — CVSS 8.8 — OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RP...
CVE-2026-105119 — OpenIdentityPlatform OpenAM — CVSS 7.6 — OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid FlowsOpenAM...
CVE-2026-105121 — OpenIdentityPlatform OpenAM — CVSS 6.9 — OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Real...
CVE-2026-105120 — OpenIdentityPlatform OpenAM — CVSS 6.9 — OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoin...