Full story
Ledger Wallet Implant Linked to $93 Million Theft
A hidden implant found in Ledger hardware wallets has been linked to approximately $93 million in stolen funds. The security firm Bloom identified the malicious software after reports of drained cryptocurrency wallets emerged on October 9, 2026.
Ledger confirmed that the compromised devices were sold through CryptoBilis, a reseller based in Southeast Asia. The company stated that confirmed cases of the implant involve units distributed via this specific channel. Bloom researchers discovered the implant while investigating the reported wallet drains.
Npm Trusted Publishing Flaw Exposes 1,500 Packages
In a separate security incident, researchers found that npm’s Trusted Publishing feature allowed attackers to push new versions of packages without possessing the original credentials. The exploit relied on registering GitHub repository names that maintainers had abandoned.
Bloom Security counted more than 1,500 npm packages exposed to this takeover method. The vulnerability allowed attackers to hijack packages by claiming ownership of unused repository names on GitHub. GitHub stated it has shipped fixes for the issue.
CEOs Rank Cyber-Enabled Fraud Above Ransomware
Akshay Joshi, head of the Centre for Cybersecurity at the World Economic Forum, stated that chief executive officers now rank cyber-enabled fraud above ransomware as their top cybersecurity concern. This assessment was cited from findings in the Global Cybersecurity Outlook 2026.
Joshi discussed how artificial intelligence, geopolitics, and industrialized fraud are changing the cyber risk landscape in an interview with Help Net Security. The outlook highlights a shift in executive priorities toward fraud facilitated by advanced technology.
Microsoft Patches Mark of the Web Bypass
Microsoft addressed an exploited vulnerability in its Patch Tuesday update for CVE-2026-96951. The flaw allowed attackers to bypass the Mark of the Web security feature, which is designed to warn users about files downloaded from the internet.
The patch was part of a broader release that included fixes for over 1,400 security bugs. Microsoft released the updates to address the active exploitation of the Mark of the Web.
Supply Chain and Infrastructure Attacks Disrupt Retail
Beyond software vulnerabilities, European food retailers faced significant operational disruptions from two separate cyberattacks. In France, supermarket chains experienced tampering with fridges and freezers, compromising cold storage infrastructure.
Simultaneously, Dutch multinational Ahold Delhaize reported a disruption at its stores in the Netherlands and Belgium stemming from an unspecified "security issue." These incidents highlight the tangible impact of cyber threats on physical retail operations.
Workforce Gaps and Remediation Challenges Persist
The cybersecurity labor market showed signs of contraction, with US employers posting 235,786 job openings from January through September 2026. According to staffing intelligence firm CyberSN, which pulled data from JobSpikr, this figure represents a four-year low in hiring activity.
Industry experts argue that remediation remains difficult due to business pressures and the critical nature of revenue-generating systems. Kunal Modasiya, Senior VP and GM at Qualys, suggested that security teams should focus on the entire remediation workflow rather than prioritizing speed alone.
Emerging Risks in AI and Public Administration
Michael Scott, CISO at Immuta, predicted that critical AI incidents will occur at major enterprises within the next 18 months. He argued that AI agents should be treated as lower-trust identities that do not inherit all user permissions to mitigate risk.
In the public sector, David Fuhr, CTO at intcube, highlighted a security cohort where 27 municipalities hardened Windows Server and Active Directory together over a 12-week period. This collaborative approach demonstrates efforts to secure government infrastructure against evolving threats.
New Tools for AI Agent Security
AWS released Strands Box, an open-source sandbox designed for AI agents. The tool pairs operating-system isolation with rules that weigh prior agent actions to enhance security.
The software is currently in developer preview on Macs with Apple silicon, with Linux support planned for future release. This release addresses the growing need for secure environments as AI agents become more integrated into enterprise workflows.
