Week of 12 October 2026
Latest issueAn attacker used Claude Code and an open-source pentest tool to hit at least five South Korean banks, and their own exposed AI logs gave them away. The FBI and Secret Service say FortiBleed credentials, covering more than 86,000 devices, are now feeding INC/Lynx and Payload ransomware affiliates. Both stories land on the same point: SOC speed and credential hygiene decide outcomes.
A browser-in-the-browser phishing kit is relaying Okta and Google MFA codes to a live operator, with Island researchers seeing submissions from about 200 addresses on a single frontend. Separately, FortiBleed credential abuse covers more than 86,000 devices and the FBI is telling victims to adopt phishing-resistant MFA. The pattern is clear: anything that issues a credential can be phished, relayed or stolen.
The UK ICO secured data protection commitments from ten leading AI developers, including OpenAI, Anthropic, Google and Microsoft, and opened an agentic AI evidence call closing 20 November. Meanwhile, more than 44,000 people have objected under Article 21 to NHS England's Palantir platform, and the EU AI Act high-risk deadline now sits at December 2027.
A Norwegian startup's $17,600 Claude bill on Microsoft Foundry, which its Azure credits did not cover, shows how third-party AI models on hyperscaler marketplaces are creating billing surprises. Microsoft also launched a low-cost decision model priced at $0.042 per million input tokens, and Flexera's data shows cloud waste rising for the first time in five years.
Nine in ten VMware customers are now weighing an exit because of licensing costs, and Broadcom's partner purge is pushing IBM to hand hundreds of cloud customers to another provider. Every hypervisor decision is also an operating system decision, and the Linux estate underneath is where the next cost review lands.
Microsoft is giving Copilot access to the entire Windows file system and launching Nvidia N1X Surface hardware, which turns endpoint governance into a live decision for every managed fleet. Outlook is also blocking two more attachment types from November.
The CBUAE transition window closed on 16 September with no blanket extension, so the AED 1 billion penalty regime is now live and enforcement can name institutions publicly. Technology providers and API firms that serve UAE banks now need either a licence or a documented CBUAE opinion that they are out of scope. AI governance evidence, not policy documents, is what supervisors will ask for next.
The UAE Cyber Security Council is shifting national defence from response to prevention, with sovereign AI tooling and a financial-sector defence framework now in play. Attack volumes remain high at up to 800,000 a day, and officials are warning organisations not to read quiet spells as an all-clear. For GCC buyers, the signal is clear: homegrown capability and evidence of resilience will matter in procurement.
Download all eight briefs
Enter your details and we'll email you links to all eight Word documents for the week of 12 October 2026. Free to read, no obligation.