Cyber Security News

Hacking Editorial Brief — October 7, 2026

ASOS Breach Attribution Emerges; Snowflake Repository Compromised

The ASOS security incident that surfaced yesterday through push notification extortion now has an attribution claim. A group identifying itself as "Xuanye group" claimed responsibility for compromising ASOS's Snowflake cloud data repository, according to messages sent to app users. The Snowflake platform detail provides the first technical specificity about the breach vector, following yesterday's unusual public notification tactic that bypassed traditional extortion channels. ASOS shares continued sliding as the incident develops, though the company has not confirmed the attackers' claims or disclosed what data may have been accessed from the repository.

Critical Flaw in Progress AI Gateway Enables Command Injection

Progress Software disclosed CVE-2026-91140, a critical command injection vulnerability in its DataDirect GenAI gateway product that allows malicious OpenAPI or Swagger documents to execute arbitrary operating system commands through AI agents. The flaw represents a new class of supply chain risk where document parsing by AI-integrated systems creates execution pathways. Separately, the BYOD ransomware group claimed to have breached Trump Mobile, leaking 3,615 customer records including names, email addresses, phone numbers, and home addresses. A former infrastructure engineer was sentenced to 32 months in prison for deploying ransomware-style malware that locked over 3,000 devices on his employer's network, marking one of the more significant insider threat prosecutions this year.

Japan's business community reported a 50 percent year-over-year increase in AI-assisted corporate hacking attempts, adding regional context to the broader surge in AI-enabled attack campaigns documented across multiple jurisdictions.

Sources: NHK World · Mighty 790 KFGO · TechRadar · Cybersecurity News · BleepingComputer