Dutch Police Arrest 24-Year-Old in ShinyHunters Cybercrime Probe On September 28, 2026, Dutch authorities confirmed the arrest of a 24-year-old Amsterdam man as part of an investigation into ShinyHunters, the prolific extortion group behind a wave of high-profile breaches in 2026. The suspect, identified by his employer as Pepijn van der Stap, worked as an offensive-security lead at Amsterdam-based cybersecurity firm Neo Security. His arrest followed a dramatic raid involving stun grenades at the company’s office, according to reports from Reuters and KrebsOnSecurity. Van der Stap, who previously used the online handle "Umbreon" and had a prior cybercrime conviction, is alleged to have ties to ShinyHunters’ operations. However, the group itself denied his affiliation in a statement to NL Times, creating a contradiction between law enforcement suspicions and the group’s claims. ### Key Details of the Investigation - Arrest Timeline: The suspect was reportedly detained around September 16, with Dutch police publicly confirming the arrest on September 28. He is scheduled to appear in a Rotterdam court, though no formal charges have been announced. - Suspected Links: Dutch investigators are examining a possible connection to the February 2026 cyberattack on Odido, a major Dutch telecom carrier, for which ShinyHunters claimed responsibility. However, no direct evidence ties the suspect to the FBI breach claimed by ShinyHunters shortly after his arrest involving the agency’s job-application portal (apply.fbijobs.gov) and the alleged theft of 5,000+ employee records. - Employer’s Role: Neo Security’s CEO, Benjamin Korper, publicly confirmed the raid and the suspect’s identity, a rare move in cybercrime cases where companies typically avoid comment. ### ShinyHunters’ 2026 Campaigns The group has been one of the most disruptive extortion crews this year, targeting: - Odido (February 2026) – Dutch telecom breach. - Oracle PeopleSoft – Exploiting a CVSS 9.8 vulnerability via a WAF bypass. - Rockstar Games – Leaking 8.1GB of anti-cheat source code. - FBI systems – Multiple claims, including the job-portal breach and alleged 3TB data theft. ShinyHunters operates differently from traditional ransomware groups, favoring data theft and extortion over encryption. Reports suggest overlap with Russian ransomware group Cl0p, reflecting a broader trend of loosely affiliated cybercriminal networks sharing infrastructure. ### Unresolved Questions & Next Steps - Legal Process: Dutch prosecutors must decide whether to file formal charges, with updates likely emerging from the Rotterdam court proceedings. - FBI Breach Link: No evidence currently connects the suspect to the FBI incident, leaving the group’s claims unverified. - Industry Impact: The case has reignited debates over background checks for offensive-security professionals, particularly those with prior convictions. The arrest marks a rare law enforcement success against ShinyHunters, though the group’s denial and the lack of confirmed charges leave key aspects of the case unresolved. Dutch authorities continue to investigate, with the telecom breach serving as the most concrete lead.

AI-Powered Cyberattacks Surge as Hackers Outpace Defenses In 2025, cyberattacks have escalated at an unprecedented rate, fueled by AI’s ability to automate and refine malicious software. Cybersecurity firm Palo Alto Networks reported a fourfold increase in daily attacks among its clients compared to 2024, with hackers leveraging AI to develop adaptive malware, accelerate data theft, and bypass traditional defenses. Former Yahoo and Facebook security chief Alex Stamos warned of a "crazy amount of offensive activity," noting that organizations including banks, hospitals, and government agencies are being breached daily. The shift stems from AI’s dual role in both offense and defense. Advanced models like Anthropic’s Claude Mythos Preview and OpenAI’s GPT-5.5-Cyber have demonstrated near-human hacking capabilities, prompting their restricted release to select government and corporate partners. These tools have already uncovered thousands of long-standing vulnerabilities in open-source software, with Mozilla using Mythos to patch 400+ bugs in Firefox in April alone 20 times its typical monthly rate. Yet, despite these efforts, the window to respond to threats has collapsed: Moody’s Ratings found that attackers now exploit known vulnerabilities in just 44 days, down from over 700 days in 2020. The threat landscape is further complicated by open-source AI hacking tools, which lower the barrier for less skilled criminals. The hacking group ShinyHunters, linked to AI-assisted attacks, recently disrupted Canvas (impacting thousands of schools) and breached Oracle’s HR system, potentially exposing data from over 100 organizations. Meanwhile, the U.S. government has restricted public access to Mythos, limiting its defensive applications. Legacy systems and under-resourced sectors such as hospitals, utilities, and municipal agencies are particularly vulnerable. Many rely on outdated code written by retired or deceased developers, lacking the funds or expertise to modernize. Hospitals, already targeted by ransomware, face heightened risks as AI amplifies attacks. Experts warn of potential blackouts, banking disruptions, or large-scale data breaches in the coming years, with Anthropic estimating that a single attack on one of its partners could affect 100 million people. While AI-driven security tools offer some defense, the pace of innovation has outstripped preparedness. Mozilla’s CTO, Raffi Krikorian, compared the urgency to Y2K-scale upgrades, but with months not years to act. As AI continues to evolve, the cycle of discovery and exploitation may persist, leaving organizations and individuals scrambling to adapt.

Cybercrime Crew’s Exposed Server Reveals Mass Webshell Operation Targeting 1.4 Million Sites A cybercrime group, tracked as WP-SHELLSTORM, inadvertently exposed its operations for three weeks after leaving an unsecured server online. The incident, discovered by researchers at SOCRadar and Ctrl-Alt-Intel, provided an unprecedented look into a webshell access brokerage a scheme where attackers compromise websites en masse, install backdoors, and sell access to other criminals. ### The Exposure On June 11, 2026, SOCRadar identified an unprotected server (IP: 137.175.93[.]126) hosting 800MB of data, including: - Hacking tools (exploit scripts, webshells) - Activity logs (command histories, scan results) - Target lists naming 1.4 million websites (WordPress, Joomla, and others) - Command-and-control (C2) configurations The server, rented in the U.S., was left open due to a Python web server left running for 22 days a simple but costly oversight. Ctrl-Alt-Intel independently analyzed the same directory, publishing findings on June 22, before SOCRadar’s July 9 report. ### The Attack Method The group exploited 27 known vulnerabilities, primarily in WordPress plugins, to deploy webshells small scripts granting remote control over compromised servers. Key flaws included: - Breeze caching plugin (CVE-2026-3844) – Exploited against 45,000+ sites, successfully backdooring 17,000+ (only effective with a non-default setting enabled). - Joomla JCE editor (CVE-2026-48907) – Targeted 560,000+ sites but only breached 77. - Other WordPress plugins (e.g., ThemeREX Addons, Simple File List, WP File Manager). The attackers used FOFA, a Chinese search engine for internet-connected systems, to build target lists. Their toolkit included: - down.php – A heavily obfuscated webshell derived from BestShell (open-source Chinese malware). - VShell – A stealthy backdoor disguised as a kernel process ([kworker/0:2]) to evade detection. ### Compromise Scale While the 1.4 million figure represents targets, not breaches, researchers confirmed: - Ctrl-Alt-Intel: 25,195 sites with evidence of compromise. - SOCRadar: 5,700+ active webshells. ### Earlier Corporate Espionage Campaign Before the WordPress spree, the same group ran a quieter operation in May 2026, targeting Java-based corporate systems via a Nacos configuration server flaw (CVE-2021-29441). They extracted: - 613 configuration files from 11 systems across nine companies (fintech, e-commerce, logistics, gaming, electronics). - Cloud credentials (AWS, Alibaba, Oracle, Tencent, DigitalOcean). - Database passwords and Alipay RSA private keys. SOCRadar suggests this was a "funding round" before scaling up the higher-volume webshell operation. ### Attribution & Sloppy Tradecraft Researchers assess with medium-to-high confidence that the group is Chinese or Chinese-speaking, citing: - Simplified Chinese in code and command logs. - Use of FOFA (requiring a Chinese phone number for registration). - Tools like Godzilla and VShell, common in Chinese-speaking cybercrime forums. Despite a sophisticated toolchain, the group made basic errors: - Left the server unprotected for weeks. - Exposed a FOFA config file, traceable via law enforcement. - Failed to sanitize command histories, revealing the full operation. When alerted, the group deleted log entries between July 2–4, but the damage was already done. ### Broader Implications WP-SHELLSTORM stands out not for its technical sophistication, but for its scale and opportunism. Using publicly known vulnerabilities and automated scanning, the group compromised thousands of sites without needing zero-days. The incident mirrors a March 2026 exposure of Russia’s APT28 (Fancy Bear), where an open directory revealed phishing tools and logs. In both cases, human error not advanced hacking led to the unraveling of major cybercrime operations.

ShinyHunters Claims FBI Breach, Denies Harassment Tactics in Defiant Post The extortion group ShinyHunters has publicly accused the FBI of spreading "false information" about its operations, claiming to have breached the agency in retaliation. In a lengthy post on its leak site, the group targeted FBI Cyber Division Assistant Director Brett Leatherman and Director Kash Patel, demanding the removal of a May 2026 FBI/IC3 advisory that alleged the group engages in harassment tactics including threatening messages, swatting, and exaggerated claims of possessing compromising material. ShinyHunters denied all such allegations, calling them "disinformation" and asserting it has never conducted swatting attacks, sent threats to victims' families, or falsely claimed to hold sensitive personal data. The group also rejected associations with "The Com", a decentralized cybercrime network, labeling it a fabrication by the cybersecurity industry. As proof of its breach, ShinyHunters claimed to have accessed sensitive data on nearly all FBI agents and job applicants, including names, home addresses, phone numbers, and details about spouses. 404 Media reportedly verified a sample of the data, which included information on roughly 5,000 agents, though the full extent of the breach remains unconfirmed. The group also defaced the FBI’s jobs website (FBIjobs.gov), though the agency stated it is investigating the claims without confirming a full breach. The FBI has not yet disclosed what data may have been exposed or who might be affected. The advisory in question, titled "ShinyHunters: Cyber Criminal Group Attacks Learning Management System", was issued on May 15, 2026, and warned of the group’s alleged tactics though ShinyHunters disputed its classification as a "FLASH report", noting it was labeled a Public Service Announcement (PSA). The group’s post framed the breach as a First Amendment exercise, insisting it was not financially motivated but rather a correction of perceived defamation. It also threatened journalists it accused of spreading "false narratives" about its operations, offering to provide its side of the story via an OnionMail address. The FBI has not publicly responded to the claims beyond acknowledging the investigation into unauthorized activity on its systems.

AI-Driven Surge in Vulnerability Disclosures and Exploitation Reaches Record Highs in 2026 Google’s Threat Intelligence Group (GTIG) reported a dramatic spike in vulnerability disclosures, with numbers doubling from 5,045 in January to 10,740 in August 2026 surpassing annual totals from 2025. The year has already seen 141 exploited vulnerabilities, exceeding last year’s 127, as threat actors increasingly leverage AI to accelerate discovery and weaponization. The rise is attributed to rapid, targeted exploitation of high-risk flaws rather than a surge in zero-day attacks. Hackers are using AI tools to analyze patches, vulnerability disclosures, and proof-of-concept (PoC) code to automate the weaponization of n-day vulnerabilities patched flaws that remain exploitable due to delayed updates. GTIG researchers noted that AI-assisted techniques are making it easier for attackers to identify and exploit critical bugs at scale, particularly in enterprise and perimeter systems. A key example is CVE-2026-1731, a high-severity flaw in BeyondTrust software discovered by Hacktron AI, an autonomous research agent. Within four days of disclosure, multiple threat clusters exploited the vulnerability in initial-access campaigns, deploying malware like SNOWLIGHT, SPARKRAT, and cryptominers for privilege escalation and data exfiltration. The incident underscores how AI-driven research agents are uncovering and weaponizing high-impact vulnerabilities faster than ever. Most AI-discovered flaws fall into medium or high-risk categories, defined by their potential for direct, large-scale exploitation without significant mitigating factors. Vendors like Totolink and Oracle have been frequent sources of disclosed vulnerabilities, while 14% of exploited flaws targeted edge and security appliances, reflecting threat actors’ focus on exposed enterprise services. The trend aligns with broader industry data: CISA reported over 67,000 new CVEs in 2026, projecting a year-end total of 96,000 a 263% increase in annual submissions since 2020. The first three months of 2026 alone saw one-third more CVEs than the same period in 2025, signaling an accelerating pace of vulnerability discovery and exploitation.

US tech company F5 confirmed a data breach in which nation-state attackers stole the source code and vulnerability information related to its BIG-IP family of networking and security products. BIG-IP is a critical infrastructure component used by enterprises for traffic management, load balancing, and security, making this breach particularly severe. The stolen data could enable adversaries to identify and exploit undiscovered flaws in BIG-IP systems, potentially leading to supply-chain attacks, unauthorized network access, or large-scale disruptions in organizations relying on F5’s solutions. The breach underscores the escalating risks of state-sponsored cyber espionage targeting foundational IT infrastructure, with implications for global cybersecurity resilience. F5 has not disclosed whether customer data was compromised, but the theft of proprietary code and vulnerability details poses a long-term threat to its product ecosystem and the broader digital supply chain.

Russian Cybercriminal Group Exposes 74,000 Fortinet Firewall Credentials in Massive Leak A Russian-speaking cybercriminal group inadvertently exposed credentials from nearly 74,000 Fortinet firewalls and VPN gateways worldwide after leaving the data unsecured on a server. The breach, discovered by security researcher Volodymyr “Bob” Diachenko over the past weekend, was confirmed by other researchers, including Kevin Beaumont, who verified the authenticity of the leaked login details. The compromised data, dubbed FortiBleed, includes configuration files containing sensitive information visible only from the devices themselves. The group obtained the credentials through automated large-scale harvesting, intercepting SSL VPN authentication hashes, cracking them using a 45-GPU cluster via Hashtopolis, and leveraging the passwords to infiltrate Active Directory environments. Researchers at Hudson Rock identified 73,932 unique firewall URLs across 194 countries, with many devices exposing their FortiGate Management Interface to the internet. While Fortinet previously addressed password storage vulnerabilities in early 2025 by adopting PBKDF2 with randomized salt, many devices still use the older, weaker SHA-256 with salt method, making them susceptible to brute-force attacks. The leaked data appears to include both recently harvested credentials and older collections from prior breaches. The breach impacts high-profile organizations, including Samsung, Siemens, Foxconn, Oracle, Accenture, DHL, Infosys, and Fortinet, as well as government agencies and critical infrastructure sectors. Notably, four organizations spanning Japan, Taiwan/Vietnam, Iraq, and Turkey were fully compromised, with a Turkish NATO defense contractor suffering exfiltration of classified defense documents. Fortinet attributes the leak to exploited vulnerabilities and brute-force attacks, though the exact timeline of data collection remains unclear. Organizations using Fortinet devices are advised to assume compromise if their domains or IPs appear in the exposed dataset, requiring credential rotation, MFA enforcement, and system upgrades to mitigate further risks.