[APAC] Bengaluru cyber police arrested three suspects after tracing an alleged online investment fraud in which a resident lost about ₹93.58 lakh, with investigators identifying more than 500 mule bank accounts and links extending to Kolkata, Hong Kong and California. Transaction records, account-opening data and cross-border digital traces are now central to mapping the fraud infrastructure beyond the accounts that directly received the victim's payments.

[APAC] Mumbai's West Region Cyber Police arrested three men accused of operating an OTP-farming network that supplied Indian WhatsApp numbers to overseas fraudsters, seizing 100 phones, 669 SIM cards and related equipment while tracing ₹22.30 lakh in suspected proceeds. Device inventories, account movements and messaging artefacts are being used to establish how locally registered numbers were provisioned, controlled and connected to investment-fraud operations linked to Cambodia.

[EMEA] The RNLI told supporters that personal information may have been taken in a cyberattack affecting Beacon CRM, the third-party platform it uses for supporter records, after the provider disclosed an incident involving customer data. The charity said there was no current evidence of misuse or publication, leaving investigators to determine confirmed exfiltration scope, affected record categories and whether attacker assurances about deletion can be independently verified.

[EMEA] CrowdSec said an attacker copied about 170 private GitHub repositories using a still-valid OAuth token associated with a recently departed employee whose laptop had been compromised through the earlier TanStack npm supply-chain attack. Its investigation reconstructed a nine-minute cloning window, exposed offboarding and token-governance weaknesses, and found limited personal information in the archive, underscoring how endpoint compromise can remain operationally significant long after the initial malicious-package event.

[AMER] CISA added Linux kernel vulnerability CVE-2025-39682 to its Known Exploited Vulnerabilities catalogue on 18 September after evidence of exploitation, directing US federal agencies to remediate by 21 September. The flaw affects TLS receive-path handling of zero-length records, and the CISA entry also requires forensic triage under BOD 26-04, making exposure assessment and evidence preservation part of remediation rather than a patch-only exercise.

[GLOBAL] Patchstack reported CVE-2026-84434 in the Gravity Forms WordPress plugin as an unauthenticated arbitrary-file-upload vulnerability affecting versions through 3.1.0.4, with version 3.1.1 identified as patched and exploitation reported. Because malicious uploads can lead to remote code execution, defenders should preserve web, application and file-system evidence while establishing whether vulnerable forms were externally reachable and whether unexpected execution artefacts appeared before remediation.

[APAC] Police in Deoghar arrested four men suspected of operating payment scams by impersonating customer-care representatives and sending counterfeit APK files intended to control victims' devices, seizing six phones and four SIM cards. Investigators are examining the devices, subscriber records and financial flows to establish victim numbers, malware use and responsibility, linking specific accounts and transactions to each suspect rather than relying on possession of the handsets alone.

[EMEA] Ukrainian authorities said a multi-agency operation involving the Bureau of Economic Security, State Border Guard Service and Cyber Police uncovered an alleged cash-conversion network handling nearly UAH 500 million a month, with around 50 searches across Kyiv, Kharkiv and Odesa. Investigators reported seizing substantial cash and issuing notices of suspicion, while recovered financial and digital records will be central to reconstructing transaction chains and assigning individual roles.

[APAC] Pakistan's National Cyber Emergency Response Team and Ministry of IT issued a National Cybersecurity Handbook setting baseline security rules for public-sector staff, including restrictions on personal email, unauthorised devices, commercial cloud services and public AI tools. The guidance also emphasises early reporting of ransomware notes, suspicious messages, unauthorised access attempts and unexplained file changes, creating clearer expectations for evidence retention and escalation when government systems show compromise.

[AMER] NIST announced more than US$1.7 million in cooperative agreements for nine cybersecurity workforce projects across eight US states, aligning employer needs with education and training programmes built around the NICE Framework. The awards reinforce the policy role of common workforce standards by linking practical learning, apprenticeships and community partnerships to defined cybersecurity competencies that organisations can use when building investigative, resilience and technical teams.