iRhythm said a completed forensic investigation found that unauthorised individuals accessed and downloaded data from third-party-hosted business applications between 3 and 8 June, and the US digital-health company began notifying affected people on 2 October. The reviewed data includes patient names, contact details, account and device serial numbers, insurance numbers, service dates and dates of birth, while iRhythm said its clinical systems, products and patient safety were unaffected.

Delhi Police arrested two people after investigating a ₹6 lakh “digital arrest” fraud initiated through a threatening WhatsApp video call in India, according to local reporting published on 5 October. Investigators linked a bank account used in the case to nearly ₹50 lakh in transactions and at least ten cybercrime complaints from multiple states, indicating that account tracing is now exposing a potentially broader fraud network.

Jordanian authorities detained Saif al-Din Khader, described by sources as a suspected ShinyHunters member, while two sources told Reuters that he is cooperating with the FBI and other investigators seeking alleged associates. Reuters could not establish the circumstances of his detention, and the FBI did not confirm the specific arrest, so the cooperation claim remains source-based rather than an official law-enforcement finding.

Andhra Pradesh counter-intelligence officers arrested Indian Navy sailor Pradeep Mukherjee in Coimbatore after investigators detected suspicious digital activity and placed him under surveillance, Indian officials told The New Indian Express. Officials allege that a Pakistani intelligence operative contacted him through social media and obtained classified maritime information, but the espionage allegations remain under investigation and have not been established in court.

Pantheon said its continuing investigation found that a small number of customer websites had been compromised through weaknesses in their own applications and then used to interact with the hosting platform’s services. The company said affected customers were undergoing site cleanup and credential rotation, additional protections had been deployed, and it had found no evidence that other customers’ sites or data were accessed.

California retailer Harborside notified customers that an unauthorised person accessed part of IDScan.net’s VeriScan cloud environment between 4 April and 2 September, potentially involving identification data collected during retail verification. Harborside said its own systems were not involved and that the potentially affected information depended on what was scanned during verification, while IDScan’s investigation remained ongoing and the notice did not establish misuse of customer information.

NIST’s vulnerability database published CVE-2026-71885 for Bouncy Castle Java before version 1.86, where its Messaging Layer Security implementation failed to bind an X.509 credential to the LeafNode signature key. Under deployments admitting external commits without an independent credential check, an attacker could be accepted under another party’s identity and subsequently decrypt or send group messages, while basic-credential deployments are unaffected.

CVE-2026-92084 affects Beaver Builder Page Builder for WordPress through version 2.11.0.5, where insufficient validation can allow unauthenticated arbitrary shortcode execution under specific Sidebar module and widget conditions. The published record requires attacker-controllable widget text, such as an approved comment in a Recent Comments widget, so investigators should distinguish vulnerable installations and prerequisite configurations from evidence that exploitation actually occurred.

Pune’s Wanowrie Police arrested five people in India after investigating bank accounts allegedly opened or supplied for cyber-fraud transactions, with local reporting linking the case to approximately ₹1.80 crore. The arrests followed financial and account-tracing work intended to identify how fraud proceeds moved through mule infrastructure, while the allegations remain subject to investigation and judicial determination rather than established criminal findings.

Singapore Police said a 40-year-old man would be charged over suspected money-laundering activity linked to a government-official impersonation scam in which a victim handed S$6,000 to a collector. Cyber Command officers identified and arrested the man on 1 October and seized a fake anti-corruption pass, a mobile phone, documents and clothing as exhibits, while police said he is also suspected of involvement in similar cases.

US President Donald Trump appointed Director of National Intelligence Jay Clayton to lead a new federal artificial-intelligence task force intended to coordinate government engagement with industry, consumers and public-interest groups. The body will also include senior officials from the Federal Trade Commission, Pentagon and Office of Personnel Management and report to the president and chief of staff, creating a new federal governance mechanism for assessing AI risks and opportunities.

The Council of the European Union’s Horizontal Working Party on Cyber Issues convened on 5 October as member-state delegates continued coordination on cyber policy, legislation and international cooperation. The working party’s remit includes countering cyber threats and strengthening digital resilience, making its cross-government coordination relevant to the legal and policy environment within which evidence sharing, attribution and cross-border cyber investigations operate.