October 1, 2026 by sig9

Hacker Wars - October 01, 2026

Your daily dose of infosec chaos

New month, same chaos. Crypto takes the brunt today: a $387.5 million exchange heist pinned on a zero-day in third-party security software, and MetaMask quietly yanking Ethereum validators while it fights an infrastructure incident. Meanwhile Cisco has an actively exploited SD-WAN zero-day in the wild, Google is handing a frontier AI to defenders, and the FTC has started asking AI labs some very pointed questions.

Bitget Blames $387.5 Million Heist on Third-Party Zero-Day

The exchange confirmed that the attackers who made off with $387.5 million last week got in through a zero-day in third-party security products, not a flaw in Bitget’s own code, per findings from the ongoing SlowMist investigation. A brutal reminder that your security tooling runs with deep privileges and is part of your attack surface whether you like it or not.

What to do: Inventory every third-party tool with privileged access to critical systems and demand clarity from vendors on their patch posture.

MetaMask Incident Forces Ethereum Validators Offline

MetaMask disclosed an ongoing security incident affecting part of its infrastructure and is voluntarily exiting affected Ethereum validators while it remediates with external partners and advisors. Details are thin, but a wallet provider deliberately taking its own validators out of the set is the blockchain equivalent of cutting a live wire.

What to do: Update the MetaMask extension as soon as a patched release lands, and treat any “MetaMask support” outreach right now as phishing until proven otherwise.

Cisco Catalyst SD-WAN Zero-Day Patched After Active Exploitation

Cisco shipped fixes for a Catalyst SD-WAN vulnerability that gives remote, unauthenticated attackers administrative access to vulnerable appliances, and confirms it was exploited in the wild before a patch existed. Unauthenticated admin on edge appliances is precisely the kind of foothold ransomware crews and APT groups dream about.

What to do: Patch Catalyst SD-WAN appliances immediately and hunt through logs for suspicious management-plane activity.

Google Hands Gemini 4 Argon to Defenders, Guardrails Optional

Google rolled out Gemini 4 Argon, its newest frontier model, to vetted cyber defenders through the Fairwind Program, with a guardrail-free version planned - and says the model already surfaced a critical vulnerability in software used by hospitals worldwide. Offensive-capable AI in trusted hands is great until the vetting gets sloppy, and the same model that finds a bug can write the exploit for it.

What to do: Nothing to deploy, but pay attention to how guardrail-free AI access gets governed before someone less vetted gets the same toys.

FTC Opens Consumer Risk Probe Into OpenAI and Anthropic

The FTC is formally investigating OpenAI and Anthropic over possible risks to consumers, with a spokesperson confirming the probe but declining to elaborate on scope or timeline. AI labs are graduating from hype cycles to full platform-style regulatory scrutiny, and compliance teams should take notes.

What to do: If you ship AI-powered features, assume a regulator will eventually ask for your risk and safety documentation - keep it written down.

That’s a wrap. Back tomorrow with more digital warfare.

Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown

This bulletin is provided for informational purposes. Contact us for tailored security analysis.