Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Before you buy another security tool or remove an existing control, answer one question: how does your website actually present the payment form? For e-commerce merchants completing PCI DSS Self-Assessment Questionnaire A (SAQ A), that architectural detail matters. An embedded payment form, a redirect, and a fully outsourced payment process are different arrangements, with different implications for how the SAQ A script-attack eligibility criterion applies.

Your MFA rollout is only as strong as the exception list nobody has looked at since it was created.

Security is built on the small decisions we make each day. That’s why Cybersecurity Awareness Month 2026 focuses on the habits that make life harder for attackers—such as using strong passwords, enabling multi-factor authentication (MFA), recognizing and reporting scams, and keeping software updated. However, security awareness must also address the risks that arise when employees introduce new applications and services into their work.

On 6 October 2026, ASOS customers received an extortion message through the retailer's own app claiming its Snowflake instance had been compromised. CYJAX looks at what happened, why third-party and cloud platform risk sits at the centre of the incident, and how organisations can monitor their extended supply chain before attackers do. By now, most people in the UK will have heard about the cyber incident that hit ASOS on 6 October 2026.

In late July 2026, 36 municipal waste and water systems across Minnesota were targeted in a cyber attack. The attackers targeted Programmable Logic Controllers (PLCs) that were in control of pressure, pumps, and chemical dosing. When the news broke, it felt like it was everywhere. This was an attack on critical systems, systems that we require and use daily. But cyberattacks on U.S. critical infrastructure systems like water, hospitals, sewage, gas, and electricity aren’t new.

The GhostAction supply chain campaign hit 772 public GitHub repositories between August 31 and September 30, 2026, targeting 2,577 secrets with the same injected workflow we documented last year.

CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodology and tooling.

The ASOS cyber attack reported on 6 October 2026, has raised fresh questions about third-party access, SaaS security and how modern organisations manage an increasingly connected attack surface. The incident became public in an unusual way: customers received an unauthorised mobile push notification through the ASOS app claiming the retailer had been compromised. ASOS later confirmed that basic personal information, including names and contact details, may have been accessed.