The stories that mattered most across all sources.
Denmark's central population register was breached through a trusted partner
Danish authorities disclosed that attackers abused a private company's legitimate access to the Central Person Register (CPR), running about 14 million automated searches in September before detection in early October. Exposed data includes names, addresses and CPR numbers for roughly 8.8 million people, about 80 percent of the register. A party claiming responsibility said access came via an IT company account protected by the password 123456.
Why it matters: This is a textbook trusted-access failure. Audit which partners hold standing access to your sensitive datasets, enforce MFA and rate limits on bulk queries, and alert on anomalous search volume.
The Dutch DPA fined Uber 825 million euros over automated decisions
The Dutch DPA fined Uber 824,990,000 euros for breaches of GDPR Article 22 on automated individual decision-making and Article 13 on information duties. Uber used fully automated decisions to temporarily or permanently deactivate driver accounts on suspicion of fraud or low ratings, causing income loss, without giving drivers enough information. Uber has appealed, so there is no final judicial decision yet.
Why it matters: This is one of the largest fines on automated decisioning. Any system that materially affects individuals needs documented human oversight, Article 22 safeguards and a transparent explanation.
Cloudflare acquired Deno; Deno Deploy will shut down
Cloudflare announced on 9 October the acquisition of Deno, including the team and the open-source runtime. The Deno runtime gets one more year of bug fixes and security updates, Deno Deploy shuts down in six months with paid users migrated to Cloudflare Workers, and the JSR registry keeps running. Terms were not disclosed.
Why it matters: If you run production workloads on Deno Deploy, plan migration now within the six-month window and model the cost and latency of moving to Workers. The runtime itself has a one-year support tail.
One-click account takeover in Telegram Desktop
A researcher published CVE-2026-107181, an IPC-injection flaw in Telegram Desktop through version 7.2.8 combined with an unauthorized URI scheme that enables arbitrary local file read and exfiltration, leading to account takeover from a single malicious link click. It is rated CVSS 8.1 and fixed in version 7.2.9.
Why it matters: Push Telegram Desktop updates to 7.2.9 or later across managed endpoints. The attack steals session and encryption keys with no password, so one click can compromise an account.
The US suspended Microsoft and major IT firms from the green-card program
On 8 October the US administration suspended Microsoft's access to the PERM green-card program for skilled foreign workers, alleging hiring-practice fraud. The suspension also named Adobe, Capgemini, Cognizant, HCL, Infosys, Tata and Wipro. The thread drew 945 points and over 1,600 comments on Hacker News.
Why it matters: The move has direct talent and immigration-planning impact for firms relying on H-1B and offshore IT services vendors. Assess exposure in your staffing and vendor contracts.
