The Flax Typhoon gets a cold front.

This CyberWire Daily briefing aggregates recent cybersecurity news: an international coalition disrupted tools and operations tied to a Chinese state-backed group, law enforcement executed mass arrests in Ghana targeting cybercrime compounds, Anthropic and others launched security initiatives, a maximum-severity SonicWall SMA1000 vulnerability and unpatched AhsayCBS flaws are being actively exploited, ransomware activity reached record levels in Q3 2026, a pre-baked firmware malware campaign (Midnight Mimosa) affected inexpensive Android devices across many countries, and a large money-mule operation was prosecuted.