Major Incidents or Breaches

  • The UK Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday [29].
  • TFG London experienced a cybersecurity incident disrupting IT systems used by Phase Eight, Hobbs, and Whistles premium fashion brands [31].
  • Meta disclosed that hackers accessed code and personal data of 1,500 individuals in a GitHub breach, with most affected being Meta employees in the United States [53].
  • An OpenAI employee was arrested for allegedly planting a hidden recording device in an executive conference room at the company’s San Francisco offices [13][23][39][49].
  • Advertising company Xandr, owned by Microsoft, was fined €8.6 million by the Norwegian Data Protection Authority for illegally relaying Grindr users’ sensitive data to advertisers [19][58].

Newly Discovered Vulnerabilities

  • Microsoft released security updates addressing over 1,400 vulnerabilities, including a Windows Shell bug under active exploitation and two other zero-days. The updates cover Windows operating systems and other software, with 76 vulnerabilities rated critical [12][26][36][40][43][47][55].
  • A critical heap buffer overflow vulnerability (CVE-2026-39919) in Ghostscript could allow remote code execution via specially crafted PDF files [24].
  • SAP disclosed a critical CVSS 10 flaw in its Cloud SDK for Python that can send OAuth2 client credentials to attacker-controlled servers, affecting multi-tenant environments [17].
  • Docker fixed a critical two-year-old Hub vulnerability (CVE-2026-105445) that allowed attackers to impersonate users and tamper with container images [15][33].
  • Multiple high-impact vulnerabilities (CVE-2026-35029, CVE-2026-59823) were found and patched in LiteLLM, a widely used open-source LLM gateway [54].
  • A flaw in curl’s HTTP/2 upload handling allowed client-side code execution when uploading to a malicious server [5].
  • A critical Linux kernel flaw in the vhost subsystem enables local users to gain root privileges and, in some virtualization setups, break out from guest to host [10].
  • Security researchers exploited a four-byte write and timing bug to run code inside Windows SmartScreen’s protected VBS enclave [11].
  • Critical vulnerabilities affecting Citrix, Fortinet, and Ivanti products were patched, including flaws leading to authentication bypass, code execution, and sensitive data leaks [46].
  • SAP patched critical vulnerabilities in NetWeaver and S/4HANA that could allow attackers to execute code and compromise systems [48].
  • Adobe patched 176 vulnerabilities across 11 products, including Commerce, Photoshop, ColdFusion, and others [51].
  • Chrome and Firefox updates addressed 114 vulnerabilities, and Mozilla introduced Firefox Enterprise for enhanced compliance and security [45].

Notable Threat Actor Activity

  • Extortion groups such as ShinyHunters are increasingly using voice phishing (vishing) and Microsoft Teams phishing by impersonating help desks to gain initial access [1].
  • North Korean threat actors are conducting phishing campaigns targeting Ukrainians to gather war-related intelligence [37].
  • US authorities arrested two individuals and seized 187 laptops in Texas as part of a crackdown on North Korean IT worker operations designed to hide their true location [44].
  • Attackers continue to exploit gaps in multi-factor authentication (MFA) coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords [34].
  • Ransomware attacks involving data theft have surged by 275 percent in 2026, with over 896 terabytes of data exfiltrated from victim organizations [2].
  • Ransomware gangs are reportedly escalating to physical threats, including stalking and threats to employees’ families, though such claims are difficult to verify [35].
  • Attackers are using fake calendar invites and fake Calendly job interview pages to steal credentials, including Facebook and Google logins, even bypassing two-factor authentication [3][56].

Trends, Tools, or Tactics of Interest

  • The Hirudo Android banking trojan replaces legitimate banking apps with patched versions to bypass security checks and steal credentials [8][21].
  • Cloned voices and synthetic video calls are being used in payment fraud, help desk resets, and access requests, highlighting the need for readiness drills against deepfake-enabled social engineering [6].
  • Researchers used a public OpenAI model to develop a full-chain Chrome exploit by chaining three previously unknown bugs, demonstrating the potential for AI-assisted vulnerability research [7].
  • AI tools are increasingly being used in penetration testing, as seen when an AI agent discovered a critical OTP bypass in a production environment [9].
  • Anthropic warned that small AI models could soon self-replicate on consumer IoT devices, potentially creating AI-powered botnets that are difficult to eradicate [14][25][38].
  • Researchers highlighted ongoing issues with orphaned VBA projects inside AutoCAD DWG files, which can be leveraged for malicious purposes [41].
  • Attackers are still exploiting MFA gaps, particularly targeting systems that have not fully transitioned away from password-based authentication [34].

Regulatory or Policy Developments Affecting the Security Industry

  • The Norwegian Data Protection Authority fined Xandr €8.6 million for unlawfully sharing Grindr users’ sensitive data with advertisers without valid consent [19][58].
  • GitHub has tightened npm publishing security, expiring unvalidated trusted publishing configurations after 48 hours to prevent package hijacking following the discovery of a flaw affecting over 1,500 packages [18].
  • Microsoft announced that Windows 11 24H2 Home and Pro editions have reached end of support and will no longer receive monthly security updates [28].

Vulnerabilities Under Active Exploitation and Urgent Patching

  • Multiple zero-day vulnerabilities in Ivanti Connect Secure VPN appliances were actively exploited, with attackers chaining three flaws to achieve unauthenticated remote code execution as root. Only two of the three zero-days have been patched so far. CISA and Ivanti have issued urgent patching advisories [4][16][20][32][46][50].
  • Microsoft’s October 2026 Patch Tuesday addressed a Windows Shell vulnerability (CVE-2026-96951) that has been exploited in the wild [12][26][36][43][47][55].

Sources#

  1. UK Housing Ombudsman Service investigates 'security incident' - bleepingcomputer.com
  2. TFG London cyberattack disrupts systems at Hobbs and Whistles retailers - bleepingcomputer.com
  3. Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach - securityweek.com
  4. OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room - thehackernews.com
  5. OpenAI engineer arrested for allegedly planting spy device in office - bleepingcomputer.com
  6. An OpenAI Employee Allegedly Used a Chatbot to Help Plant a Recording Device at the Office - wired.com
  7. Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say - securityweek.com
  8. Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation - thehackernews.com
  9. Grindr users’ sensitive data shared through ad auctions without valid consent - malwarebytes.com
  10. Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug - thehackernews.com
  11. Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days - bleepingcomputer.com
  12. Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday - darkreading.com
  13. Microsoft Patches More Than 1,400 Security Flaws - krebsonsecurity.com
  14. October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th) - isc.sans.edu
  15. Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day - securityweek.com
  16. Update Windows: Record Patch Tuesday fixes flaw already under attack - malwarebytes.com
  17. Ghostscript flaw lets hackers hijack servers via PDF uploads - bleepingcomputer.com
  18. SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft - thehackernews.com
  19. Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another - thehackernews.com
  20. Docker Hub flaw let attackers impersonate users, tamper with images - bleepingcomputer.com
  21. When LLM Gateways Go Wrong: Findings from LiteLLM - research.checkpoint.com
  22. curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution - thehackernews.com
  23. AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host - thehackernews.com
  24. Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave - thehackernews.com
  25. Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products - securityweek.com
  26. SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities - securityweek.com
  27. Adobe Patches 176 Vulnerabilities Across 11 Products - securityweek.com
  28. Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise - securityweek.com
  29. Extortion Groups are Impersonating Help Desks to Gain Initial Access - blog.knowbe4.com
  30. North Korea Phishes Ukrainians for War Intel - darkreading.com
  31. US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms - securityweek.com
  32. The MFA Gaps Attackers are Still Exploiting - bleepingcomputer.com
  33. Report: Ransomware Attacks Involving Data Theft Are Surging - blog.knowbe4.com
  34. Ransomware Gangs Embrace Physical Threats, Family Stalking? - darkreading.com
  35. CyberheistNews Vol 16 #41 [Heads Up] Attackers Trick Your Employees to Share Fake Calendar Invites - blog.knowbe4.com
  36. Fake Calendly “Meta Careers” pages steal Facebook and Google logins - malwarebytes.com
  37. Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks - thehackernews.com
  38. Hirudo Android malware replaces banking apps to evade security checks - bleepingcomputer.com
  39. How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team - thehackernews.com
  40. Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days - thehackernews.com
  41. An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part. - thehackernews.com
  42. Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets - thehackernews.com
  43. Anthropic warns self-replicating AI could spread to your smart devices - bleepingcomputer.com
  44. Anthropic Finds Ingredients for Future AI Worms - darkreading.com
  45. Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th) - isc.sans.edu
  46. GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking - thehackernews.com
  47. Microsoft: Windows 11 24H2 Home and Pro reached end of support - bleepingcomputer.com
  48. CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts - thehackernews.com
  49. Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far - thehackernews.com
  50. CISA warns admins to immediately fix Ivanti flaw exploited as zero-day - bleepingcomputer.com
  51. Ivanti warns of Connect Secure zero-day exploited in attacks - bleepingcomputer.com
  52. Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN - securityweek.com