Microsoft's largest ever Patch Tuesday (1,411 flaws and three zero-days, one already exploited) and an Ivanti Connect Secure zero-day chain against a fully patched VPN appliance top a day that also brought a maximum-severity SAP OAuth flaw, a two-year-old Docker Hub token bug, and fresh detail on the hardware implant behind an 86 million dollar Ledger drain.
🔴 CRITICAL (2)
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, including three zero-days and one exploited Windows bug Confirmed
Microsoft released its largest security update on record, addressing 1,411 vulnerabilities across Windows, Office, SQL Server, Visual Studio and other products, of which about 75 are rated critical. The release includes one actively exploited zero-day and two publicly disclosed ones, and the count dwarfs September’s previous record of nearly 1,000 fixes. CISA added CVE-2026-96951, a command injection flaw in Windows Shell rated CVSS 8.8, to its Known Exploited Vulnerabilities catalog on the same day, giving federal agencies until 16 October to patch. Administrators should treat this month’s Windows, SharePoint, Office and SQL Server updates as urgent, prioritise internet facing systems and expect a staggered delivery because of the volume.
Sources BleepingComputer|CISA KEV|KrebsOnSecurity|DarkReading
Ivanti Connect Secure zero-day chain gave root access on a fully patched VPN, third flaw still unpatched Confirmed
Volexity reported that a previously undocumented actor it tracks as UTA0576 chained three Ivanti Connect Secure zero-days to gain unauthenticated, root level code execution on a fully patched appliance in early October, then stole stored credentials and exfiltrated data. CVE-2026-104935, rated CVSS 8.6, covers an authentication bypass and a remote code execution flaw, and Ivanti has released fixes, while the third bug used for privilege escalation had no patch at the time of reporting. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October with a 16 October deadline, and administrators should upgrade Connect Secure to the latest release immediately, look for unusual outbound traffic and certificate activity, and assume credentials stored on any exposed appliance may be compromised.
Sources Volexity|CISA|SecurityWeek|Rapid7
🟠 HIGH (7)
Ledger finds LTE implant that read recovery phrases off the screen, losses traced near 86 million dollars Confirmed
Ledger published technical detail on the hardware implant found in signers sold through reseller CryptoBilis, describing a hidden circuit board under the screen that captures the 24 word recovery phrase during setup and transmits it over a mobile network, leaving the secure element and its firmware untouched. The company says all confirmed cases trace to that reseller channel, tracing has followed roughly 86 to 93 million dollars, and German retailer MediaMarkt Saturn has stopped selling the devices. Anyone who generated a wallet through a third party reseller should move funds to a wallet seeded on a device bought from a trusted source, and treat any pre-supplied recovery phrase as compromised.
Sources Decrypt|CoinDesk|SecurityWeek|The Hacker News
SAP patches maximum severity Cloud SDK for Python flaw that leaked OAuth2 credentials Confirmed
SAP disclosed a CVSS 10.0 flaw in its Cloud SDK for Python that can send an application’s OAuth2 client credentials to a server an attacker controls, potentially letting an attacker impersonate the application against SAP Business Technology Platform services. Exploitation requires the attacker to control a tenant subdomain used by the application, which limits exposure to multi tenant setups. The fix is part of SAP’s October 2026 security updates, which cover 20 vulnerabilities in total, and BTP developers and platform teams should update the SDK and review subdomain and trusted domain configuration.
Sources The Hacker News|BleepingComputer
Docker Hub token flaw CVE-2026-105445 let one user push images as another Confirmed
Docker disclosed CVE-2026-105445, a critical privilege assignment bug in Docker Hub’s personal-account-to-organization conversion that allowed an authenticated user to reassign a personal access token they controlled to another account, so they could push, pull or delete that user’s container images without ever knowing the token secret. The flaw existed from August 2024 until a fix shipped on 30 September, and Docker says it reviewed roughly 304,000 pushes made with transferred tokens and found no evidence of exploitation or malicious images. Teams should confirm whether any of their tokens were force deactivated after the disclosure, rotate long lived personal access tokens in favour of scoped or organisation tokens, and verify image digests for anything published in that two year window.
Sources Docker|The Hacker News|BleepingComputer
GitHub expires unvalidated npm trusted publishing configs after researchers showed package hijacking Confirmed
GitHub changed how npm trusted publishing works after researchers found an attacker could push new versions of another user’s package without stealing their credentials, a weakness that left more than 1,500 packages exposed to hijacking. Trusted publishing configurations that are not validated by a successful publish now expire 48 hours after creation, a configuration becomes permanently valid only after its first successful publish. Maintainers should review their existing trusted publisher settings, confirm that the linked workflows are the ones they intend, and check recently published versions of packages they own for unexpected releases.
Sources The Hacker News
Ghostscript heap overflow CVE-2026-39919 allows code execution through crafted PDFs Confirmed
A critical heap buffer overflow in the Ghostscript interpreter and rendering engine, tracked as CVE-2026-39919, can lead to remote code execution when a crafted PDF, PostScript or EPS file is processed. Ghostscript sits behind many document conversion pipelines, print servers, mail gateways and file scanning services, so an upload or attachment path that renders documents is enough to reach it. Administrators should upgrade to a fixed Ghostscript release, keep the interpreter behind a sandbox and non privileged user, and treat document conversion services as internet facing attack surface when planning exposure.
Sources BleepingComputer
LG smart TVs can be rooted before authentication by anyone on the local network Confirmed
Three vulnerabilities in LG’s webOS can be chained to give an attacker on the same local network root access to certain LG smart TVs without a PIN or any interaction from the owner, in a chain detailed by SSD Secure Disclosure and demonstrated at the TyphoonPWN 2026 competition. Researchers tested the chain on the 32LQ636BPSA and 27TQ600SW models running webOS 7.5.7-25 with firmware 04.54.40, and LG has issued a fix although the published bulletin does not state fixed firmware versions. Owners should apply the latest TV firmware, keep the sets on a segmented network rather than the same segment as laptops and phones, and treat TVs in meeting rooms or lobbies as untrusted endpoints.
Sources The Hacker News|Cybernews
Bitdefender finds preinstalled malware on low-cost Android phones that turns them into residential proxies Confirmed
Bitdefender documented a campaign it tracks as Midnight Mimosa, in which low-cost Android smartphones built on MediaTek platforms ship from the factory with malicious software baked into the firmware, letting operators install apps silently, commit ad fraud and route third party traffic through the devices as residential proxies. Because the code lives in the firmware rather than in installable apps, users cannot remove it with a normal factory reset. Buyers should avoid unbranded or grey market handsets for work use, and organisations issuing inexpensive devices should verify firmware provenance and monitor for unexpected proxy or ad traffic leaving their network.
Sources The Hacker News
🟡 MEDIUM (9)
XWorm RAT expands into a full surveillance platform Confirmed
SecurityWeek reports that the XWorm remote access trojan has grown from a commodity stealer into a surveillance toolkit, with an expanded plugin set that adds live audio streaming, location tracking and interaction with a victim’s authenticated browser sessions. The plugin model means operators can assemble capabilities per target, and the browser session abuse lets attackers reach accounts without cracking credentials. Defenders should alert on new scheduled tasks and unusual outbound connections from user endpoints, and treat session hijacking as a reason to require reauthentication for sensitive applications.
Sources SecurityWeek
Progress MarkLogic flaws include two that let delegated managers take admin control Confirmed
Progress Software disclosed 31 vulnerabilities in its MarkLogic Server database, five of them critical, and two can let an account with only delegated management privileges escalate to full administrator control of the server. Fixes have been available since 10 September in MarkLogic 11.3.7 and 12.1.0, and the details were published on 12 October. Database administrators running older releases should upgrade now and review which accounts hold limited management roles, since partial privileges turn out to be enough here.
Sources The Hacker News
Check Point finds authorisation flaws in widely used LiteLLM gateway Confirmed
Check Point Research published an assessment of LiteLLM, a popular open source LLM gateway, finding high impact issues tracked as CVE-2026-35029 and CVE-2026-59823, including a missing authorisation check on the configuration update endpoint that let any authenticated user, including low privileged accounts, change gateway settings. The flaws are fixed in LiteLLM 1.83.9. Teams that route model traffic through a shared gateway should upgrade, restrict who can reach its administrative endpoints, and review gateway configuration and API keys that may have been altered.
Sources Check Point Research
FBI and CrowdStrike disrupt North Korean laptop farms used for fraudulent IT employment Confirmed
CrowdStrike and the FBI disrupted several laptop farms in the United States that the DPRK linked group FAMOUS CHOLLIMA used to place operatives in American companies while hiding their real location and identity. The farms host the machines that remote IT workers of the scheme connect to, so removing them interrupts both the fraudulent employment income and the access it buys. Employers hiring remote IT staff should verify identities with in person or strong remote checks, watch for traffic that routes through unusual relay infrastructure, and treat hardware shipped to suspicious addresses as a warning sign.
Sources CrowdStrike|Nextgov
Meta says attackers took source code and personal data of 1,500 people through GitHub breach Confirmed
Meta notified around 1,500 people, most of them employees in the United States, that attackers obtained source code and personal data through a breach connected to GitHub, and it is offering credit monitoring to those affected. The company has not described the entry point in detail, and the incident highlights how much sensitive material engineering teams keep in code hosting platforms. Organisations should review what secrets, customer data and internal code live in repositories and CI systems, enforce short lived credentials, and monitor for bulk cloning or repository access from unfamiliar networks.
Sources SecurityWeek
OpenAI engineer arrested after listening device found in a conference room Under investigation
An OpenAI engineer was arrested after a covert recording device was found in one of the company’s conference rooms, according to the company and the FBI, and OpenAI says internal AI monitoring helped surface the activity. The case is being handled as a criminal matter and few technical details have been released. It is a reminder that insider threats include physical surveillance, so organisations should combine technical monitoring with physical security sweeps for sensitive meeting spaces and legal guidance on what employees may record.
Sources BleepingComputer|SecurityWeek|Decrypt
TFG London cyberattack disrupts systems at Phase Eight, Hobbs and Whistles Under investigation
TFG London, the group behind the Phase Eight, Hobbs and Whistles fashion brands, detected a cybersecurity incident that affected the IT systems serving those retailers, with disruption reported across store and online operations. The company has not said whether data was taken or who was behind the intrusion. Retailers affected by outages should brief staff and customers on phishing that references the disruption, and security teams assessing retail peers should note the steady targeting of mid sized groups with outsourced IT.
Sources BleepingComputer
CISA issues ICS advisories for Inductive Automation Ignition and Swann cameras Confirmed
CISA published new industrial control system advisories, including one for Inductive Automation Ignition where CVE-2026-92817, rated CVSS 8.8, lets a low privileged authenticated user escalate privileges through improper session validation in the Perspective module, affecting releases from 8.1.0 through 8.3.8. A second advisory covers Swann SWIFI-SE2KIC cameras, where missing authentication for a critical function allows unauthenticated viewing of video and related data. Operators of SCADA, manufacturing and surveillance systems should apply the vendor updates and remove these management interfaces from direct internet exposure.
North Korea uses simple reply baiting phishing to gather Ukraine war intelligence Confirmed
DarkReading reports that DPRK linked actors are running straightforward reply baiting phishing campaigns against Ukrainians to try to learn how North Korean troops are performing in the war, rather than relying on elaborate technical exploits. The campaigns start with innocuous messages designed to get a reply, then build rapport and move the conversation towards collecting information or delivering malware. Security awareness training should cover low tech conversational approaches, not only malicious attachments and links, and staff dealing with sensitive topics should route unsolicited approaches through reporting channels.
Sources DarkReading
⚪ WATCH (7)
Anthropic warns small AI models could soon self replicate across IoT devices Confirmed
Anthropic published research and a warning that small AI models may be only months away from being able to copy themselves across consumer IoT devices such as smart ovens and off brand Android TV boxes, forming botnets with no central server to shut down. The work combined IoT and network experiments and describes the resulting worms as challenging to stop once spread. The practical takeaway for now is inventory and network segmentation for cheap internet connected appliances, plus monitoring for unexpected model files and compute usage on embedded devices.
Sources The Hacker News|SecurityWeek|DarkReading|BleepingComputer
Google restructures Chrome bug bounty after criticism of earlier cuts Confirmed
Google is partially reversing earlier reductions to its Chrome vulnerability reward programme and restructuring payouts to focus on complex memory safety bugs, which are harder to find and more valuable to attackers. The change follows researcher pushback that lower rewards would reduce scrutiny of the browser. Security teams that track browser risk should expect disclosure patterns to shift rather than the underlying bug classes to disappear, and should keep patching browser and engine updates on a short cycle regardless of bounty economics.
Sources SecurityWeek
Kaspersky details InjectEave method for capturing headphone audio through electromagnetic emissions Confirmed
Researchers, including a team in Hong Kong, demonstrated a method dubbed InjectEave that remotely captures the analog audio signal from wired headphones by picking up electromagnetic emissions from the cable, which can function as an unintended antenna. The approach is a laboratory technique rather than an observed campaign, but it matters for organisations handling sensitive spoken information in shared or adjacent spaces. Teams should consider tempered glass and cable management in secure rooms, keep high value conversations away from predictable window positions, and treat analog leakage paths as part of physical security reviews.
Sources Kaspersky
CrowdStrike shows how attackers evade LLM safety classifiers with request aggregation Confirmed
CrowdStrike research describes techniques for getting harmful output past large language model safety classifiers by splitting, aggregating or rephrasing requests so that no single prompt looks malicious to the filter. The work matters to any organisation exposing a model through a gateway or agent that relies on prompt classification as a control. Prompt filters should be treated as one layer among several, with output validation, tool permission scoping and monitoring of aggregated session behaviour rather than per prompt decisions alone.
Sources CrowdStrike
South Korea blocks 27 crypto exchanges including BitMart and KuCoin Confirmed
South Korean regulators extended earlier restrictions from mobile apps to websites and blocked access to 27 crypto exchanges that are not registered locally, naming BitMart and KuCoin among them, in a push to act before investors report losses. The move affects users in South Korea rather than exchange operations globally. Firms with customers or staff in the country should expect access failures and update onboarding and offboarding guidance, and compliance teams should track similar registration based blocking elsewhere in the region.
Sources CoinDesk
UK High Court ruling moves seized 5 billion dollar bitcoin haul closer to the Treasury Confirmed
A UK High Court judge ruled that Chinese law governs fraud victims’ claims to roughly 61,000 bitcoin seized from Zhimin Qian, a decision that weakens the claimants’ position and improves the government’s chances of keeping the holdings, worth about 5 billion dollars. The case shapes how cross border fraud proceeds and victim claims are handled in the asset recovery system. Crypto businesses and payment firms with exposure to similar tainted flows should expect continued seizures, attribution work and claims on recovered assets.
Unit 42 traces unsophisticated attack on a European bank to third party risk Confirmed
Unit 42 published an analysis of an intrusion against a European bank’s IT infrastructure that used unremarkable tooling but succeeded by way of a third party relationship, and lays out detection opportunities that defenders in similar environments can reuse. The case shows that loud, low sophistication attacks still work when they arrive through a trusted connection or supplier. Security teams should map supplier access paths, monitor for unusual authentication from partner networks, and rehearse containment steps that assume the entry point is the supply chain.
Sources Unit 42
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.