CyberWatch Newsroom Live Intel

Critical CVE-2026-96951 Qualys Security Blog

2026-10-13 Qualys Security Blog

Microsoft Patch Tuesday, October 2026 Security Update Review

Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services. As organizations continue to navigate an evolving threat landscape, applying security patches promptly remains critical to reducing exposure and strengthening security posture. This month’s updates highlight the importance of i…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Vulnerability Research & Audits

Advisory

Moderate Dark Reading

2026-10-13 Dark Reading

North Korea Phishes Ukrainians for War Intel

The Democratic People's Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Moderate BleepingComputer

2026-10-13 BleepingComputer

Anthropic warns self-replicating AI could spread to your smart devices

Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate The Record by Recorded Future

2026-10-13 The Record by Recorded Future

Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue

More than 40 residences in Texas were the target of a federal operation in September to clamp down on remote worker scams that feed money back to the North Korean regime.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Critical CVE-2026-96951 Cisco Talos Intelligence

2026-10-13 Cisco Talos Intelligence

Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild CVE-2026-96951 is a security feature bypass vulnerability that affects Wind…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Telemetry & Research

Advisory

Moderate Dark Reading

2026-10-13 Dark Reading

Anthropic Finds Ingredients for Future AI Worms

Anthropic's latest study combines IoT and network tests to explore AI self-replication, which researchers said would be "challenging" to shut down.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Moderate The Record by Recorded Future

2026-10-13 The Record by Recorded Future

FTC: Company netted at least $60 million charging sextortion victims for help it didn’t provide

An Ohio-based company charged individuals thousands of dollars to fight sextortion scams, but the operation itself was fraudulent, according to a Federal Trade Commission complaint.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Critical BleepingComputer

2026-10-13 BleepingComputer

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate BleepingComputer

2026-10-13 BleepingComputer

Microsoft releases Windows 10 KB5126657 extended security update

Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Critical CVE-2026-75650 Trend Micro ZDI

2026-10-13 Trend Micro ZDI

The October 2026 Security Update Review

Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland , because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). If you’d rather wat…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Zero Day Vulnerabilities

Advisory

Moderate SANS Internet Storm Center

2026-10-13 SANS Internet Storm Center

October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)

Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Moderate BleepingComputer

2026-10-13 BleepingComputer

Microsoft: Windows 11 24H2 Home and Pro reached end of support

Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Important The Hacker News

2026-10-13 The Hacker News

Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate BleepingComputer

2026-10-13 BleepingComputer

UK Housing Ombudsman Service investigates 'security incident'

The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Important CVE-2026-104935 SecurityAffairs

2026-10-13 SecurityAffairs

U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Known Exploited Vulnerabilities (KEV) catalog . The …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical The Hacker News

2026-10-13 The Hacker News

Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that converts a personal account into an organization, Docker said in a security advisory o…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate GitHub Security Blog

2026-10-13 GitHub Security Blog

GitHub’s model for secret detection: Finding more secrets with less noise

/* Copyright 2022 The Mona Sans Project Authors (https://github.com/github/mona-sans), with Reserved Font Name "Mona" This Font Software is licensed under the SIL Open Font License, Version 1.1. This license is copied below, and is also available with a FAQ at: https://openfontlicense.org ----------------------------------------------------------- SIL OPEN F…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Open Source Supply Chain

Advisory

Moderate BleepingComputer

2026-10-13 BleepingComputer

Windows 11 KB5127648 & KB5126653 cumulative updates released

Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Critical The Hacker News

2026-10-13 The Hacker News

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which rep…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Critical The Hacker News

2026-10-13 The Hacker News

SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Critical CVE-2026-104935 Rapid7 Threat Research

2026-10-13 Rapid7 Threat Research

Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935 , a high-severity authentication bypass by spoofing ( CWE-290 ) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands. Ivanti reports that exploitation in the wild ha…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Metasploit & Exploit Research

Advisory

Important BleepingComputer

2026-10-13 BleepingComputer

TFG London cyberattack disrupts systems at Hobbs and Whistles retailers

TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Important The Hacker News

2026-10-13 The Hacker News

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publi…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Important The Record by Recorded Future

2026-10-13 The Record by Recorded Future

Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says

The new research, published by AI security startup AIR, found that a network filtering flaw in Vercel Sandbox — a tool used to run code in isolated environments — could allow agents to exploit certificate validation processes to transmit data outside approved networks.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory