Cybersecurity news — Tuesday 13 October 2026

Krebs on Security 23:24 UTC

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times…

SecurityWeek 23:07 UTC

Saudi national Abdulrahman Alfozan was arrested Friday and terminated by OpenAI. The post Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say appeared first on SecurityWeek .

BleepingComputer 22:33 UTC

A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. [...]

CyberScoop Asia 22:10 UTC

Ivanti customers are in familiar territory, responding to yet another actively exploited zero-day affecting one of the vendor’s most commonly targeted security products. Volexity researchers, which discovered in-the-wild exploitation…

CyberScoop Asia 21:43 UTC

Federal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea’s remote IT worker scheme. The Justice Department announced the indictment Tuesday, highlighting two arrests and…

BleepingComputer 21:33 UTC

A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. [...]

BleepingComputer 21:16 UTC

Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers…

BleepingComputer 19:56 UTC

Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]

BleepingComputer 19:47 UTC

Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]

SANS ISC 19:25 UTC

Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and…

CyberScoop Asia 19:23 UTC

The Federal Trade Commission is asking a court to force the owner of multiple digital security and privacy companies from further operations, saying the businesses are serially defrauding their customers out of millions of dollars. Earlier…

BleepingComputer 19:04 UTC

Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. [...]

SecurityWeek 18:43 UTC

CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. The post Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN appeared first on…

The Hacker News 18:20 UTC

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said…

BleepingComputer 18:19 UTC

The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. [...]

The Hacker News 18:03 UTC

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited…

BleepingComputer 17:49 UTC

Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. [...]

The Hacker News 17:33 UTC

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on…

ZDNet Security 17:30 UTC

The move is a turning point in the developer’s relationship with AI and Linux.

The Hacker News 17:28 UTC

A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology…

SecurityWeek 17:14 UTC

The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge. The post Adobe Patches 176 Vulnerabilities Across 11 Products appeared first on SecurityWeek .

ZDNet Security 17:00 UTC

It just got a whole lot easier to vibe code the exact Android app you need – no developer experience required.

SecurityWeek 17:00 UTC

Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities. The post Google Partially Reverses Chrome Bug Bounty Cuts appeared first on SecurityWeek .

BleepingComputer 16:44 UTC

TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. [...]

The Hacker News 16:18 UTC

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having…

CyberScoop Asia 16:15 UTC

A joint international law enforcement and industry operation against scammers netted 28 arrests, rescued 117 trafficking victims and led to the takedown of more than 3.7 million accounts, the Justice Department announced Tuesday. The…

SecurityWeek 16:01 UTC

Most of the affected individuals are Meta employees in the United States and they are being offered credit monitoring services. The post Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach appeared first on SecurityWeek .

BleepingComputer 15:45 UTC

Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]

ZDNet Security 15:37 UTC

Apple’s ‘Welcome Home’ event featured all the new smart home hardware coming to the Apple lineup.

ZDNet Security 15:28 UTC

HomePod mini 2 is here, and there are four major upgrades that separate it from the first generation.

BleepingComputer 15:20 UTC

Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). [...]

ZDNet Security 14:31 UTC

As an Apple Home user, here’s what stands out about Apple’s new smart home hub – and what I want to test firsthand.

BleepingComputer 14:01 UTC

Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations…

BleepingComputer 13:51 UTC

SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. [...]

The Hacker News 13:12 UTC

The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users' sensitive data to advertisers. The administrative penalty is the…

Malwarebytes Labs 13:00 UTC

Norway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about Grindr users. While the…

ZDNet Security 13:00 UTC

Exclusive: A new Employ report shows how AI is both helping and hurting the hiring industry.

SecurityWeek 11:58 UTC

Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own. The post Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns appeared first on…

The Hacker News 11:57 UTC

The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move…

ZDNet Security 11:50 UTC

Another European move toward digital sovereignty has curtailed adopting the US workplace suite.

Malwarebytes Labs 11:17 UTC

A cyberattack has forced hundreds of supermarkets across France to throw away refrigerated and frozen food after attackers interfered with the systems that keep it cold. The attack caused significant financial losses and food waste. Some…

SecurityWeek 11:13 UTC

Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions. The post XWorm RAT Evolves Into Surveillance Platform appeared first on SecurityWeek .

The Hacker News 11:09 UTC

Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by…

SecurityWeek 11:00 UTC

IBM’s Steve Wallin talks to SecurityWeek on the effect of AI-driven attacks on enterprise defenses. The post AI Turns Familiar Cyberattacks Into a Race Against Time appeared first on SecurityWeek .

SecurityWeek 10:36 UTC

A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers. The post $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant appeared first on SecurityWeek .

The Hacker News 10:30 UTC

A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model…

SecurityWeek 09:37 UTC

The company says it took some of its systems offline to contain a security issue within its network. The post Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems appeared first on SecurityWeek .

The Hacker News 08:48 UTC

Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said. The attackers reached them through the…

The Hacker News 08:44 UTC

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12…

The Hacker News 08:43 UTC

GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. "GitLab has remediated an issue that, under certain…

SecurityWeek 08:28 UTC

A cyberattack targeted refrigeration controllers, setting refrigerators and freezers across hundreds of supermarkets to defrost. The post Refrigeration Controller Hack Spoils Food Across European Supermarkets appeared first on SecurityWeek…

Malwarebytes Labs 07:30 UTC

Scammers are finding different ways to use personal details exposed in data breaches to lure people into conversations. Last week , we showed how a Facebook Marketplace listing used the recipient’s name to make a text asking “Is this still…

The Hacker News 06:00 UTC

Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets…