AX·NEWS
Sign in

Cybersecurity

Cybersecurity news — Wednesday 14 October 2026

50 stories from 10 sources, every one in English. Each links to its publisher.

Open in the live feedRSS feedOn a TV

  1. Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
    USBleepingComputer

    Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]

  2. Authorities charge alleged OLVX cybercrime marketplace operator in North Macedonia
    USCyberScoop Asia

    Authorities in the Republic of North Macedonia filed charges against the alleged administrator of OLVX, a cybercrime marketplace that sold stolen personal data, credentials and malicious tools for attacks since 2023. The 20-year-old…

  3. FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
    USBleepingComputer

    The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]

  4. Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
    INThe Hacker News

    Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted…

  5. Ledger asks sellers across Asia to halt sales after supply-chain attack
    USBleepingComputer

    Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device…

  6. Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities
    USCyberScoop Asia

    Microsoft’s streak of record-breaking vulnerability disclosures continued with a mega Patch Tuesday , containing 1,413 defects affecting the company’s various enterprise products and services. The monthly batch of patches surpassed the…

  7. Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
    INThe Hacker News

    Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A…

  8. Cisco patches new Secure Email Gateway zero-day exploited in attacks
    USBleepingComputer

    Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]

  9. Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
    INThe Hacker News

    Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits…

  10. AI worms could spread across your smart devices, Anthropic warns
    USMalwarebytes Labs

    Your streaming box might not look like much of a computer. But connect enough inexpensive devices together, and they can run an AI model. Researchers at Anthropic demonstrated this by running a Google Gemma model across 15 off-brand…

  11. U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
    INThe Hacker News

    The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers and KVM devices as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix…

  12. Upcoming Speaking Engagements
    USSchneier on Security

    This is a current list of where and when I am scheduled to speak: I’m speaking at ATTENTION: Democracy, Rebuilt in Montreal, Quebec, Canada. The event runs October 21–23, 2026, and my talk is on Wednesday, October 21. I’m speaking at the…

  13. AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds
    USSecurityWeek

    In Booz Allen’s isolated OT lab, AI models met every objective across eight scenarios and reached an industrial control network from a perimeter compromise in just over 16 minutes. The post AI Agents Navigate Unfamiliar OT Systems and Move…

  14. ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
    USSecurityWeek

    ABB previously published an advisory warning about possible probing of a dynovaPRO vulnerability. The post ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw appeared first on SecurityWeek .

  15. Senators press Trump admin to rally federal government around AI safety, security 
    USCyberScoop Asia

    Members of Congress are pressing the Trump administration to expand the federal government’s role in securing artificial intelligence, wanting new safety standards and regulations, independent testing of models and more “aggressive” use of…

  16. Microsoft fixes VPN issues caused by September Windows updates
    USBleepingComputer

    Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. [...]

  17. The Future of AI Cryptanalysis
    USSchneier on Security

    Matthew Green has been writing a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key ciphers. I am more optimistic than he is. That is, I have…

  18. U.K. Sanctions Cryptomus for RU Money Laundering
    USKrebs on Security

    The United Kingdom has issued economic sanctions against Cryptomus , a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime…

  19. Cyberattack on Connected Fridges in France
    USSchneier on Security

    Another IoT cyberattack , this one in France: Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected. […]…

  20. Harmonic Security Raises $50 Million for Workforce AI Protection
    USSecurityWeek

    The cybersecurity startup plans to expand engineering and go-to-market teams in the US and UK. The post Harmonic Security Raises $50 Million for Workforce AI Protection appeared first on SecurityWeek .

  21. The Blind Spots of Agentic Pentesting and How to Close Them
    USBleepingComputer

    AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure…

  22. Windows update patches a whopping 1,400 security bugs –  including 2 zero days
    USZDNet Security

    This month’s update also marks the first official one for Windows 11 26H2 and the end of support for Windows 11 24H2 Home and Pro.

  23. Virtual Event Today: Zero Trust Strategies Summit
    USSecurityWeek

    This summit is laser-focused on the next generation of Zero Trust and Identity security, moving beyond theory to deliver actionable strategies. The post Watch Now: Zero Trust Strategies Summit – All Sessions Available on Demand appeared…

  24. Global takedown hits network behind 1 billion phishing messages
    USBleepingComputer

    A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]

  25. Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
    USCyberScoop Asia

    Microsoft collaborated with Japanese authorities, Health-ISAC and several cybersecurity companies to dismantle an expansive, seemingly disconnected ecosystem of Chinese-language cybercrime tools and services, the company announced…

  26. Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
    USSecurityWeek

    Backed by a federal court order, Microsoft and Health-ISAC seized domains powering YAM Store, CoGUI, and Iron Man. The post Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages appeared first on SecurityWeek .

  27. CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
    USBleepingComputer

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]

  28. CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
    INThe Hacker News

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure…

  29. curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
    INThe Hacker News

    A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on…

  30. How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
    INThe Hacker News

    Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake. The call comes in at…

  31. Hirudo Android malware replaces banking apps to evade security checks
    USBleepingComputer

    A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. [...]

  32. Update Windows: Record Patch Tuesday fixes flaw already under attack
    USMalwarebytes Labs

    Microsoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities , including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws. Just when you thought a previous record would…

  33. Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
    INThe Hacker News

    A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by…

  34. Fake Calendly “Meta Careers” pages steal Facebook and Google logins
    USMalwarebytes Labs

    We found a wave of websites posing as Calendly booking pages for job interviews at Meta. Visitors pick a slot for a 30-minute phone call with a recruiter, fill in their details, and pass what looks like a CAPTCHA. Then the page asks them…

  35. Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
    INThe Hacker News

    Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app…

  36. An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
    INThe Hacker News

    The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major…

  37. US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms
    USSecurityWeek

    Investigators stormed 40 locations in Texas and seized 187 laptops used by North Korean IT workers to hide their location. The post US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms appeared first on SecurityWeek .

  38. Microsoft: Recent Windows updates may trigger Remote Desktop failures
    USBleepingComputer

    Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. [...]

  39. Police receive fake murder tip from Anthropic’s Claude AI
    USMalwarebytes Labs

    Police tip hotlines already have their fair share of crank callers. Apparently they now have to contend with crank AI agents as well. AI agents have already been caught hacking software companies , breaching an Australian government portal…

  40. AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
    INThe Hacker News

    A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's…

  41. Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
    USSecurityWeek

    Mozilla has introduced Firefox Enterprise for organizations with strict compliance, governance, and security requirements. The post Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise appeared first on…

  42. Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
    USSecurityWeek

    Critical-severity flaws could lead to authentication bypass, code execution, and sensitive authentication information leaks. The post Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products appeared first on SecurityWeek .

  43. Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
    USSecurityWeek

    The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild. The post Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day appeared first on…

  44. Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)
    USSANS ISC

    Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (.dwg).

  45. SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
    USSecurityWeek

    The bugs could allow attackers to invoke internal operations and execute code, completely compromising the system. The post SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities appeared first on SecurityWeek .

  46. Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
    INThe Hacker News

    Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating…

  47. Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
    INThe Hacker News

    Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in…

  48. ISC Stormcast For Wednesday, October 14th, 2026 https://isc.sans.edu/podcastdetail/10136, (Wed, Oct 14th)
    USSANS ISC
  49. OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room
    INThe Hacker News

    A Saudi national and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to covertly record sensitive conversations. Abdulrahman…

  50. TAG-193’s Regional Espionage Operations
    USRecorded Future

    Joint research by Cisco Talos and Recorded Future’s Insikt Group examined sustained cyber-espionage activity by TAG-193 targeting government organizations across Central Asia and the wider Commonwealth of Independent States (CIS). Tracked…