IT Security News Roundup: 2026-10-14 Morning

IT Security News: Morning roundup, 2026-10-14

Summary

This monitoring period was dominated by unprecedented vulnerability disclosures, highlighted by Microsoft's record-breaking patch release alongside critical updates from major enterprise software vendors. Meanwhile, infrastructure attacks against physical systems and corporate supply chains revealed persistent operational and remote-access risks. Securing access controls—whether against zero-day exploit chains, malicious search ads, or insider threats—remains vital for defenders balancing system availability against evolving attack vectors.

1. Panda Security published guidelines on teaching children responsible AI prompting, emphasizing critical evaluation of AI-generated responses.
2. Ivanti patched CVE-2026-104935, a high-severity authentication bypass flaw in Connect Secure appliances that allowed unauthenticated remote code execution in limited active attacks.
3. Microsoft released its largest security update in history during October Patch Tuesday, fixing over 1,400 vulnerabilities across its software suite.
4. Threat actors chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to gain unauthenticated root access and steal Active Directory credentials.
5. An OpenAI engineer was arrested after allegedly placing a hidden listening device wrapped in toilet paper inside an executive boardroom to intercept private meetings.
6. Zoom published a security bulletin addressing CVE-2026-108185, a certificate validation flaw in My Notes that could allow unauthenticated network attackers to access sensitive data.
7. Microsoft resolved 1,413 vulnerabilities in its October 2026 Patch Tuesday update, setting a record for monthly software bug fixes.
8. Docker resolved a critical vulnerability in Docker Hub that allowed attackers to hijack personal access tokens and tamper with container images.
9. Meta removed over 3.7 million fraudulent accounts across Facebook and Instagram following a global law enforcement operation that resulted in 28 arrests.
10. Chainguard research revealed that billion-dollar enterprises are twice as likely to leave critical vulnerabilities unpatched due to fear of operational downtime.
11. Data breach monitoring confirmed that threat actor ShinyHunters exfiltrated internal corporate documents from Crunchbase, exposing details for over 559,000 contacts.
12. Attackers are hijacking Google Search results with malicious ads to deliver a fake PuTTY installer that deploys malware while launching a working SSH client as a distraction.
13. Microsoft patched CVE-2026-96951, an actively exploited Windows Shell vulnerability that allows remote attackers to execute code while bypassing Mark of the Web warnings.
14. Google and Mozilla issued patches for 114 security vulnerabilities across their browsers, while Mozilla announced a new enterprise-focused Firefox tier.
15. Microsoft resolved three security flaws in Windows BitLocker disk encryption that allowed attackers to bypass security protections and escalate system privileges.
16. Enterprise software providers Citrix, Fortinet, and Ivanti issued patches addressing 29 security flaws spanning authentication bypasses and remote execution risks.
17. Microsoft's record October Patch Tuesday addressed 1,413 vulnerabilities, featuring a fix for an exploited zero-day flaw in Windows Shell.
18. Cybersecurity news highlights included compromised war-zone webcams, North Korean phishing campaigns, and retail disruptions at major fashion brands.
19. SANS Internet Storm Center warned that legacy AutoCAD drawing files can harbor hidden Visual Basic for Applications macros that pose unrecognized security risks.
20. Microsoft patched actively exploited zero-day CVE-2026-96951 in Windows Shell, which enabled attackers to bypass Mark of the Web security controls.
21. SAP delivered security updates addressing critical vulnerabilities in NetWeaver and S/4HANA that permitted unauthorized remote code execution.
22. Netskope reported that a leaked builder transformed XWorm from a basic remote access trojan into an advanced surveillance tool capable of audio monitoring and browser takeover.
23. Italian regulatory authorities launched an investigation into Microsoft-owned video game studios over deceptive pricing practices for in-game microtransactions.
24. Hackers disrupted nearly 700 European supermarkets by altering industrial refrigeration controller settings, causing food storage temperatures to rise.
25. Retail company TFG London confirmed a cyberattack that forced key IT systems offline across popular clothing brands Hobbs, Whistles, and Phase Eight.

Summaries written with AI (Google Gemini) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Simple ways to guide responsible AI prompts for learning
2. Ivanti Connect Secure CVE-2026-104935 Flaw Enables Unauthenticated Remote Code Execution
3. Microsoft Breaks Patch Tuesday Record Again with 1400+ CVEs
4. Hackers Chain 3 Ivanti VPN Zero-Days to Gain Root Access Without Authentication
5. OpenAI engineer arrested for allegedly trying to eavesdrop on executive meetings
6. Zoom Certificate Validation Vulnerability Allows Attackers to Access Sensitive Information
7. Microsoft Fixes 1,413 Vulnerabilities in Record October Patch Tuesday Update
8. Critical Docker Hub Vulnerability Lets Attackers Impersonate Users and Tamper With Container Images
9. Meta Removes 3.7 Million Scam Accounts as 28 Arrested in Global Crackdown
10. Billion-Dollar Companies Twice as Likely to Leave Critical Vulnerabilities Unpatched
11. Crunchbase – 559,908 breached accounts
12. Hackers Abuse Google Search to Attacks ITadmins with Weaponized PuTTY Installer
13. Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)
14. Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
15. Windows BitLocker Vulnerabilities Security Feature Bypass and Privilege Elevation Attacks
16. Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
17. Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
18. Webcams go to war, Kimsuky sends invites, Anthropic blocks copycats
19. Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)
20. Windows Shell Zero-Day Lets Attackers Bypass Mark of the Web Security Protections
21. SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
22. How a leaked builder of XWorm turned a remote access trojan into a surveillance kit
23. Italy Probes Microsoft Video Game Makers Over Transparency
24. Hackers Hacked European Market Cooling Units Set Temperature 50 Degree
25. TFG London Confirms Cyberattack Affecting Hobbs, Whistles, and Phase Eight