|
🪟 Microsoft patches record 1,413 flaws
LINK
|
- Microsoft set a new Patch Tuesday record yesterday, shipping fixes for 1,413 vulnerabilities across Windows, Office, SharePoint and other products, one of which is already being exploited in attacks seen in the wild.
- The exploited bug (CVE-2026-96951, CVSS 8.8, high severity) is a command injection flaw in Windows Shell that lets attackers slip past Mark of the Web defenses by tricking a user into opening a specially crafted file sent via email or message.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by Friday; Microsoft also detailed a publicly known .NET flaw that lets a logged-in attacker run unauthorized code by bypassing Windows Defender Application Control.
|
🔓 Stolen login exposes some Meta source code
LINK
|
- Hackers used an employee's stolen login credentials to break into some of Meta's GitHub repositories, taking product source code and personal information tied to roughly 1,500 people, mostly Meta employees in the United States.
- Meta said the attackers got in through stolen credentials rather than a flaw in a Meta product, and its internal systems were not breached; about 99% of the stolen material was software code, with personal information making up the rest.
- Meta detected the intrusion several weeks before confirming it on October 13, 2026, blocked the attackers, rotated secrets in the affected repositories, added scans to catch mistakenly uploaded user data, and is offering affected people credit and dark web monitoring.
|
🇰🇵 DOJ charges 14 in North Korea IT scheme
LINK
|
- The Justice Department has charged 14 people and seized about 187 computers in Operation Lonestar Roundup, a crackdown on North Korea's scheme to place IT workers in American companies using stolen or fabricated identities.
- Two U.S. citizens and 10 others in China allegedly held remote jobs at more than 70 companies from 2019 through 2025, with facilitators running "laptop farms" that kept employer-issued laptops online with remote-access software for overseas workers.
- The FBI warned the scheme now pays U.S. citizens to sit interviews and host laptops and sometimes threatens former managers, and since May the group has spoofed device identifiers to make a video capture card look like a webcam, which CrowdStrike says makes a lasting takedown unlikely.
|
🔑 Ivanti VPN zero-days grant root access
LINK
|
- Attackers used a chain of Ivanti Connect Secure VPN zero-days to gain unauthenticated root access, steal credentials, and evade detection, hitting a fully patched appliance running version 22.8R2.4 before anyone noticed.
- The flaw (CVE-2026-104935, high severity at CVSS 8.6) lets an attacker bypass the login page by passing a URL check while an HTTP header redirects to a protected internal script, then win a race to run an uploaded Perl script before it's deleted.
- Ivanti patched two of the three bugs on October 13, with the privilege-escalation fix still coming; Volexity warns the on-disk Integrity Checker Tool missed the attack because changes were made in memory and restored.
|
🤖 AI builds $250K Chrome exploit
LINK
|
- Security firm XBOW used AI agents running OpenAI's GPT-5.6 Sol model to build a full-chain Chrome exploit in six days for about $40,000 in computing costs, earning a $250,000 reward from Google, which has fixed the flaws.
- The chain linked three bugs to break out of Chrome's renderer sandbox: one in the V8 JavaScript engine's Maglev compiler gave memory access inside V8, an out-of-bounds write in the animated WebP decoder left the V8 sandbox, and a Crashpad crash-reporting flaw on Windows caused memory corruption outside the sandbox.
- Disclosed on October 13, 2026, the demonstration targeted Windows with a crafted page launching a program on a test system and was not used against people; XBOW estimated the issue could affect about one billion users, and Google has fixed all three flaws.
|
|
