# Today's Top Stories

Microsoft's October 2026 Patch Tuesday set a new record with 1,413 vulnerabilities patched, including 1,102 in Windows, 134 in Office, and 36 in SharePoint Server. Over 670 flaws relate to privilege escalation, with more than 300 enabling remote code execution. At least one vulnerability is confirmed under active exploitation, making immediate patching critical for enterprise defenders.

Volexity disclosed that an attacker chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to achieve unauthenticated root-level command execution. As of October 13, Ivanti has patched only two of the three flaws; CVE-2026-104935 enables unauthenticated RCE with elevated privileges. Ivanti is urging customers on affected versions to 'act immediately,' and a fix for the third zero-day remains pending.

Attackers remotely hijacked Danfoss refrigeration controllers at hundreds of French supermarkets on the night of October 11, raising temperatures to 50°C and forcing stores to discard food across multiple retail chains including Les Mousquetaires. The controllers, which allow remote management by maintenance firms, were the attack vector. This ICS/OT incident demonstrates real-world consequences of insecure industrial remote access in the food supply chain.

Ledger confirmed that hardware signers sold through Southeast Asian reseller CryptoBilis were physically compromised with a hidden circuit board implanted beneath the screen, which read and exfiltrated users' seed phrases and recovery data to attackers. The implant is linked to an $86 million cryptocurrency theft. This supply-chain hardware attack bypasses all software security controls and affects users who trusted the device's physical integrity.

GitLab patched a CVSS 10.0 vulnerability in both Community Edition and Enterprise Edition that allowed unauthenticated remote attackers to execute arbitrary code on GitLab servers via a maliciously crafted regular expression in a CI/CD pipeline configuration. The flaw required no authentication, making it exploitable by any external attacker with network access to the instance. GitLab administrators should apply patches immediately given the maximum severity and unauthenticated attack surface.

The DOJ's Operation Lonestar Roundup charged 14 individuals for running a North Korean IT worker scheme that used stolen identities to infiltrate 70 U.S. employers and funnel approximately $3 million back to Pyongyang. Two arrests were made during a September federal operation targeting over 40 laptop farm locations in Texas. The scheme represents a continued DPRK strategy of using fraudulent remote workers to generate hard currency while potentially exfiltrating sensitive employer data.

Bitdefender researchers tracking a campaign dubbed 'Midnight Mimosa' found that low-cost Android smartphones built on MediaTek platforms across multiple brands are shipping with preinstalled firmware-level malware. The malware enables covert app installation, ad fraud, and enrollment of devices into residential proxy networks—all without user interaction. Because the malicious code is embedded in the device firmware, standard security tools and factory resets may be insufficient to remove it.

SAP disclosed a CVSS 10.0 flaw in its Cloud SDK for Python affecting multi-tenant applications on SAP Business Technology Platform (BTP), which can cause an app to send its OAuth2 client credentials to an attacker-controlled server. The advisory, published October 13, requires an attacker to control only the tenant subdomain to trigger credential exfiltration. Organizations running BTP services with the Python SDK in multi-tenant configurations should treat this as an urgent remediation priority.

GitHub discovered that a flaw in npm's trusted publishing feature allowed attackers to push new versions of packages they didn't own without stealing credentials, leaving over 1,500 packages vulnerable to hijacking. GitHub's remediation was to auto-expire unvalidated trusted publishing configurations 48 hours after creation, with configurations becoming permanent only after a successful publish. This supply-chain risk is particularly significant given npm's role in JavaScript dependency ecosystems worldwide.

Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI employee, was arrested and charged with using an electronic device to intercept oral communications after allegedly planting a hidden recording device in an executive conference room at OpenAI's San Francisco offices. The FBI and OpenAI confirmed the arrest, and Alfozan was subsequently terminated. The incident raises serious insider threat concerns for AI labs handling sensitive model development and strategic discussions.