Article Read Time
1. Ivanti Connect Secure Zero-Day Gives Attackers Root Access, CISA Orders Immediate Patching
A high-severity authentication bypass in Ivanti Connect Secure (CVE-2026-104935) has been exploited since early October, with Volexity tracking a threat actor that chained it with two other flaws to gain unauthenticated root-level code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until Friday to secure their networks. Post-exploitation activity targeted Active Directory credentials, LAPS passwords, and BitLocker recovery keys, and Ivanti’s Integrity Checker Tool may miss the intrusion because the commands run in memory.
Source: BleepingComputer URL: https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day/
2 Microsoft Ships a Record 1,413 Fixes, Including an Exploited Windows Zero-Day
Microsoft’s October Patch Tuesday set a new record at 1,413 CVEs, pushing the 2026 total past 4,000. One flaw, CVE-2026-96951, is a Windows shell bypass of Mark of the Web protections that is already under active attack, allowing malicious files to run without the usual SmartScreen and Protected View warnings. CISA added it to the Known Exploited Vulnerabilities catalog with an October 16 deadline for federal agencies.
Source: SecurityWeek URL: https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/
3. Compromised ConnectWise Credential Used to Sign In to 173 Microsoft 365
Tenants Attackers used a compromised application credential tied to ConnectWise Cloud Backup, formerly SkyKick, to sign in to Microsoft 365 tenants belonging to ConnectWise partners and their customers on October 15. Huntress confirmed 173 affected tenants, and ConnectWise suspended application access, which froze the product for partners. The company says it has no indicators that backup data was compromised, though the full scope of accessed Microsoft 365 data remains unconfirmed.
Source: The Hacker News URL: https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
4. Meta Confirms Hackers Took Source Code and Personal Data of 1,500 People from GitHub
Meta disclosed that an outside group used an employee’s stolen credentials to reach some of its GitHub repositories. About 99 percent of the exposed data was business data, mainly software code, while the remainder was personal data that had been added to the repositories against company policy. Roughly 1,500 people, most of them U.S.-based employees, are being notified and offered credit and dark web monitoring.
Source: SecurityWeek URL: https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/
5. UK Legal Aid Agency Breach Reached Records Dating Back to 1978
An updated government assessment of the 2025 Legal Aid Agency breach found that attackers took about 250,000 records from before 2007, including legal aid assessments from 1978 and probation data covering offenders supervised between 2010 and 2017. The stolen records include National Insurance numbers, financial details, and in some cases criminal charge and sentencing information. The Ministry of Justice says it has no indication the data has been published, and notes that a record count does not equal a count of affected individuals.
Source: The Register URL: https://theregister.com/security/2026/10/15/legal-aid-agency-hackers-made-off-with-records-dating-back-to-1978/5303243