Duna's Kiat
All editions
News

CyberNews: 14/10/2026 Edition

Today’s roundup

  • Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
  • Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
  • SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
  • Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
  • AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
  • GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
  • Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
  • European Retail Firms Confirm Cyber Incidents
  • Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
  • Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation

    • Summary

    Microsoft's October Patch Tuesday fixed a record 1,413 vulnerabilities, including an actively exploited Windows Shell bug. The release covers 1,102 Windows flaws, 134 in Office, 61 in developer tools, 36 in SharePoint Server and 22 in SQL Server; more than 670 are privilege escalation bugs.

    Volexity said on October 13 that an attacker chained three Ivanti Connect Secure zero-days to run commands as root without logging in. Ivanti has fixed two of them and urged customers to act immediately; the fix for the third is still pending.

    SAP disclosed a CVSS 10.0 flaw in its Cloud SDK for Python that can send an application's OAuth2 client credentials to an attacker-controlled server. It affects multi-tenant applications on SAP Business Technology Platform and requires the attacker to control the tenant subdomain.

    Docker fixed on September 30 a two-year-old Docker Hub flaw in the account-to-organization conversion feature that let one user push, pull or delete images as another user. Docker found no evidence of exploitation.

    Tencent Zhuque Lab found Vghost (CVE-2026-74580), a flaw in the Linux kernel's vhost subsystem present for nearly a decade that lets a local user read and write kernel memory and become root. In one virtualization setup, an untrusted virtual machine can write to host memory and hijack the program running it.

    GitHub now expires unvalidated npm trusted publishing configurations 48 hours after creation, after researchers showed that an attacker could publish new versions of another user's package without stealing credentials, leaving more than 1,500 packages exposed to hijacking.

    XBOW researchers chained three previously unknown Google Chrome bugs into a full-chain exploit that runs code on Windows when a user simply loads a web page, building it in six days with AI agents running OpenAI's public GPT-5.6 Sol model. Google confirmed and fixed all three bugs and paid a $250,000 bounty.

    Several European retail firms confirmed cyber incidents, while H&M said it is investigating such claims.

    ThreatFabric detailed Hirudo, a new Android banking trojan that replaces legitimate banking apps, including eight Indonesian ones, with patched versions designed to bypass the apps' own built-in security checks.

    Norway's data protection authority fined Microsoft-owned advertising unit Xandr a record €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data, which can reveal sexual orientation, to advertisers.

    Want to dig deeper?

    Vulnerabilities

    CVE-2026-74580 High