Briefing — 14 October 2026

🎧 Subscribe to the podcast feed | Direct audio link

Security News

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (BleepingComputer) — One of the largest single patch releases in Microsoft history; three zero-days were already exploited before patches dropped.

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN (SecurityWeek) — A chained zero-day in Ivanti Connect Secure allows root-level access on fully patched appliances with active exploitation confirmed in the wild.

Ghostscript flaw lets hackers hijack servers via PDF uploads (BleepingComputer) — A critical RCE vulnerability in the Ghostscript PDF rendering library allows server takeover through maliciously crafted document uploads.

Ransomware Gangs Embrace Physical Threats, Family Stalking (Dark Reading) — Documented cases of ransomware operators surveilling executives' homes and following family members as a negotiation pressure tactic.

North Korean hackers target Ukrainian experts for intelligence on Russia's war (The Record) — DPRK-linked threat actors are phishing Ukrainian defence and government officials to gather battlefield intelligence on the Russia-Ukraine conflict.

Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue (The Record) — DOJ operation dismantles infrastructure used to run North Korean IT worker scams generating millions in illicit revenue.

Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts (Slashdot) — Hardware supply chain attack confirmed: physical devices were intercepted and modified with covert chips before reaching customers, enabling cryptocurrency theft.

FBI Arrests Saudi OpenAI Employee For Planting Recording Device In Conference Room (Slashdot) — A current OpenAI employee of Saudi nationality arrested for placing a covert recording device inside a company conference room.

FBI Arrests Canadian Cybersecurity Expert In ShinyHunters Hacking Case (Slashdot) — A Canadian cybersecurity researcher arrested in connection with the ShinyHunters group, responsible for numerous major data breaches.

Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach (SecurityWeek) — Hackers exfiltrated source code and personal data belonging to approximately 1,500 Meta employees via a GitHub repository breach.

Docker Hub flaw let attackers impersonate users, tamper with images (BleepingComputer) — A Docker Hub vulnerability allowed attackers to impersonate legitimate users and modify container images, posing a supply chain risk.

Adobe Patches 176 Vulnerabilities Across 11 Products (SecurityWeek) — Adobe's October patch batch covers 176 vulnerabilities across eleven products.

Sandbox vulnerability gives rogue AI agents a path to escape and leak data (The Record) — New research demonstrates a sandbox escape vulnerability in AI agent frameworks allowing rogue agents to exfiltrate data beyond their intended scope.

UK & Critical National Infrastructure

TFG London cyberattack disrupts systems at Hobbs and Whistles retailers — A cyberattack against TFG London has disrupted IT systems across fashion retailers Hobbs and Whistles, affecting retail operations.

BMT IQ (UK) — N0n ransomware victim — BMT IQ, a UK-based marine surveying and inspection company, appears on N0n's victim list as part of the group's ongoing global maritime campaign.

Cyberattack halts construction of Denmark-Germany tunnel — A cyberattack disrupted systems supporting construction of the Fehmarnbelt undersea tunnel, halting work on a major European transport infrastructure project.

No new NCSC advisories were issued in the past 48 hours.

Ransomware Victims (48h)

100 victims · 21 groups