Sam's News — security — 2026-10-14¶

Security¶

8.5 Microsoft Patches Record 1,413 Vulnerabilities Including Actively Exploited Windows Zero-Day¶

Microsoft released patches for a record 1,413 vulnerabilities, including a critical Windows security feature bypass flaw currently being exploited in the wild.

1,411 vulnerabilities patched—largest Patch Tuesday to date
70 vulnerabilities rated Critical; 57 involve remote code execution
CVE-2026-96951: Windows Shell Mark of the Web bypass, actively exploited
CVE-2026-108398: .NET Framework flaw; third zero-day in MessagePack-CSharp serialization library
Release coincides with Windows support deadlines requiring OS upgrades

Sources: SecurityWeek RSS Update to: Microsoft October 2026 Patch Tuesday addresses record 1,411 vulnerabilities including 3 zero-days

8 AI-Discovered Linux Kernel Vulnerability Allows Local Root Access and VM Escape¶

A critical Linux kernel vulnerability (CVE-2026-74580, 'Vghost') discovered by AI analysis allows local users to escalate privileges to root across nearly a decade of kernel versions (4.11–7.2-rc4). In certain virtualization setups, untrusted guest VMs can escape to the host hypervisor. The flaw stems from a stale cache of memory mappings dating to 2017, with a second error in 2020.

Vghost affects Linux 4.11 through 7.2-rc4—nearly 10 years of releases
Allows local root escalation and potential VM-to-host escape in specific configurations
Root cause: vhost fails to invalidate cached memory mappings when ring reconfigured
Flaw originated 2017 (cache added), compounded 2020 (bounds check removed)
Tencent published proof-of-concept October 12; Ubuntu, RHEL, Amazon Linux, Azure Linux, Oracle Linux vulnerable; world-readable vhost device on 4 of 5 distros tested

Sources: The Hacker News AI Web Searched

8 International law enforcement disrupts cybercriminal ecosystem behind 1 billion phishing messages¶

International law enforcement disrupted a Chinese-language cybercriminal ecosystem responsible for over 1 billion phishing messages targeting 75,000+ organizations across 150 countries. Microsoft and Japan's NPA led the takedown, seizing domains and disabling 20,000+ accounts connected to YAM Store.

1+ billion phishing messages across 150 countries since January 2026
750+ million messages targeted Microsoft customers specifically
Over 20,000 YAM Store accounts disabled; 100,000+ impersonation domains blocked
Targets: consumers, healthcare, financial institutions, logistics, IT sectors
Coordinated by Microsoft, Japan NPA, JC3, Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs

Sources: Microsoft On the Issues AI Web Searched, CyberScoop AI Web Searched, Microsoft Security Blog AI Web Searched, BleepingComputer RSS

8 Researchers weaponize public OpenAI model to build zero-day Chrome exploit in six days¶

XBOW researchers used OpenAI's publicly available GPT-5.6 Sol model to chain three Chrome zero-days into a full exploit in six days, costing ~$40,000 in AI charges. Google awarded the maximum $250,000 bounty after confirming and fixing all three vulnerabilities.

Exploit built in 6 days (August 2–7, 2026) using public GPT model
AI charges cost approximately $40,000 per usage logs
Google awarded maximum $250,000 bug bounty
Vulnerabilities: CVE-2026-85045 (V8), CVE-2026-78952 (WebP decoder), and one unpatched Chrome component
Before LLMs, comparable exploit required ~4 engineers over 6–9 months

Sources: The Hacker News AI Web Searched

7.5 SAP Patches Critical NetWeaver and S/4HANA Vulnerabilities Allowing Code Execution¶

SAP released patches for 22 security vulnerabilities on October 14, including four critical flaws affecting NetWeaver, S/4HANA, and Cloud SDK. CVE-2026-89111 (CVSS 10/10) is an OAuth2 SSRF allowing credential exfiltration; CVE-2026-89110 and CVE-2026-89107 enable unauthenticated or authenticated code execution and full system compromise.

22 security notes released October 14; 4 critical vulnerabilities patched
CVE-2026-89111 (CVSS 10/10): OAuth2 SSRF in Cloud SDK for Python BTP applications
CVE-2026-89110 (CVSS 9.9/10): broken access control in NetWeaver Visual Composer portal
CVE-2026-89107 (CVSS 9.9/10): code injection in S/4HANA via Fiori rule definition
CVE-2026-89108 (CVSS 9.1/10): missing auth check in Manufacturing Integration and Intelligence
No wild exploitation reported; immediate patching advised

Sources: SecurityWeek AI Web Searched

7.5 Researchers Break Into Windows SmartScreen Enclave via Write Vulnerability and Timing Bug¶

Doyensec researchers executed arbitrary code inside a Windows VBS enclave protecting SmartScreen using a four-byte write flaw and timing side-channel attack. Microsoft patched the vulnerability (CVE-2026-83498, CVSS 7.8) in September; Doyensec published research on October 13, over a month after the fix.

Four-byte write flaw in SFAPE.dll Initialize function; timing side-channel in second function
Exploits required local access and low-level privileges; cannot be exploited remotely
Enclave stores hashed Windows sign-in passwords to detect unsafe credential entry
Microsoft patched September 8 before public disclosure
Not exploited in wild; Microsoft rated CVE-2026-83498 Critical (CVSS 7.8)

Sources: The Hacker News AI Web Searched

7.5 CISA warns of actively exploited Ivanti Connect Secure zero-day vulnerability¶

CISA warned of an actively exploited zero-day in Ivanti Connect Secure (CVE-2026-104935, CVSS 8.6) allowing remote unauthenticated code execution. Federal agencies ordered to patch by October 16; honeypot sensors observed 105 exploitation attempts from 50 unique IPs as of October 14.

CVE-2026-104935 affects ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior
CVSS score 8.6; allows remote unauthenticated arbitrary code execution
105 exploitation attempts from 50 IPs (Singapore, US) as of October 14
Threat actor UTA0576 used X-DSCGI-PATH header to upload Perl scripts as ZIP files
Sixth Ivanti vulnerability exploited in 2026; patching deadline October 16 for federal agencies

Sources: Recorded Future News AI Web Searched, The Hacker News AI Web Searched, BleepingComputer RSS

7 Microsoft eliminated more bugs in one month via AI than all of 2025¶

Microsoft fixed a record 1,413 vulnerabilities in its October 2026 Patch Tuesday, exceeding the total for all of 2025, driven by AI-assisted vulnerability discovery. The update included 1,102 Windows bugs, 78 critical flaws (65 enabling remote code execution), and addressed a Windows Shell zero-day actively exploited in the wild.

October 2026 Patch Tuesday: 1,413 vulnerabilities fixed—exceeds entire 2025 total
1,102 Windows bugs, 134 Office vulnerabilities, plus SharePoint, SQL, Exchange, and developer tools fixes
78 critical vulnerabilities patched: 65 RCE, 11 elevation-of-privilege, 2 spoofing
Windows Shell zero-day actively exploited; CISA ordered federal agencies to patch by October 16
AI-assisted tools drove record volume; Microsoft proposing 'risk cohorts' strategy for prioritization

Sources: Cybernews AI Web Searched

7 Chrome and Firefox Release Updates Patching 114 Vulnerabilities; Mozilla Launches Firefox Enterprise¶

Chrome and Firefox have released updates addressing 114 flaws, while Mozilla introduces Firefox Enterprise for organizations with strict compliance requirements.

Sources: SecurityWeek RSS

7 Citrix, Fortinet, and Ivanti Release Patches for 29 Critical Vulnerabilities¶

Citrix, Fortinet, and Ivanti have patched 29 vulnerabilities that could enable authentication bypass, code execution, and credential leaks.

Sources: SecurityWeek RSS