📡 Tech & Security Digest — 2026-10-14
Curated from Hacker News, security blogs, and tech publications.
BleepingComputer
- Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days — Today is Microsoft’s October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and …
- Ivanti warns of Connect Secure zero-day exploited in attacks — Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access g…
- Ghostscript flaw lets hackers hijack servers via PDF uploads — A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution t…
- SAP warns of maximum severity OAuth2 SSRF security flaw — SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the C…
- Docker Hub flaw let attackers impersonate users, tamper with images — Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user’s container repositories using a …
Hacker News
- Character.ai has initiated voluntary Chapter 11 bankruptcy (324 pts)
- OpenAI engineer arrested in bugging of executive conference room (597 pts)
- Show HN: Use your OpenAI subscription to create audiobooks (164 pts)
Krebs on Security
- FBI Arrests Executive at Ransomware Negotiation Firm — Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an inves…
- Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch…
- ShinyHunters Extorted Boeing Spin-off Prior to Arrests — A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooper…
- Two Alleged ‘TeamPCP’ Hackers Arrested in Australia — Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrati…
The Hacker News
- Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch — Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within…
- Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE — A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstac…
- Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments — Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code exec…
- Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far — An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Vol…
- Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer — Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote acces…
- Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access — Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives a…
- Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) ca…
- Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own — Three research teams broke into Google’s Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fu…
- SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft — A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a&nbs…
- Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug — Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has c…