Cybersecurity News — 2026-10-16

Generated: 2026-10-16 | Sources: Microsoft, BeyondTrust, Mandiant, Ivanti, Volexity, Palo Alto Networks, Cisco, CISA, Collabora, Nextcloud, Vercel, GreyNoise, Shadowserver, UK Legal Aid Agency, UK Foreign Office, Datatilsynet, The Hacker News, SecurityWeek, BleepingComputer, Krebs on Security

1. Microsoft Fixed a Record 1,411 Flaws, and One Was Already Being Used

Microsoft's monthly update — Patch Tuesday, the second Tuesday of each month — landed on 13 October carrying fixes for 1,411 separate flaws, the largest count it has ever shipped in one month, with 70 of them rated Critical. Three were zero-days, meaning they were known about before a fix existed. The one that should move you is CVE-2026-96951 in Windows Shell, which Microsoft says is already being used in attacks: it defeats Mark of the Web, the quiet tagging system that marks a file as having come from the internet and is the reason Windows warns you before opening a downloaded document. Beat that tag and a file arriving by email or download opens with no warning at all. The other two have been publicly described but not yet seen in attacks — one lets unauthorised code run inside a protected process by defeating Windows Defender Application Control, found by Google's Project Zero. Separately, two Windows versions stopped receiving security updates with this release, including Windows 11 24H2 Home and Pro.

Why it matters for your business: the headline number is not really the story, because you cannot act on 1,411 of anything. Two things here are actionable. First, let Windows Update run and restart the machines — a flaw that removes the "are you sure?" warning on a downloaded file undoes the one protection most staff actually rely on, and the only fix is the patch. Second, find out which version of Windows your machines are on (press the Windows key, type winver, press Enter). If anything reports 24H2 or older, it is now receiving no security updates, and every flaw found from here on stays open on it permanently. That is a budget conversation, not a technical one, and it is cheaper to have now than after an incident.

2. The Remote-Support Tool Your IT Provider Signs Into Has Been Attacked Since August

BeyondTrust Remote Support is the kind of product an IT company uses to take control of your screen when you ring them — powerful by design, because its whole job is to reach inside other people's computers. CVE-2026-102764 lets an attacker with no account at all bypass the login entirely and carry out file operations on the appliance. BeyondTrust patched its own hosted customers on 8 October; anyone running it on their own server has to apply the update themselves. The part that matters is the timeline: Mandiant, which found the attacks, says it has been exploited since late August, so there were roughly six weeks in which a vulnerable, internet-facing appliance could have been broken into with nothing available to stop it. In the incidents Mandiant examined the attackers installed a web shell — a small file that turns a web server into a remote command prompt — gained full administrative control of the appliance, erased the logs that would have recorded them, and then used stolen administrator passwords to move further into the network. Mandiant's guidance is unusually direct: any internet-reachable appliance that was running a vulnerable version during that window should be treated as possibly already compromised until somebody has checked. Several vendors attribute the activity to an espionage group they track under different names; those are the vendors' own assessments, described as suspected, not proven findings, and they change nothing about what needs doing.

Why it matters for your business: you almost certainly do not own one of these, and that is exactly the point — your IT provider might, and a compromise of it reaches every customer they support, including you. Send them one email this week: do you use BeyondTrust Remote Support or Privileged Remote Access, is it patched, and if it was exposed before 8 October has anyone checked it for intrusion? The broader habit is worth building. Make a short list of the suppliers who hold remote access into your systems, and accept that their security is now part of yours. Deleting access for a provider you no longer use is the cheapest item on that list.

3. An Ivanti VPN Flaw Was Chained With Two Others to Take Over Fully Patched Devices

Ivanti Connect Secure is a VPN appliance — the box that lets staff reach the office network from home. CVE-2026-104935 is an authentication bypass that needs no login, no user interaction and little skill to exploit. On its own that would be serious enough, but the security firm Volexity, which found it, reports something worse: the attacker combined it with two further flaws to achieve root-level control — complete ownership of the device — on appliances that were fully up to date at the time. Ivanti says it is aware of limited exploitation and is working with affected organisations; Volexity traces the activity to at least 3 October. The attacker's tradecraft is the instructive detail. They installed no malware and left no web shell behind, instead re-exploiting the device afresh for each command, and they edited the logs — which had the effect of defeating Ivanti's own Integrity Checker Tool, the utility customers are told to run to confirm a device is clean. Ivanti has fixed two of the three flaws in the chain; a privilege-escalation flaw used in the same sequence remains unpatched. Shadowserver counts over 5,500 of these appliances reachable from the internet, though some of those will already be secured.

Why it matters for your business: the lesson for a small business is about what "we checked and it was clean" is worth. A built-in health check run on a device the attacker already controls is being answered by the attacker, so a clean result is reassurance rather than evidence. If you have an Ivanti VPN, this is a job for today, and the question to ask your provider is not only "is it patched" but "what independent record do we have of what that device did in early October" — logs sent somewhere else, where they cannot be edited by whoever gets in. Centralised logging sounds like a large-company luxury; it is the one thing that lets anybody answer this question honestly.

4. A Palo Alto Firewall Flaw Being Exploited Reaches the Admin Page, Not the Internet Side

CVE-2026-0322 affects PAN-OS, the operating system on Palo Alto Networks firewalls and its Panorama management product, and lets an attacker run code as root — the highest level of control — on the firewall itself. Palo Alto found it internally, reports very limited exploitation, and has released patches; CISA added it to its catalogue of known-exploited flaws and gave US federal agencies until 17 October to fix it. One qualification matters a great deal: the attacker must already be authenticated, so this is not a flaw a stranger can fire at you blind. It is a flaw that turns a stolen or weak administrator password, or a disgruntled insider, into total control of the device guarding your network — and crucially it is in the management interface, the administrative web page, which has no business being reachable from the public internet in the first place. That connects this week's incidents. Every actively exploited flaw above except the Microsoft one is in something sitting at the edge of a network: a VPN, a remote-support appliance, a firewall's admin page, and the email gateway below. Those devices are attacked first because they are the only things an attacker can reach without an invitation.

Why it matters for your business: ask whoever manages your firewall two questions. Is it patched for this, and can its management page be opened from outside the office? If the answer to the second is yes, that is worth fixing whatever the patching position, because it converts "an attacker needs a password" into "an attacker needs a password and nothing else". Administration should require being on the office network or connected through a VPN. While you are there, confirm that the firewall's administrator accounts are individually named people with multi-factor authentication, not one shared admin password that three former staff members also knew.

5. A Cisco Email Gateway Is Being Attacked Through Attachments, and the Fix Has Existed Since September

Cisco Secure Email Gateway is an appliance that inspects incoming mail for malicious content before it reaches staff inboxes. CVE-2026-76519 scores 9.8 out of 10 and is about as bad as a flaw can be in practice: an attacker with no account simply sends an email with a crafted attachment, and the appliance — in the act of examining it for malware — writes files to its own operating system and runs commands as root. No one has to click anything. It affects attachment handling when the file-reputation feature is switched on with an older version of Content Scanner Tools. Cisco learned of active exploitation in October, has published indicators of compromise, has contacted customers whose devices showed signs of compromise, and warns that an attacker with root access may be able to conceal their activity. For virtual appliances its recovery advice is to build a new one on a fixed release and rebuild the configuration rather than clean up in place. The sharpest detail is the date: the fixes were released on 14 September, a month before exploitation became public. This is the second flaw in this product line to be exploited since mid-September.

Why it matters for your business: most small businesses use Microsoft 365 or Google Workspace for mail filtering and own no such appliance, so check whether this applies to you before worrying about it. The transferable lesson is about security that inspects things. Anything that opens attachments, scans uploads or renders previews is handling hostile input on purpose, which makes it a target rather than a safe haven — so protective products need patching at the same speed as the things they protect. And note that a fix had been sitting available for a month. Patching promptly is not about the day a vulnerability makes the news; by then the window has usually been open for weeks.

6. A Nextcloud Add-On Was Being Exploited For a Month Before It Had a CVE Number

Nextcloud is self-hosted file sharing — a business's own private alternative to Dropbox or Google Drive — and Collabora Online is the add-on that lets you edit documents inside it. CVE-2026-110447 is a command-injection flaw in the optional built-in CODE server component: an attacker sends a crafted request to one file and the server runs their commands, with no login and no user interaction needed. There is one prerequisite that makes it unpredictable rather than reassuring — the built-in server has to be stopped at the time, which happens routinely after a restart, an upgrade or a crash. Attackers installed web shells and used them to hunt specifically for password databases, password-manager files and cryptocurrency wallets. Some users have said ransomware operators are exploiting it, which BleepingComputer could not confirm. The timeline is the real story and it compounds the point from the Cisco entry above. The fix was committed on 9 September and released on 11 September; administrators began reporting attacks around 10 September; a community warning appeared on 3 October; the advisory and CVE number were only published on 14 October. Collabora attributes the delay largely to backlogs in CVE processing, which it links to a rising volume of AI-generated security reports. A study cited alongside it found the median gap between a public fix and its CVE publication grew from 5.1 days in January to 39 days in August. Standalone Collabora servers, Docker and package installs, and Nextcloud All-in-One are not affected; versions of the add-on before 26.4.303 are.

Why it matters for your business: waiting for a CVE number or a news story before updating is no longer a safe policy, because the gap between "the fix exists" and "the world is told why it mattered" has stretched to weeks. Two practical consequences. If you run Nextcloud, update the Collabora add-on now to 26.4.303 or later, and if you do not need it, remove it rather than merely disabling it — the vendor is explicit that disabling is not enough. More generally, prefer software that updates itself, and where you can't, subscribe to the vendor's own release notes or security mailing list. That is the earliest honest signal you will get.

7. Next.js Shipped Two Critical Website Flaws Out of Schedule — and `npm audit` Won't Flag Both

Next.js is one of the most widely used frameworks for building modern websites and web applications, so this reaches small businesses through whoever built their site. On 14 October its maintainers issued an unscheduled update fixing two flaws rated critical, both allowing code execution on the server, plus a third that lets a crafted request pin a server process at full processor load and block everyone else. The fixed versions are 16.4.1 and 15.5.28. As of 15 October there are no public reports of any of the three being used in attacks, which makes this the comfortable case — a real flaw, a fix available, time to act deliberately. Two practical wrinkles deserve naming. One flaw lives not in Next.js itself but in an image-handling library reached through a component called sharp, and updating Next.js on version 15 can leave the vulnerable older sharp in place underneath, so it has to be checked separately. And two of the three advisories were issued without a CVE number and do not appear in the npm advisory feed — which means the standard command developers run to check for vulnerable components, npm audit, will not report them.

Why it matters for your business: if your website or customer portal was custom-built, forward this to whoever maintains it and ask for a yes or no: are we on 16.4.1 or 15.5.28, and is sharp at 0.35.5 or later? The answer takes them minutes. The wider point is for anyone who has concluded that an automated dependency check is the same as being on top of updates. An advisory with no CVE number is invisible to those tools, so somebody still has to read the release notes of the handful of components your business genuinely depends on. If nobody owns that job, nobody is doing it.

8. Forgotten Network Boxes Are Being Broken Into to Resell the Business's Internet Connection

The threat intelligence firm GreyNoise found a campaign that breaks into internet-facing equipment and installs Pawns.app — a legitimate bandwidth-sharing application that pays people to let others route traffic through their connection. Installed without the owner's knowledge, it turns the business's internet line into a node in a commercial residential proxy network, and the attacker collects the payments. GreyNoise identified at least 143 compromised devices across 34 countries, and in some cases the attackers also set up SSH key access as a second way back in should the first be closed. The notable thing is what they broke in through: CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter network storage drives, Log4Shell — CVE-2021-44228, a flaw that was headline news five years ago — in Ubiquiti UniFi Video recorders, and a 2025 flaw in SAP NetWeaver. Hikvision and Dahua video recorders were also targeted. Not one of these is a new vulnerability. These are old, well-documented flaws in the category of equipment nobody has an owner for: a storage drive bought years ago, a camera recorder installed by whoever fitted the cameras, a box blinking in a cupboard that still works and so is never thought about again.

Why it matters for your business: the damage is quiet, which is why this runs for years — a slower connection, your business's address appearing in other people's abuse reports and fraud-detection systems, and the standing fact that someone else has administrative control of a device on your network. Spend half an hour walking your premises and listing every device that is plugged into the network but is not a computer or a phone: storage drives, camera recorders, printers, door entry systems, that old router. For each one, establish whether it still receives updates from its maker, and whether it can be reached from the internet. Anything that fails both tests should be taken off the internet or taken out. A device the manufacturer abandoned is not going to be fixed, however well it still does its job.

9. A UK Government Breach Turns Out to Have Exposed Records Going Back to 1978

The Legal Aid Agency, part of the Ministry of Justice, was hacked in April 2025 and announced the breach in May 2025 without stating its full extent. An incident update this month sets out what forensic work has since established, and the scope is far wider than first described: compromised records date back to 1978, with roughly 250,000 of them predating 2007, though most relate to applications, claims and payments between 2007 and 2025. The data involved is unusually sensitive for the people concerned — for applicants, names, addresses, dates of birth, National Insurance numbers, case reference numbers and phone numbers; for legal practitioners, contract details, office locations, payment details and account credentials; and for a smaller number of probation service users between 2010 and 2017, names, dates of birth, nationalities and case references. The agency says it has no evidence the stolen information has been published or sold. Its explanation for the eighteen months it took to establish this is the part every business should read twice: the data was unstructured, fragmented or incomplete, so working out what had been taken was itself a major exercise.

Why it matters for your business: this is the clearest illustration you will get of why data retention is a security control and not a filing preference. Every one of those 1978 records was a liability sitting in storage long after it could serve any purpose, and the inability to say what was held is what turned a breach into an eighteen-month investigation. Do two things. Pick your three largest stores of customer or staff data and decide, in writing, how long each is kept and what happens at the end — then actually delete to that rule, because an undeclared "we keep everything" is the finding, not the defence. And make sure somebody could produce a plain list of what personal data you hold and where within a day. If that would take you weeks, you have discovered the same problem while it is still cheap to fix.

10. The UK Has Sanctioned a Crypto Payment Processor, Which Changes What a Ransom Payment Means Legally

On 8 October the UK sanctioned Cryptomus — formerly Certa Payments and Xeltox Enterprises, and renamed Heleket last year — along with the payment platforms VexPay, TokenSpot and Tsunami Payments. Cryptomus is a cryptocurrency payment processor that the UK says handles payments for dozens of Russian exchanges and for sites selling cybercrime services, and that has processed payments tied to ransomware, fraud and darknet markets; TRM Labs puts more than $7 billion in transactions through it since 2022 linked to serious criminal networks. The direct legal consequence is plain: any Cryptomus assets held at UK banks are frozen, and British companies are barred from doing business with it in any form. This is one of the few places where attribution genuinely changes a UK business's obligations rather than merely colouring the story. Paying a ransom is not in itself illegal in the UK, but paying money to a sanctioned entity is a serious legal matter in its own right — and ransom payments are routinely routed through exactly this kind of processor.

Why it matters for your business: if you are ever in a ransomware incident, the question "who exactly would receive this money, and are they sanctioned" has to be answered before any payment, by somebody competent to answer it — your insurer, your solicitor or a specialist incident-response firm — and the answer kept in writing. That is far easier to arrange before an incident than during one. It also sharpens a point from last week's indictment of a ransomware recovery firm: you cannot assess a sanctions risk you do not know about, so any provider you engage must be contractually required to tell you before communicating with or paying an attacker, not after. Check now whether your cyber insurance names an incident-response firm, because in a crisis that is who you will be dealing with.

11. An Advertising Firm Was Fined €8.6 Million for Trusting Someone Else's Consent

Norway's data protection authority has fined the advertising technology firm Xandr, now owned by Microsoft, 92 million Norwegian kroner — about €8.6 million — its largest fine to date, announced on 12 October. Between July 2018 and April 2020 Xandr ran real-time advertising auctions inside the dating app Grindr, a process that relayed user data to potentially thousands of companies. Because simply using that app indicates a person's sexual orientation, the regulator held that the data was sensitive and required explicit consent. Xandr's defence was that it believed Grindr had obtained consent from users. The regulator rejected that reasoning in terms worth remembering: it found Xandr was a joint controller of the data rather than a passive pipe, gained a direct financial benefit, and therefore had its own duty to check that valid consent existed — companies cannot, as the authority put it, simply blame one another. The fine was calculated on Xandr's own turnover because the conduct predates Microsoft's ownership, and the long duration of the practice counted against it. Xandr has three weeks from receiving the decision to appeal.

Why it matters for your business: the reasoning here applies directly to a small business using analytics, advertising pixels, a booking system or an AI tool, and it is the opposite of what most owners assume. Clicking through a supplier's terms does not transfer your responsibility to them; where you both benefit from the data, you both answer for it. So before you add the next tracking script or connect customer records to a new service, establish what legal basis you are relying on and whether your privacy notice and cookie banner actually say it is happening. Pay particular attention to anything that reveals something sensitive by implication — health, sexuality, religion, trade union membership — because data does not have to state a fact outright to be treated as revealing it. A list of visitors to one page of a clinic's website is health data.

Sources

Summaries are compiled from public threat-intelligence feeds and security news sources. This digest is for awareness purposes only and does not constitute professional security advice.

Cybersecurity News