Google moved Chrome's desktop Stable channel to 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux on 13 October 2026 (US time), rolling out over the coming days and weeks. The release carries 37 security fixes: seven rated critical, 29 high and one medium. The critical ones are a buffer overflow in the ANGLE graphics layer (CVE-2026-110152, reported by Zhenpeng (Leo) Lin of depthfirst) and use-after-free bugs in Browser (CVE-2026-110149), PDF (CVE-2026-110136), Network (CVE-2026-110161), Core (CVE-2026-110165), SVG (CVE-2026-110148) and Media (CVE-2026-110151). High-rated fixes include a V8 type confusion (CVE-2026-110140), V8 use-after-free bugs (CVE-2026-110168 and CVE-2026-110169, the second reported by Xinyang Ge of Anthropic with help from Claude), a privilege elevation in the installer (CVE-2026-110150), incorrect authorisation in the updater and Mojo, and several Passwords bugs including an information leak (CVE-2026-110146). Many of the bugs were reported by Xinyang Ge. Google's post does not say any of them are being exploited. The Extended Stable channel moved to 152.0.7977.167 for Windows and Mac the same day with 28 of the fixes, including the PDF, Network and SVG critical bugs. Chromium-based browsers such as Microsoft Edge, Brave and Opera take these fixes in their own releases. Primary: Chrome Releases blog.
Chrome Releases — Stable Channel Update for Desktop, 155.0.8059.79/.80 (13 Oct 2026)
CISA published ICS advisory ICSA-26-286-02 on 13 October 2026 for the Swann Communications SWIFI-SE2KIC, a product of the Australian-headquartered security camera maker. Firmware 2.0.22 and earlier has three missing-authentication flaws (CWE-306). CVE-2026-107605 lets an attacker on the local network view the live video feed without logging in; CVE-2026-107606 lets them retrieve a snapshot of the live feed; and CVE-2026-107607 lets them open a real-time video stream. CISA scores them 6.2 (CVSS 3.1, Medium) and 5.9 to 6.9 (CVSS 4.0). CISA says the flaws are not exploitable remotely and no public exploitation has been reported. The advisory lists no fixed firmware. Swann's interim advice is to keep the camera behind a secured router and firewall, never expose its RTSP service to the internet through port forwarding, DMZ or a public IP, use strong unique router and account passwords, and install firmware updates when they arrive. Elliott Phillips reported the flaws. CISA lists the products as deployed worldwide in commercial facilities; Swann cameras are also common in Australian homes and small businesses.
The US Department of Justice said on 13 October 2026 that Abdulrahman Alfozan, 35, a Saudi national who had worked as an OpenAI engineer since July 2025, was arrested on 9 October and charged with using or trying to use a device to intercept oral communications. According to the complaint, OpenAI staff found a covert audio recording device on 30 September plugged into a USB port behind a television in an executive conference room in one of its San Francisco buildings. The device was wrapped in toilet paper, had been installed around 28 September and stored encrypted data. The room was used for meetings on proprietary research, product plans, business relationships and government work. Prosecutors say camera footage showed Alfozan near the room several times though he was not invited to meetings there; that he searched an internal productivity tool for office, meeting-room and executive schedule details; that a chatbot account linked to his spouse asked how to build and hide recording devices, including prompts naming the device's custom header and MAC address; and that on 5 October he returned to check behind the television, the same day security staff found a second similar recorder in a bag he left in another room. In a statement on X, OpenAI said it used its own AI models 'to understand the device and where it had come from' and referred the matter to the FBI after finding an employee had planted it, and it told TechCrunch it has no indication he accessed or took model weights, source code or customer data (as reported by The Hacker News, which says he has since been terminated). The charge carries up to five years in prison. UPDATE (19 Oct US time; Reuters via iTnews, 20 Oct): asking a judge to keep Alfozan in custody as a flight risk, federal prosecutors allege in a detention memo that he was in frequent contact with an unnamed member of the Saudi royal family, who had tried to recruit him for an AI role in Saudi Arabia, and that a Saudi military official paid for one-way flights for his wife and young son to return to Saudi Arabia after his arrest. Prosecutors say he built customised, encrypted recording devices to secretly record highly sensitive meetings involving senior OpenAI staff, business counterparts and government officials; meetings with government officials took place in the conference room around the time the device was installed. Before his arrest he had planned to fly to Riyadh during two months of parental leave. Prosecutors say the investigation remains active and further charges could follow. His lawyer says the planned trip was booked before any investigation, for family and immigration reasons, and has asked for his release on conditions; the Saudi government media office did not respond to Reuters. UPDATE (20 Oct; court filing via The Hacker News): a US court granted the government's request to keep Alfozan in detention on Monday 19 October (US time). The filing says photos on his iPhone dated 22 to 28 September show another concealed recording device and the TV input panels in OpenAI buildings, including a second conference room used for sensitive meetings; parts matching the devices were found at his home; and he opened a folder named "Saudi Gov Docs" on 4 October and used an OpenAI productivity agent to look up Saudi government engagements. His wife and son had already left the US before his planned 12 October one-way flight to Riyadh.
US Department of Justice — Saudi national arrested for installing surreptitious audio recording device at OpenAI (13 Oct 2026)
Fortinet's FG-IR-26-180, published on 13 October 2026, fixes CVE-2026-106173 in FortiSIEM. Fortinet titles it an arbitrary file write in the gRPC phQueryMaster service and describes a path traversal (CWE-22) that may let an unauthenticated attacker execute unauthorised code or commands with specially crafted packets. It rates the flaw Critical, 9.4 (CVSS 3.1). Only FortiSIEM 7.5.0 is listed as affected; 7.6 is not affected and FortiSIEM Cloud is not affected. The fix is 7.5.1. Fortinet gives a workaround: restricting access to TCP port 27918 prevents the issue. The flaw was found internally by Fortinet's product security team, and the advisory marks it as not known to be exploited. FortiSIEM collects logs and credentials for the systems it monitors and is widely run by managed security providers, and older FortiSIEM bugs have been exploited soon after disclosure, so a SIEM that accepts traffic from untrusted networks is worth treating as urgent. Released in the same Fortinet monthly batch as the critical FortiSandbox flaw CVE-2026-107656 (its own card). UPDATE (20 Oct, Horizon3.ai): Horizon3.ai published a technical analysis and released working exploit code on GitHub. It found the phQueryMaster gRPC service on TCP 27918 listens on all interfaces and does not ask clients for a certificate, so anyone who can reach the port can call it without logging in. Its SendQueryResult handler builds a file path from an attacker-supplied query-id without validation, so '../' sequences pick the directory, and a NUL byte in the query-id cuts off the file name the server would otherwise append, letting an attacker overwrite an existing file in place while keeping its owner and permissions. Horizon3.ai's exploit overwrites /opt/charting/redishb.sh, a Redis health-check script cron runs every 60 seconds, which turns the file write into code execution; a second variant creates a new file with an exact name. Horizon3.ai says no FortiSIEM application log clearly shows the attack. Fortinet's advisory still marks the flaw as not known to be exploited (checked 21 Oct). Wire: The Hacker News (20 Oct).
Fortinet PSIRT FG-IR-26-180 — FortiSIEM arbitrary file write in gRPC phQueryMaster (13 Oct 2026)
Fortinet published FG-IR-26-185 on 13 October 2026 for CVE-2026-107656, a critical authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox web management GUI. A remote, unauthenticated attacker can send crafted HTTP requests to get past authentication, and Fortinet lists the impact as executing unauthorised code or commands. It rates the flaw 9.6 (CVSS 3.1). FortiSandbox 5.0.0 to 5.0.6 and 4.4.0 to 4.4.9 are affected, as are FortiSandbox PaaS 5.0.0 to 5.0.6 and every PaaS 4.4 release; the 5.2 branch is not affected. Fortinet's product security team found it internally, and Jason McFadyen of TrendAI Research also reported it. The advisory marks it as not known to be exploited. It was part of Fortinet's 13 October monthly PSIRT release, which also fixed a separate critical FortiSIEM flaw (CVE-2026-106173, its own card) and lower-rated FortiSandbox, FortiOS, FortiManager, FortiAnalyzer and FortiMail issues. FortiSandbox sits in the mail and web inspection path and holds samples of suspicious files, so an exposed admin interface is a high-value target. Wire: Cyber Security News (13 Oct).
Fortinet PSIRT FG-IR-26-185 — FortiSandbox improper access control and session management in the web management interface (13 Oct 2026)
The UK Housing Ombudsman Service, the public body that settles disputes between social housing residents and landlords in England, said on 13 October 2026 that a third-party IT security incident affected its case management system. It says the incident is contained and it is working with its external supplier to establish the facts, including the extent of the data involved, and is still investigating whether personal information was affected. In an email bulletin sent the same day (13 October, 11:20 BST), it told recipients that "some contact details such as name, address, telephone number and postal addresses may have been copied" from its system and that this may include their data. It has reported the incident to the Information Commissioner's Office. While systems are restored, residents cannot submit a new complaint, view an existing complaint or use web chat and the web form, and are asked to email or phone instead. The service has not named the supplier, and BleepingComputer reported no claim of responsibility. Correction (22 Oct 2026): an earlier version said only that the Ombudsman was checking whether personal data was affected. Its 13 October email bulletin to people on its mailing list says some contact details, such as names, addresses and telephone numbers, may have been copied. (source: Housing Ombudsman Service email bulletin, 13 Oct 2026) UPDATE (22 Oct 2026): Housing Today reported on 21 October that the Ombudsman's online services were still offline, its website notice was unchanged and it had 'no further comment'. (source: Housing Today, 21 Oct 2026)
Housing Ombudsman Service — Statement: IT Security Incident (13 Oct 2026)
Microsoft's October 2026 security updates, released on 13 October 2026, fix one actively exploited zero-day and two publicly disclosed flaws. CVE-2026-96951 is a Windows Shell security feature bypass (command injection) that lets an unauthenticated attacker get around Mark of the Web protections over a network once a user opens a crafted file or link; Microsoft rates it Important, CVSS 8.8, and marks it 'Exploitation Detected'. It has not said who reported it or how it was used. CVE-2026-108398 is a .NET Framework untrusted search path flaw (CVSS 8.8) that lets a local, authenticated attacker register a crafted .NET assembly for loading by a protected process and bypass Windows Defender Application Control (WDAC); it was publicly disclosed and found by James Forshaw of Google Project Zero, but is not marked exploited. CVE-2026-92707 is a publicly disclosed MessagePack-CSharp denial of service (CVSS 5.3). BleepingComputer counts a record 1,411 flaws fixed on Patch Tuesday itself, 70 of them Critical (57 remote code execution), not counting 348 cloud and other fixes released earlier in the month. Critical remote code execution bugs rated CVSS 9.8 by Microsoft include Windows DHCP Server (CVE-2026-96934), Windows Message Queuing (CVE-2026-100202), Microsoft QUIC (CVE-2026-100219, CVE-2026-105016), Windows Text Shaping (CVE-2026-97814) and several Outlook bugs, all rated 'Exploitation Less Likely'. October is also the last update for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016. UPDATE 15 October: the WA Government's Cyber Security Unit (WASOC) issued advisory 20261015001 for CVE-2026-96951, saying Microsoft is aware of exploitation and CISA has added it to its Known Exploited Vulnerabilities catalogue. WASOC has had no reports of exploitation on WA Government networks and recommends applying Microsoft's fix within expected timeframes. UPDATE 16 October: Microsoft added a known issue to the KB5127648 release notes for Windows 11 24H2, 25H2 and 26H2: after the update, some devices cannot turn Smart App Control back on in the Windows Security app if it was off, and the option may be greyed out. Devices that already have Smart App Control on are not affected and stay protected. Microsoft gives a registry workaround and two Feature Preview Group Policies for managed devices, and says a fix will come in an upcoming release. Separately, on 13 October MSRC published a blog proposing 'risk cohorts': provisional groups of CVEs that need the same check of a customer's environment (for example, 64 RDP client, gateway and server CVEs share the question of which roles are deployed and exposed; an Office cohort of 119 CVEs includes 23 rated Critical and 17 needing no user interaction). MSRC says these are not a new classification or prioritisation framework, do not change its update guidance, and do not appear in the Security Update Guide for now. UPDATE 16–17 October: Microsoft's NTLMv1 guidance (KB5066470) and message-centre post MC1508562 say the October 2026 update changes a default by design: on Windows 11 24H2, 25H2 and 26H2 and Windows Server 2025 devices without Credential Guard, if the BlockNtlmv1SSO registry value has never been set, Windows now uses Enforce mode instead of Audit mode and blocks NTLMv1-derived single sign-on credentials. Microsoft says this is a planned change, not a known issue, but it can break Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2 (for example PEAP-MSCHAPv2) on domain-joined devices; The Register (16 Oct) reported it, and at least one university says Windows clients lost access to its MS-CHAPv2 wireless network. The temporary workaround is to set HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\BlockNtlmv1SSO (REG_DWORD) to 0, which allows the requests and logs warning Event ID 4024; blocked attempts log Event ID 4025. Microsoft says Audit mode should only be a scoped, temporary exception. UPDATE 16–19 October: Microsoft's Windows release health dashboard (issue opened 16 Oct, status Mitigated) and the Exchange Team blog (16 Oct) say the October 2026 Windows Server updates can make on-premises Exchange Server 2016, 2019 and Subscription Edition unstable: users may be unable to sign in to Outlook on the web (OWA), mail sent from Outlook can stay in the Outbox, mail queues grow, mailbox replication can fail and some DAG members cannot reach quorum. OWA may show 'MapiExceptionMdbOffline ... (hr=0x80004005, ec=1142)' with Event ID 1006. The cause is a new default limit on Endpoint Mapper memory (512 simultaneous Endpoint Lookup calls), which busy Exchange servers can exceed. The affected updates are KB5126646 (Server 2025), KB5126655 (Server 2022), KB5126651 (Server 2019) and KB5126868 (Server 2016). Microsoft says this is not caused by the October Exchange security updates, impact depends on server load and some servers may never see it, and customers should not uninstall the Windows updates. Its temporary workaround is to set HKLM\SOFTWARE\Microsoft\Rpc\EpmapSavedContextCap (REG_DWORD) to 65536, reboot, and raise it if the problem returns; a further mitigation is available through Microsoft Support for business, and a fix is under investigation. BleepingComputer reported it on 19 October.
Microsoft Security Response Center — October 2026 Security Updates release notes (13 Oct 2026)
Microsoft Windows Command Injection Vulnerability. Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability. Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
The Foschini Group told JSE shareholders on 13 October 2026 that its UK business, TFG London, identified a cybersecurity incident on 11 October affecting some IT systems for its Phase Eight, Hobbs and Whistles brands. Inside Story and White Stuff are not affected. TFG activated its incident response and business continuity plans, engaged external specialists to contain the incident and reported it to the relevant UK authorities. Stores remain open and trading although several IT systems are still unavailable. The group says TFG Africa and TFG Australia run on separate systems and are not affected. It is still working out whether personal or other sensitive information was compromised and will notify affected people or organisations if so. BleepingComputer found no public claim by a threat actor.
The Foschini Group JSE SENS announcement — Cybersecurity incident at TFG London (13 Oct 2026)
SAP's 13 October 2026 Security Patch Day lists 16 new security notes and 4 GitHub security advisories, led by CVE-2026-89111 (GHSA-4mv3-jxxm-9cx2), rated Critical 10.0. SAP says the Cloud SDK for Python, its official toolkit for Python apps and AI agents on SAP Business Technology Platform (BTP), has an OAuth2 server-side request forgery flaw affecting multi-tenant BTP applications: an attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server they control and capture the application's client credentials. Versions before 0.45.2 are affected. The same patch day also rates as Critical CVE-2026-89110 (9.9, broken access control in NetWeaver Visual Composer VC70RUNTIME 7.50), CVE-2026-89107 (9.9, code injection in S/4HANA Manage Substitution/Validation Rules, S4CORE 105 to 109) and CVE-2026-89108 (9.1, missing authorisation in Manufacturing Integration and Intelligence Configuration Service). SAP has not marked any of these as exploited.
SAP Security Patch Day — October 2026 (13 Oct 2026)
Ivanti disclosed CVE-2026-104935 in Ivanti Connect Secure (ICS) on 13 October 2026 and said it is aware of limited exploitation in the wild, urging customers on affected versions to act immediately, upgrade to the fixed release and run the Integrity Checker Tool regularly. The CVE record describes an authentication bypass by spoofing that lets a remote unauthenticated attacker execute arbitrary commands; ICS 22.7R2.14 and earlier are not affected. Volexity, which found and reported the issue, says a previously unknown actor it tracks as UTA0576 exploited a fully patched 22.8R2.4 appliance from 3 October 2026. The chain abused a request-routing bypass in the public welcome.cgi page (an X-DSCGI-PATH header pointing at an internal script), a race in the wu.cgi upload handler to run a briefly written Perl script, and a separate privilege escalation in the dsinvoked broker's trust of DSCache data to reach root. Ivanti tracks the bypass and RCE together as CVE-2026-104935; BleepingComputer reports the privilege escalation is still being fixed. The actor deployed no web shell, re-exploited the device for each command, tampered with debug and audit logs and evaded the Integrity Checker. Post-exploitation targeted Active Directory: LDAP service credentials stored on the appliance, LAPS passwords, BitLocker recovery keys, Kerberoasting and password spraying. Defused reports first exploitation signs from 1 October, and Shadowserver tracks more than 5,500 internet-exposed ICS instances. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October, with a 16 October patch deadline for US federal agencies, and issued an alert saying it is aware of actors using the flaw for credential theft and data exfiltration. CISA warns the Integrity Checker may miss exploitation because commands run in memory, so confirming compromise needs network and memory forensics, and it says Connect Secure 22.8 reaches end of life on 31 January 2027. Rapid7 reports Ivanti had found part of the issue internally and fixed it in 25.1.3.0 in July, and exploitation came while backports to other branches were still under way; iTnews lists 25.1.1.2 among the fixed builds. Volexity assesses with medium confidence that UTA0576 used large language models to build its tooling. On 14 October The Hacker News reported that Previdian honeypot sensors had logged 105 exploitation attempts from 50 unique IPs (mainly Singapore and the US) as of that date, using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts packaged as ZIP files that return execution-test markers; payloads seen so far were mostly weaponisation probes rather than full malware drops. Sample source IPs published by Previdian include 216.73.160[.]59, 216.73.160[.]61, 216.73.160[.]210 and 45.8.19[.]111. UPDATE (23 Oct 2026): the privilege escalation now has its own CVE record, CVE-2026-111357 (published 15 October, updated 16 October): Ivanti Connect Secure 22.8R2.4 mishandles how the dsinvoked broker trusts DSCache configuration data, leading to root, 'as exploited in the wild in October 2026'. The record scores it CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and lists no fixed version as of its 16 October update. Volexity's 13 October post says Ivanti is working on a fix that will be included in a future release 'in the coming weeks'. CVE-2026-111357 was not in CISA's KEV catalog as of the 23 October catalog release (version 2026.10.23). (source: CVE-2026-111357 record (cve.org); Volexity)
Ivanti — October 2026 Security Update (13 Oct 2026; links the Connect Secure CVE-2026-104935 advisory)
