← Back to Threat Recap · This week · Monthly recap

This week in security

12 Oct 2026 – 19 Oct 2026 · generated Mon, 19 Oct 2026 12:01:13 GMT

Top stories

  1. Ivanti warns of Connect Secure zero-day exploited in attacks BleepingComputer +10 sources · 13 Oct 2026
    Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]
  2. October 2026 Patch Tuesday: 1,411 fixes and counting ThreatHunter.ai +9 sources · 13 Oct 2026
    The largest Patch Tuesday in 23 years. One zero-day being exploited right now, two more disclosed, 70 Critical bugs, and a twelve-month curve that says this is the new normal. Here is what to patch first, what we are…
  3. Cisco patches new Secure Email Gateway zero-day exploited in attacks BleepingComputer +5 sources · 14 Oct 2026
    Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]
  4. Global takedown hits network behind 1 billion phishing messages BleepingComputer +5 sources · 14 Oct 2026
    A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]
  5. ARMORY CASTLE Exploits BeyondTrust Google Threat Intelligence +4 sources · 15 Oct 2026
    Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting…
  6. Microsoft Windows Shell 0-Day Vulnerability Actively Exploited in Attacks Cybersecurity News +4 sources · 14 Oct 2026
    Microsoft has patched an actively exploited Windows Shell zero-day vulnerability that allows attackers to bypass Mark of the Web protections. Tracked as CVE-2026-96951, the flaw was addressed in the October 2026 Patch…
  7. Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns SecurityWeek +4 sources · 13 Oct 2026
    Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own.
  8. Proofpoint to buy Varonis for $6.3 billion CyberScoop +3 sources · 15 Oct 2026
    The deal pairs the email security giant's massive threat intelligence with Varonis' visibility into corporate data, as both companies race to secure the AI agents now roaming enterprise networks.
  9. Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory The Hacker News +3 sources · 15 Oct 2026
    A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and…
  10. UK Legal Aid Agency: Hackers stole records dating back to 1978 BleepingComputer +3 sources · 15 Oct 2026
    The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to…

Zero-days & actively exploited

Biggest breaches

Added to CISA KEV (9)

Highest exploit probability (EPSS) in the news

Most active ransomware groups (last 30 days)

Want news daily or the moment something is exploited? Use the free RSS feeds or turn on notifications on Threat Recap.

Ransomware figures are unverified claims posted by criminal groups. Tags are keyword-based.