Security news.
October's security landscape is dominated by a massive Patch Tuesday rollout alongside critical zero-day threats in enterprise edge infrastructure. Microsoft has issued fixes for a record-shattering volume of flaws, while Ivanti administrators face active zero-day exploitation delivering root access. Additionally, severe vulnerabilities have surfaced across Docker Hub and SAP, alongside widespread physical disruptions targeting European retail cooling systems.
Ivanti Connect Secure Zero-Day Chained for Pre-Auth Root RCE
Attackers are actively exploiting CVE-2026-104935 alongside other zero-day flaws to achieve unauthenticated remote root compromise on fully patched VPN appliances, prompting urgent mitigation warnings.
Microsoft Drops Massive October 2026 Patch Tuesday with 3 Zero-Days
Microsoft released security updates fixing an unprecedented 1,411 vulnerabilities, including one actively exploited flaw and two publicly disclosed zero-days.
Docker Hub Flaw Allowed Account Impersonation and Image Tampering
A critical vulnerability (CVE-2026-105445) in Docker Hub's account conversion feature enabled attackers to push, pull, or delete container repositories masquerading as other users.
SAP Fixes Maximum-Severity CVSS 10 Flaw in Cloud SDK for Python
The vulnerability allows attackers who control a tenant subdomain to steal OAuth2 client credentials from multi-tenant applications running on the SAP Business Technology Platform.
French Supermarkets Disrupted by Hijacked Danfoss Refrigeration Controllers
Attackers remotely manipulated Danfoss refrigeration controllers across hundreds of grocery stores, driving temperatures to 50°C and causing massive food spoilage.
GitHub Enforces Stricter npm Publishing Rules After Package Hijack Flaw
GitHub now automatically expires unvalidated npm trusted publishing configurations after 48 hours to prevent unauthorized parties from hijacking over 1,500 exposed packages.
SonicWall SMA 1000 Exploited via Critical SSRF Flaw
Threat actors are actively targeting a maximum-severity Server-Side Request Forgery vulnerability impacting SonicWall SMA 1000 appliances in production environments.
Anthropic Cautions Small AI Models Could Create Self-Spreading IoT Botnets
Security researchers warn that localized, lightweight AI models running on edge consumer electronics could soon autonomously replicate to establish resilient, decentralized worm networks.