--- title: "Ivanti VPN Backdoor, Microsoft Patch Tuesday, Backup Servers Hijacked – Cybersecurity News [October 12, 2026] | DuoCircle" description: "Read the latest cybersecurity news for October 13–19, 2026, covering Ivanti VPN exploits, Microsoft patches, ransomware, data breaches, and spyware attacks." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/cybersecurity-news-update-week-42-of-2026/" --- Quick Answer Cybersecurity news from October 13–19, 2026, covers Ivanti VPN exploits, Microsoft security patches, ransomware, data breaches, and zero-click spyware. SPF, DKIM, and DMARC help organizations prevent email spoofing and strengthen email security. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fcybersecurity-news-update-week-42-of-2026%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Ivanti%20VPN%20Backdoor%2C%20Microsoft%20Patch%20Tuesday%2C%20Backup%20Servers%20Hijacked%20%E2%80%93%20Cybersecurity%20News%20%5BOctober%2012%2C%202026%5D&url=undefined%2Fblog%2Fcybersecurity-news-update-week-42-of-2026%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fcybersecurity-news-update-week-42-of-2026%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fcybersecurity-news-update-week-42-of-2026%2F&title=Ivanti%20VPN%20Backdoor%2C%20Microsoft%20Patch%20Tuesday%2C%20Backup%20Servers%20Hijacked%20%E2%80%93%20Cybersecurity%20News%20%5BOctober%2012%2C%202026%5D "Share on Reddit") [ ](mailto:?subject=Ivanti%20VPN%20Backdoor%2C%20Microsoft%20Patch%20Tuesday%2C%20Backup%20Servers%20Hijacked%20%E2%80%93%20Cybersecurity%20News%20%5BOctober%2012%2C%202026%5D&body=Check out this article: undefined%2Fblog%2Fcybersecurity-news-update-week-42-of-2026%2F "Share via Email") ![cybersecurity news update](https://media.mailhop.org/duocircle/spf-permerror-6788-1792406785797.jpg) Here’s a roundup of the most important [cybersecurity](https://www.duocircle.com/blog/phishing-protection/cybersecurity-basics-that-every-first-time-business-owner-should-know/) stories from October 13 to 19, covering a VPN zero-day, a record Patch Tuesday, [zero-click spyware](https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/) delivered through ads, a fridge hack that spoiled food across Europe, and a run of large data breaches. ## Ivanti VPN zero-day used to plant a stealthy backdoor On October 13, **Ivanti disclosed CVE-2026-104935**, an authentication bypass in Connect Secure VPN appliances that lets unauthenticated attackers run commands. Volexity says a previously unknown actor, tracked as UTA0576, has been exploiting it since at least October 3, chaining it with two other flaws to reach root on patched devices. The attackers [avoided malware, re-exploited](https://www.wired.com/story/nightmare-scenario-zero-click-spyware-is-infecting-phones-via-targeted-ads/) the appliance for each command, and altered logs to cover their tracks, and CISA gave federal agencies until October 16 to fix it. [Source: Sherlock Forensics weekly roundup, citing BleepingComputer](https://www.sherlockforensics.com/blog/2026-10-14-weekly-security-roundup.html) ## Microsoft ships its largest-ever Patch Tuesday _Microsoft’s October 13 update fixed roughly 1,413 CVEs, the biggest single release on record, though counts differ by outlet_. One actively exploited zero-day, CVE-2026-96951, lets attackers bypass the **Mark of the Web protection** that warns users about files downloaded from the internet. Several Outlook flaws can be triggered simply by previewing a message. [Source: SecurityWeek](https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/) ## Backup servers hijacked to deploy cryptominers Attackers chained two AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, to take over backup servers used by **managed service providers**. They dropped web shells and a cryptominer disguised as a Microsoft Edge updater service. Ahsay’s first fix did not fully close the chain, so it issued a hotfix on October 12, and CISA added both CVEs to its exploited list on October 14\. [Source: Huntress](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) ## Ransomware hits IDC Frontier’s cloud service in Japan A [ransomware attack](https://www.cybersecuritydive.com/news/hackers-microsoft-teams-ransomware-it-support/826591/) on IDCF Cloud, a SoftBank subsidiary’s cloud service, disrupted 495 corporate and local-government customers. On October 14 the company said it found no evidence that data on the affected servers was taken, but it confirmed unauthorized queries against registration data for 48 customers. **Japan’s top cyber official described** the situation as a state of emergency in cyberspace. [Source: International Business Times](https://www.ibtimes.co.uk/japan-cyber-crisis-ransomware-data-breaches-1825675) ![SMTP Relay 3411](https://media.mailhop.org/duocircle/smtp-relay-3411-1792406891951.jpg) ## Heart-monitor maker’s breach grows to more than 8 million people _iRhythm Technologies, which makes Zio cardiac monitors, now says the breach of its third-party-hosted business applications affected about 8.2 million people_. Exposed data includes names, dates of birth, insurance numbers and device serial numbers, while the company says its clinical systems and devices were not affected. The [attacker demanded payment](https://www.bankinfosecurity.com/heart-monitor-firm-notifying-at-least-370000-patients-hack-a-33091) to keep the data from being published. [Source: BankInfoSecurity](https://www.bankinfosecurity.com/heart-monitor-firm-notifying-at-least-370000-patients-hack-a-33091) ## Data on about 7 million California students exposed A hack at a third-party academic testing company exposed names, addresses, disability status and demographic data for all 7 million [children in California schools](https://databreaches.net/2026/10/17/hack-exposes-data-on-millions-of-california-students/) over the past three years. The breach is among the largest school-data exposures reported this year. [Source: DataBreaches.net](https://databreaches.net/2026/10/17/hack-exposes-data-on-millions-of-california-students/) ## Hackers heat up supermarket fridges across Europe _Unknown attackers caused thousands of refrigerator units in hundreds of French supermarkets and other European stores to defrost and warm up, spoiling food and disrupting supply_. Danfoss, the Danish maker, said the affected models were older and no longer **received security patches**. [Source: France24](https://www.france24.com/en/france/20261012-french-supermarket-chains-say-cyberattack-shut-down-refrigerators) ## Ahold Delhaize takes systems offline after cyberattack The **Dutch supermarket operator** pulled its network offline after detecting a cybersecurity incident, causing website and app outages at U.S. chains including Stop & Shop, Hannaford and Food Lion. No group has claimed the attack yet, and the company says there is no evidence personal information was taken so far. [Source: Grocery Dive](https://www.grocerydive.com/news/ahold-delhaize-usa-sites-still-down/832900/) ![SMTP Email 3413](https://media.mailhop.org/duocircle/smtp-email-3413-1792406982874.jpg) ## Hardware crypto wallets found carrying spy implants Researchers found that some **Trezor and Ledger hardware wallets** may have been compromised with implants that steal seed phrases and transmit them over the cellular network. The attacks appear to target authorized resellers of the devices. Ledger has confirmed a spy implant was behind some thefts, and roughly $100 million in crypto has reportedly been stolen. [Source: BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/) ## Zero-click spyware delivered through online ads _Citizen Lab found that an Israeli firm, Discover-Tech, was used to deliver zero-click spyware, which infects a device without any click or tap, through online advertising_. It says the firm was used against dozens of devices belonging to [Al Jazeera staff, using the Candiru spyware](https://www.bloomberg.com/news/articles/2026-10-15/israeli-firms-placed-spyware-at-al-jazeera-via-ads-report-says). Ad blockers reduce the risk, but the technique is a serious escalation. [Source: Citizen Lab](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/) ## OpenAI employee charged over a hidden recording device The [U.S. Justice Department](https://en.wikipedia.org/wiki/United%5FStates%5FDepartment%5Fof%5FJustice) charged a Saudi national on OpenAI’s product team after he allegedly planted a recording device in an executive conference room at the company’s San Francisco office. OpenAI caught him with a **hidden camera and fired him**. The motive is not yet public, and the device appears to be an off-the-shelf internet-connected microphone. [Source: U.S. Department of Justice](https://www.justice.gov/opa/pr/saudi-national-arrested-installing-surreptitious-audio-recording-device-openai) ## Meta says stolen credentials led to a GitHub breach Meta is **notifying about 1,500 people**, mostly employees, that their personal information was exposed after attackers used an employee’s stolen credentials to access its GitHub repositories. Much of the stolen data is product source code. [Source: SecurityWeek](https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/) Amid rising cyber threats, [SPF](https://www.duocircle.com/email/spf-management/), DKIM, and [DMARC](https://www.duocircle.com/email/dmarc/) help organizations prevent email spoofing and strengthen [email security](https://www.duocircle.com/). ![Spf Validator 7800](https://media.mailhop.org/duocircle/spf-validator-7800-1792407066234.jpg) ## Untethered iOS 27 jailbreak shown for iPhone 18 _Researchers demonstrated an untethered jailbreak of iOS 27.0.1 on an iPhone 18 at the HexaCon conference in Paris_. It works without a computer and survives a restart, and it can be triggered by opening a PDF. Apple has not yet publicly responded, and the underlying vulnerabilities have not been fully disclosed. [Source: Heise](https://www.heise.de/en/news/Works-on-iPhone-18-Pro-AI-helps-create-untethered-jailbreak-for-iOS-27-0-1-11490907.html) ## FBI raids North Korean “laptop farms” The FBI and Justice Department searched at least 40 homes in **Texas used as laptop farms**, where devices are set up so [North Korean IT workers](https://securityaffairs.com/201193/intelligence/north-korean-it-workers-used-stolen-us-identities-to-earn-3-million.html) can appear to be based in the U.S. The operation is linked to efforts to earn revenue and steal data for the regime. The FBI has issued an updated public service announcement on the threat. [Source: Houston Public Media](https://www.houstonpublicmedia.org/articles/news/2026/10/14/564376/fbi-raids-north-texas-homes-for-alleged-role-in-north-korean-laptop-farm-operation/) ## Hackers hijack Google domains using rogue DNS and certificates Attackers modified authoritative [DNS records](https://www.cloudns.net/wiki/article/9/) and obtained unauthorized HTTPS certificates covering **several Google domains**, as well as domains belonging to other organizations. The same weekly recap also covers a ShinyHunters arrest and zero-days in helpdesk software. [Source: The Hacker News weekly recap](https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html) ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fcybersecurity-news-update-week-42-of-2026%2F) [ ](https://twitter.com/intent/tweet?text=Ivanti%20VPN%20Backdoor%2C%20Microsoft%20Patch%20Tuesday%2C%20Backup%20Servers%20Hijacked%20%E2%80%93%20Cybersecurity%20News%20%5BOctober%2012%2C%202026%5D&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fcybersecurity-news-update-week-42-of-2026%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fcybersecurity-news-update-week-42-of-2026%2F) Copy Related Articles - [ ![Cybersecurity News](https://media.mailhop.org/duocircle/spf-permerror-5610-1779093389633.jpg) Cisco SD-WAN Flaw, Critical NGINX Exploit, Foxconn Ransomware Attack – Cybersecurity News \[May 11, 2026\] Blog ](/blog/cybersecurity-news-update-week-20-of-2026/) - [ ![Cybersecurity news](https://media.mailhop.org/duocircle/spf-permerror-5667-1779700511937.jpg) GitHub Code Leak, 7-Eleven Breached, NYC Patient Exposure – Cybersecurity News \[May 18, 2026\] Blog ](/blog/cybersecurity-news-update-week-21-of-2026/) - [ ![Cybersecurity news](https://media.mailhop.org/duocircle/spf-permerror-5686-1780301891080.jpg) FBI Warns Firms, Carnival Breach, GlobalProtect Flaw – Cyber News Blog ](/blog/cybersecurity-news-update-week-22-of-2026/) - [ ![cybersecurity news](https://media.mailhop.org/duocircle/spf-record-4590-1780921768387.jpg) DentaQuest Leak, Cisco Patch Pending, Instagram Bug – Cyber News Blog ](/blog/cybersecurity-news-update-week-23-of-2026/) ## Related Articles [ news Cisco SD-WAN Flaw, Critical NGINX Exploit, Foxconn Ransomware Attack – Cybersecurity News \[May 11, 2026\] May 18, 2026 ](/blog/cybersecurity-news-update-week-20-of-2026/)[ news GitHub Code Leak, 7-Eleven Breached, NYC Patient Exposure – Cybersecurity News \[May 18, 2026\] May 25, 2026 ](/blog/cybersecurity-news-update-week-21-of-2026/)[ news FBI Warns Firms, Carnival Breach, GlobalProtect Flaw – Cyber News Jun 1, 2026 ](/blog/cybersecurity-news-update-week-22-of-2026/)[ news DentaQuest Leak, Cisco Patch Pending, Instagram Bug – Cyber News Jun 8, 2026 ](/blog/cybersecurity-news-update-week-23-of-2026/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Ivanti VPN Backdoor, Microsoft Patch Tuesday, Backup Servers Hijacked – Cybersecurity News [October 12, 2026]","description":"Read the latest cybersecurity news for October 13–19, 2026, covering Ivanti VPN exploits, Microsoft patches, ransomware, data breaches, and spyware attacks.","url":"https://www.duocircle.com/blog/cybersecurity-news-update-week-42-of-2026/","datePublished":"2026-10-19T00:00:00.000Z","dateModified":"2026-10-19T00:00:00.000Z","dateCreated":"2026-10-19T00:00:00.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/cybersecurity-news-update-week-42-of-2026/"},"articleSection":"news","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/spf-permerror-6788-1792406785797.jpg","caption":"cybersecurity news update"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"news"},{"@type":"ListItem","position":3,"name":"Ivanti VPN Backdoor, Microsoft Patch Tuesday, Backup Servers Hijacked – Cybersecurity News [October 12, 2026]","item":"https://www.duocircle.com/blog/cybersecurity-news-update-week-42-of-2026/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"news","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Ivanti VPN Backdoor, Microsoft Patch Tuesday, Backup Servers Hijacked – Cybersecurity News [October 12, 2026]","item":"https://www.duocircle.com/blog/cybersecurity-news-update-week-42-of-2026/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Ivanti VPN Backdoor, Microsoft Patch Tuesday, Backup Servers Hijacked – Cybersecurity News [October 12, 2026]","description":"Read the latest cybersecurity news for October 13–19, 2026, covering Ivanti VPN exploits, Microsoft patches, ransomware, data breaches, and spyware attacks.","url":"https://www.duocircle.com/blog/cybersecurity-news-update-week-42-of-2026/","datePublished":"2026-10-19T00:00:00.000Z","dateModified":"2026-10-19T00:00:00.000Z","dateCreated":"2026-10-19T00:00:00.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/cybersecurity-news-update-week-42-of-2026/"},"articleSection":"news","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/spf-permerror-6788-1792406785797.jpg","caption":"cybersecurity news update"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```