Ivanti VPN Backdoor, Microsoft Patch Tuesday, Backup Servers Hijacked – Cybersecurity News [October 12, 2026]

Here’s a roundup of the most important cybersecurity stories from October 13 to 19, covering a VPN zero-day, a record Patch Tuesday, zero-click spyware delivered through ads, a fridge hack that spoiled food across Europe, and a run of large data breaches.

Ivanti VPN zero-day used to plant a stealthy backdoor

On October 13, Ivanti disclosed CVE-2026-104935, an authentication bypass in Connect Secure VPN appliances that lets unauthenticated attackers run commands. Volexity says a previously unknown actor, tracked as UTA0576, has been exploiting it since at least October 3, chaining it with two other flaws to reach root on patched devices. The attackers avoided malware, re-exploited the appliance for each command, and altered logs to cover their tracks, and CISA gave federal agencies until October 16 to fix it. Source: Sherlock Forensics weekly roundup, citing BleepingComputer

Microsoft ships its largest-ever Patch Tuesday

Microsoft’s October 13 update fixed roughly 1,413 CVEs, the biggest single release on record, though counts differ by outlet. One actively exploited zero-day, CVE-2026-96951, lets attackers bypass the Mark of the Web protection that warns users about files downloaded from the internet. Several Outlook flaws can be triggered simply by previewing a message. Source: SecurityWeek

Backup servers hijacked to deploy cryptominers

Attackers chained two AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, to take over backup servers used by managed service providers. They dropped web shells and a cryptominer disguised as a Microsoft Edge updater service. Ahsay’s first fix did not fully close the chain, so it issued a hotfix on October 12, and CISA added both CVEs to its exploited list on October 14. Source: Huntress

Ransomware hits IDC Frontier’s cloud service in Japan

A ransomware attack on IDCF Cloud, a SoftBank subsidiary’s cloud service, disrupted 495 corporate and local-government customers. On October 14 the company said it found no evidence that data on the affected servers was taken, but it confirmed unauthorized queries against registration data for 48 customers. Japan’s top cyber official described the situation as a state of emergency in cyberspace. Source: International Business Times

Heart-monitor maker’s breach grows to more than 8 million people

iRhythm Technologies, which makes Zio cardiac monitors, now says the breach of its third-party-hosted business applications affected about 8.2 million people. Exposed data includes names, dates of birth, insurance numbers and device serial numbers, while the company says its clinical systems and devices were not affected. The attacker demanded payment to keep the data from being published. Source: BankInfoSecurity

Data on about 7 million California students exposed

A hack at a third-party academic testing company exposed names, addresses, disability status and demographic data for all 7 million children in California schools over the past three years. The breach is among the largest school-data exposures reported this year. Source: DataBreaches.net

Hackers heat up supermarket fridges across Europe

Unknown attackers caused thousands of refrigerator units in hundreds of French supermarkets and other European stores to defrost and warm up, spoiling food and disrupting supply. Danfoss, the Danish maker, said the affected models were older and no longer received security patches. Source: France24

Ahold Delhaize takes systems offline after cyberattack

The Dutch supermarket operator pulled its network offline after detecting a cybersecurity incident, causing website and app outages at U.S. chains including Stop & Shop, Hannaford and Food Lion. No group has claimed the attack yet, and the company says there is no evidence personal information was taken so far. Source: Grocery Dive

Hardware crypto wallets found carrying spy implants

Researchers found that some Trezor and Ledger hardware wallets may have been compromised with implants that steal seed phrases and transmit them over the cellular network. The attacks appear to target authorized resellers of the devices. Ledger has confirmed a spy implant was behind some thefts, and roughly $100 million in crypto has reportedly been stolen. Source: BleepingComputer

Zero-click spyware delivered through online ads

Citizen Lab found that an Israeli firm, Discover-Tech, was used to deliver zero-click spyware, which infects a device without any click or tap, through online advertising. It says the firm was used against dozens of devices belonging to Al Jazeera staff, using the Candiru spyware. Ad blockers reduce the risk, but the technique is a serious escalation. Source: Citizen Lab

OpenAI employee charged over a hidden recording device

The U.S. Justice Department charged a Saudi national on OpenAI’s product team after he allegedly planted a recording device in an executive conference room at the company’s San Francisco office. OpenAI caught him with a hidden camera and fired him. The motive is not yet public, and the device appears to be an off-the-shelf internet-connected microphone. Source: U.S. Department of Justice

Meta says stolen credentials led to a GitHub breach

Meta is notifying about 1,500 people, mostly employees, that their personal information was exposed after attackers used an employee’s stolen credentials to access its GitHub repositories. Much of the stolen data is product source code. Source: SecurityWeek

Amid rising cyber threats, SPF, DKIM, and DMARC help organizations prevent email spoofing and strengthen email security.

Untethered iOS 27 jailbreak shown for iPhone 18

Researchers demonstrated an untethered jailbreak of iOS 27.0.1 on an iPhone 18 at the HexaCon conference in Paris. It works without a computer and survives a restart, and it can be triggered by opening a PDF. Apple has not yet publicly responded, and the underlying vulnerabilities have not been fully disclosed. Source: Heise

FBI raids North Korean “laptop farms”

The FBI and Justice Department searched at least 40 homes in Texas used as laptop farms, where devices are set up so North Korean IT workers can appear to be based in the U.S. The operation is linked to efforts to earn revenue and steal data for the regime. The FBI has issued an updated public service announcement on the threat. Source: Houston Public Media

Hackers hijack Google domains using rogue DNS and certificates

Attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations. The same weekly recap also covers a ShinyHunters arrest and zero-days in helpdesk software. Source: The Hacker News weekly recap