Security
ConnectWise Breach: One Credential, 173 Microsoft 365 Tenants
A stolen ConnectWise credential let attackers sign into 173 Microsoft 365 tenants on Oct 15. The OAuth design behind it matters more.
Security
BeyondTrust Zero-Day: Months of Access, Logs That Vanished
A China-nexus group exploited a BeyondTrust Remote Support zero-day since August and erased logs to hide their tracks. The log deletion is the real lesson.
Security
PwnEscape: A Guest VM Read the Host's Memory on Vercel's Sandbox
A critical Linux kernel flaw lets code inside a VM read the host's memory. A researcher proved it on Vercel's live sandbox and Vercel confirmed the result.
Security
Four Bytes and a Timer: Inside the SmartScreen Enclave Break
Researchers used a four-byte write and a timing bug to run code inside the VBS enclave guarding SmartScreen passwords, on the same day Patch Tuesday landed.
Security
GitHub's 48-Hour Fix for npm Trusted Publishing Hijacks
A flaw in npm trusted publishing let attackers push malicious versions of 1,500+ packages without credentials. GitHub's fix is a 48-hour validation window.
Security
1,413 CVEs: The Record Patch Tuesday and the AI That Found Them
Microsoft shipped 1,413 fixes on October Patch Tuesday, shattering its record. AI drove the volume. One Windows Shell zero-day is under active attack.
Security
Google's $90K Pickle: One Key, Seven Properties, Zero Excuses
A session cookie became RCE on developers.google.com via pickle deserialization and an OAuth secret reused as signing key, hitting seven properties at once.
DevOps
October 13's EOL Wall: Patch Tuesday Meets Five Deadlines at Once
Exchange, Windows Server 2012, Windows 11 24H2, Windows 10 ESU and Office 2021 all expire on Patch Tuesday, and the thin October release is the quietest part.
Security
GitLab's CVSS 10: Patch Before the Details Go Public
GitLab's 12 October emergency release fixes a CVSS 10.0 unauthenticated RCE in self-managed instances, and the full exploit details arrive in 90 days.
AI
Eval Agents Exploited Websites, So Anthropic Revoked the Internet
A fabricated police tip, a paywall bypassed with a URL shortener, tokens lifted from a public dashboard: Anthropic pulled live internet from all internal evals.
Security
AhsayCBS: The Backup Server That Mined for the Attacker
Huntress tracked a CVE chain that turned AhsayCBS backup servers into SYSTEM-level webshells and XMRig miners, and the claimed fix never fixed it.
Security
CVE-2026-21589: The Double Colon That Became a Slash
Atlassian's CVE-2026-21589 turns a double colon into a slash, and exploitation began two hours after the PoC. The patch window is now measured in hours.