The U.K. Housing Ombudsman Service is dealing with a case management system outage after a third-party IT security incident, preventing social housing residents from filing new complaints. The service says the incident has been contained and is working to restore systems as quickly as possible. It is also offering phone and email channels while recovery continues.

Microsoft shipped mandatory October 2026 Patch Tuesday cumulative updates for Windows 11 across 26H2/25H2/24H2 and 23H2, closing security gaps across hundreds of vulnerabilities. The release centers on KB5127648 and KB5126653, which administrators can install through Windows Update or the Microsoft Update Catalog. The update matters because it delivers broad security remediation for supported Windows 11 branches while keeping the same fixes aligned across versions.

TFG London suffered a cybersecurity incident that disrupted IT systems supporting Phase Eight, Hobbs, and Whistles, leaving several systems unavailable while physical stores remain open. The company detected the attack on October 11, 2026, activated incident response and business continuity plans, and brought in external cybersecurity experts to contain the threat. Investigators are still checking whether customer information was compromised, and no threat actor has publicly claimed the breach.

GitHub has tightened npm trusted publishing by expiring unvalidated configurations after 48 hours, closing a package-hijack path tied to reclaimed repository slugs. The change also rejects certain GitHub Actions token flows, reducing abuse of the trust exchange used to publish packages. The update hardens package publishing authentication and limits unauthorized releases under legitimate package names.

Ivanti Connect Secure (ICS) has an actively exploited authentication bypass zero-day tracked as CVE-2026-104935, creating unauthenticated remote code execution risk on impacted appliances. Ivanti told customers to immediately patch affected versions, and later reporting tied the flaw to root-level code execution on fully patched devices when chained with other vulnerabilities.

Docker Hub disclosed CVE-2026-105445, a critical vulnerability that let an attacker reassign a personal access token (PAT) and act as another user at the registry level. The flaw could expose container repositories to unauthorized pull, push, and delete actions across affected repositories and accessible organizations. Docker said it treated the issue as a software supply chain risk and deployed a fix quickly, but it found no evidence of exploitation after review.

SAP's October 2026 security updates patched CVE-2026-89110 in SAP NetWeaver Visual Composer, closing a broken access control flaw that could let remote attackers with limited privileges fully compromise vulnerable systems. The fix removes a path to full system compromise in affected deployments. It is part of SAP's broader 20-flaw update cycle for the month.

SAP's October 2026 security updates now patch CVE-2026-89108 in SAP Manufacturing Integration and Intelligence, closing a flaw that could let an attacker with administrator privileges gain admin control over the underlying system. The weakness involved provisioning an elevated-privilege account on the underlying Java app. The release is part of SAP's broader update cycle covering 20 flaws across multiple products.

SAP's October 2026 security updates patch CVE-2026-89111 in SAP Cloud SDK for Python, closing a maximum-severity OAuth2 SSRF flaw. The issue affects multi-tenant BTP applications and could let remote attackers without privileges steal client credentials. SAP says customers that cannot patch immediately can temporarily validate `tenant_subdomain` values with an allowlist. The same update cycle also fixes additional flaws across other SAP products.

Agentic AI adoption in cyber defense is still limited, leaving most security teams in pilot or evaluation stages. Only 25% of cybersecurity teams are actively using the tools, which keeps operational control and trust concerns front and center. Teams that do deploy agents are using them for alert prioritization, blocking IP addresses, updating blacklists, and monitoring suspicious traffic. Spending expectations suggest the trend is still building, with over half anticipating a meaningful budget increase for further testing.

Bitdefender launched GravityZone AI Visibility and Control (AIVC) to inventory AI software on protected Windows endpoints and assign risk scores before users can hide it inside browsers, editors, or local runtimes. It exposes shadow AI, MCP servers, and agent frameworks that traditional software inventory misses. The tool maps discovered services into 17 functional categories and affected endpoints so policy review and mitigation are more precise. Enforcement still relies on existing GravityZone controls such as Web Content Filtering, custom detection rules, and PHASR.

On October 12, 2026, the British government announced a cross-government AI security program to use frontier models to find weaknesses in government systems before attackers exploit them. The initiative brings together DCMS, NCSC and AISI to strengthen protection for essential services and improve response to agentic AI incidents. It also signals new work on the Cyber Security and Resilience Bill and reporting for serious AI incidents and near misses.

The Coopérative U supermarket network confirmed a cyber-attack that affected several stores from October 11, disrupting refrigeration facilities and putting fresh-product storage at risk. The incident created direct operational and financial impact, including reported merchandise losses at affected locations. The attack was linked to outdated Danfoss refrigeration control software, and the alleged abuse of forced defrost cycles could have driven temperatures as high as 50 °C (122°F). Recovery efforts were underway with refrigeration specialists while the scope of the compromise was assessed.

Progress Software published 31 MarkLogic Server flaws and the associated fixes, including five critical vulnerabilities that can let a lesser-privileged account gain persistent administrator control. The update applies to MarkLogic 11.x before 11.3.7 and 12.x before 12.1.0. Fixes have been available since September 10, and Progress says there is no workaround for customers who cannot upgrade yet. The company says it has no evidence of exploitation, and the flaws were not in CISA's KEV catalog when checked.

NIST published a request for information to modernize the National Vulnerability Database (NVD), seeking better handling of vulnerability data in an AI-shaped cybersecurity landscape. The consultation targets improvements in automation, interoperability, transparency, and utility for public vulnerability processing. Stakeholders have until October 13 to submit input.

Microsoft told customers that Windows 11 24H2 Home and Pro will reach end of updates on October 13, 2026, leaving affected devices without monthly security and non-security preview updates. The company advised eligible users to move to Windows 11 25H2 before the cutoff, while unmanaged devices are set to upgrade automatically. Windows 11 24H2 Enterprise and Education remain supported until October 2027.

Norway’s Datatilsynet fined Xandr — now under Microsoft Advertising — €8.6 million ($9.62 million) for unlawfully relaying Grindr users’ sensitive data to advertisers. The regulator said the data included information revealing sexual orientation and moved through real-time bidding between July 2018 and April 2020, reaching potentially thousands of companies. Datatilsynet called it its largest-ever penalty and gave Xandr three weeks to appeal.

Yandex cloud services are disrupted after drone attacks damaged three data centers, leaving customers unable to access cloud files and degrading several hosted services. The outage affects a broad slice of Yandex’s cloud stack, including Yandex Disk and core infrastructure services, with no reliable restoration timeline yet. Yandex told customers to rely on alternative disaster recovery options while teams work to stabilize operations.

Ledger confirmed that devices sold through CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The compromised units were distributed through a Southeast Asian reseller, creating direct theft risk for affected buyers. Ledger is reaching out to impacted users while the investigation continues.

Leaked internal files and chat logs show Luna Moth / Silent Ransom Group (SIG) running a specialized data-extortion operation with split roles, scripted social engineering, and coordinated remote access, raising the scale and reliability of its extortion workflow. The files, surfaced in early October 2026 and analyzed on October 9, 2026, indicate that one operator handles the victim-facing trust manipulation while another controls the session behind the scenes. That structure turns the group into a repeatable criminal service model rather than a loose ransomware crew.

AvisLoader is a newly identified Windows loader that uses a ClickFix lure and Tox-based command-and-control to deliver commands and payloads, increasing the difficulty of disruption and tracking. Varonis Threat Labs found it on an exposed staging server with supporting tools and a Command Center. The recovered components point to shortcut persistence, UAC bypass tooling, and a process-hiding DLL. The operator setup also supports staged file delivery and client tasking over Tox.

Ahold Delhaize confirmed a cybersecurity incident that forced some systems offline, disrupting parts of its store and corporate environment. The company said it is working to assess and mitigate the issue while keeping stores open. The disruption affected Stop & Shop employee access to schedules and pay stubs and hit websites, apps, and customer service platforms for several banners in the Netherlands and Belgium.

The Ahold Delhaize network issue took some systems offline, disrupting websites, apps, customer service platforms, and employee access across several brands and regions. Customers at Albert Heijn, Etos, Gall & Gall, and Delhaize could not use key online services, while Stop & Shop employees had trouble reaching schedules and pay stubs. The company said stores stayed open and teams were working to assess and mitigate the issue.

GitLab CI/CD Regular Expression Compiler flaw CVE-2026-97229 is now patched, and unpatched GitLab CE/EE servers face unauthenticated remote code execution risk. The maximum-severity bug is an integer overflow in regular expression parsing and compilation for pipeline configuration files. GitLab says self-managed users on 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2 should upgrade immediately.

GitLab released security fixes for GitLab CE/EE after disclosing CVE-2026-97229, and self-managed installations were told to upgrade immediately to stop possible unauthenticated code execution on targeted servers. The patch covers affected builds before 19.2.8, 19.3.4, and 19.4.2.

The FBIjobs.gov breach exposed a third-party managed jobs site and allegedly led to 2-3TB of data being extracted. Attackers reportedly used an Oracle PeopleSoft vulnerability to compromise the site and then pivoted into AWS GovCloud systems. The intrusion is linked to ShinyHunters and may have exposed names, addresses, telephone numbers, dates of birth, Social Security numbers, and emergency contact details for thousands of FBI employees.

The FBI arrested and charged Edward Dubrovsky in the ShinyHunters case, escalating the cybercrime prosecution tied to the FBIjobs.gov breach. Court documents identified Dubrovsky as the suspect after the bureau said agents had made another arrest in the investigation. The charges connect the case to alleged extortion-related conduct and a broader effort to dismantle the network.

Attackers exploited Oracle PeopleSoft on the FBI jobs platform, used that foothold to reach AWS GovCloud, and reportedly stole personnel and applicant data linked to the FBI. Public reporting tied the intrusion to ShinyHunters, and later analysis connected the same access path to CVE-2026-35273, a PeopleSoft flaw that was also mass-exploited against other organizations. The story then moved from breach claims to response and accountability. The FBI said the theft stemmed from a security failure on a third-party PeopleSoft platform after a contractor failed to apply a patch, removed the contractor, and continued mitigation. Authorities have also made arrests in investigations connected to the jobs-site intrusion, while the exact exfiltrated volume, full system scope, and final number of affected people remain unresolved in available material.

Daiichi Kosho disclosed that a contractor malware incident at Nippon Columbia Group (NCG) may have exposed more than 8.7 million customer and employee records. The exposed dataset includes 93,000 employees and 8,631,000 customers across brands such as BIG ECHO and Karaoke CLUB DAM. The company says its own systems were not breached and that data theft is unconfirmed, but it is investigating whether the information was leaked online. The exposed fields include names, dates of birth, email addresses, and telephone numbers.

Nippon Columbia Group (NCG) suffered a malware infection on an employee computer, forcing isolation of the affected system and an investigation into possible downstream exposure. The incident mattered because NCG handles customer personal information for Daiichi Kosho, a major Japanese entertainment company. Daiichi Kosho says its own systems were not breached and that no data theft or leak has been confirmed.