Weekly recap: Week of 12 to 18 October 2026
Review the week's tracked stories, vulnerability changes, and unverified leak-site claims for the dates shown.
285 stories tracked from Monday to Sunday, Coordinated Universal Time (UTC): October 12 to October 18, 2026; +10 vs prior week; 9 Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) additions from Monday to Sunday, UTC: October 12 to October 18, 2026; 369 ransomware leak-site claims observed in tracked feeds (unverified) from Monday to Sunday, UTC: October 12 to October 18, 2026
Monday to Sunday, UTC. Permalink label: 2026-W42.
The 285 stories above are counted by publisher date (first-seen date where it is missing or unusable), and only for stories that have a summary and a why-it-matters line and are not thin or editorially excluded. The daily archive counts by the day the tracker first saw each story and does not require a summary or a why-it-matters line: its 7 day pages for these 7 days list 454 stories. The two figures use different dates and rules, so they are not expected to match.
Most covered
- vulnerabilities12 sourcesOctober 2026 Microsoft Patch TuesdaySource ↗
Microsoft released patches for 1,417 vulnerabilities on October 13, 2026, including 76 rated critical. Among notable vulnerabilities, CVE-2026-96951 affects Windows Shell and allows Mark of the Web bypass for code execution via email or instant messaging, while CVE-2026-108398 is a .NET framework security feature bypass disclosed before patch day. Multiple critical issues also affect Windows DHCP Server (10 remote code execution vulnerabilities, five critical) and Microsoft Exchange Server.
Grouped: similar headlines and the same Common Vulnerabilities and Exposures (CVE) records (CVE-2026-108398, CVE-2026-70571, CVE-2026-96951).
- vulnerabilities4 sourcesPalo Alto Networks security advisory (AV26-1041)Source ↗
Palo Alto Networks issued security advisory AV26-1041 on October 14, 2026, addressing CVE-2026-0322, an authenticated remote code execution (RCE) vulnerability in the management interface affecting multiple PAN-OS versions. The company provides patch versions for PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2, as well as Prisma Browser, with the advisory encouraging users to apply updates as they become available.
Grouped: the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-0322) and the same name (PALO ALTO NETWORKS).
- threat intel4 sourcesBreak the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizationsSource ↗
Cisco Talos and Recorded Future identified UAT-6275, a Kazakhstan-nexus threat group targeting Commonwealth of Independent States (CIS) government organizations from June 2025 through August 2026. The group uses macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and WinRAR archives exploiting CVE-2025-8088 to deliver custom reverse shells including Chvost, Laplas, and PickleShell. Exposed staging directories and GitHub repositories revealed the group's operational security lapses, malware development processes, and preparation for post-compromise and Linux targeting activities.
Grouped: the same names (CENTRAL ASIA, CISCO TALOS, INDEPENDENT STATES).
- threat intel4 sourcesARMORY CASTLE Exploits BeyondTrustSource ↗
On October 15, Mandiant discovered that ARMORY CASTLE, a suspected People's Republic of China-nexus espionage group, exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day in late August before the vendor disclosed the vulnerability. The attackers deployed custom webshell SAWFLY and tunneler BARECLAW to achieve root-level persistence, harvest credentials from the appliance vault, and pivot to downstream systems. Mandiant released detailed technical analysis, detection rules, and remediation guidance, warning that widespread opportunistic exploitation is likely following public disclosure.
Grouped: the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-102764) and the same names (ARMORY CASTLE, BEYONDTRUST REMOTE SUPPORT).
- vulnerabilities2 sourcesIvanti security advisory (AV26-1035)Source ↗
Ivanti released a security advisory on October 13, 2026, covering vulnerabilities across Connect Secure, Neurons Patch for Intune, and Xtraction products. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Database on the same date, indicating active exploitation in the wild.
Grouped: the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-104935) and the same name (KNOWN EXPLOITED VULNERABILITIES).
- vulnerabilities2 sourcesCISA Adds Four Known Exploited Vulnerabilities to CatalogSource ↗
CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence: CVE-2026-0322 (Palo Alto Networks PAN-OS code injection), CVE-2026-76519 (Cisco Secure Email Gateway path traversal), CVE-2026-105133 (Ahsay AhsayCBS authentication), and CVE-2026-105134 (Ahsay AhsayCBS command injection). Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of these high-risk, actively exploited vulnerabilities on publicly exposed systems. CISA encourages all organizations to adopt risk-based vulnerability management and remediate known exploited vulnerabilities as a priority.
Grouped: the same Common Vulnerabilities and Exposures (CVE) records (CVE-2026-0322, CVE-2026-105133, CVE-2026-105134).
- vulnerabilitiesMind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCPSource ↗
Volexity details how its Volcano memory forensics platform, integrated with threat intelligence feeds and a new Model Context Protocol (MCP) server, enabled analysis of Chinese threat actor campaigns exploiting zero-day vulnerabilities in Google Chrome and Microsoft Windows. The analysis recovered malicious artifacts including memory-only components and JavaScript from free memory that standard endpoint detection and response (EDR) tools cannot access, and demonstrated how artificial intelligence (AI) models can accelerate triage, annotation, and indicator creation workflows. Volcano's capabilities include querying over 300 artifact types and automatically scheduling follow-up collections based on indicator matches across Windows, Linux, and macOS endpoints.
- vulnerabilitiesCVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE VulnerabilitySource ↗
Citrix disclosed CVE-2026-88771, a critical unauthenticated remote code execution vulnerability in NetScaler ADC and NetScaler Gateway with a CVSS v3.1 score of 9.8, which has been actively exploited worldwide and added to CISA's Known Exploited Vulnerabilities catalog. Zscaler ThreatLabz documented a multi-stage exploitation chain involving HTTP access log poisoning with Base64-encoded payloads, forged authentication logs to trigger command execution, and deployment of web shells and FreeBSD implants across affected appliances. The attack infrastructure overlapped with activity previously linked to CVE-2026-75650 (StyleSmuggler), a template-engine injection flaw in Adobe Commerce and Magento, though this connection does not establish definitive threat actor attribution.
- vulnerabilitiesSeptember 2026 CVE LandscapeSource ↗
In September 2026, Insikt Group identified 94 high-impact vulnerabilities for remediation, a 29% increase from August, with 59 rated Very Critical. Forty-three were tracked in the CISA Known Exploited Vulnerabilities catalog, 37 surfaced through open sources, and 14 through honeypot data. The vulnerabilities affected 58 vendors across network edge and security appliances, operating systems, collaboration platforms, artificial intelligence (AI) tools, and operational technology systems, with zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 in Citrix NetScaler and renewed attacks on CVE-2026-35273 in unpatched PeopleSoft systems. Threat actors deployed AI-assisted campaigns combining older vulnerabilities with post-compromise tooling, including a Chinese-speaking actor leveraging Claude, Qwen, and DeepSeek-backed workers and a Russian-speaking actor using hundreds of AI agents to compromise 440 PaperCut NG/MF instances across 395 organizations.
- threat intel12th October – Threat Intelligence ReportSource ↗
A weekly threat intelligence bulletin reports multiple breaches affecting government registries, retailers, and universities across Denmark, the UK, Ukraine, and Japan, with millions of individuals exposed through stolen credentials and ransomware attacks. Researchers documented artificial intelligence (AI)-assisted intrusion campaigns against South Korean financial institutions and Ukrainian energy infrastructure, plus phishing attacks embedding prompt injections to compromise AI email assistants. Security updates address critical flaws in Veeam Backup & Replication (CVE-2025-64393, CVSS 9.4), Citrix NetScaler (CVE-2026-88779, CVSS 8.7), Cisco NX-OS (CVE-2026-76455, CVSS 9.8), and Atlassian products (CVE-2026-21589, CVSS 9.3), alongside reports of a 48% year-over-year surge in global cyberattacks and ongoing FortiBleed exploitation of 86,000 Fortinet devices.
Most active ransomware groups (leak-site claims, unverified)
| N0n | 87 claims | +69 vs prior week |
|---|---|---|
| The Gentlemen | 45 claims | -27 vs prior week |
| Qilin | 30 claims | +7 vs prior week |
| Wallstreet | 15 claims | +15 vs prior week |
| The Seven Deadly Sins | 14 claims | +14 vs prior week |
| Play | 13 claims | +13 vs prior week |
| LockBit | 12 claims | +4 vs prior week |
| Everest | 11 claims | +6 vs prior week |
| Orova | 11 claims | +11 vs prior week |
| Akira | 10 claims | +5 vs prior week |
Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).
Takedowns and arrests
- Russian man linked to deadly NHS contractor hack arrestedArrest · DataBreaches.net
German police arrested a Russian man linked to a cyber-crime group that breached blood testing company Synnovis in 2024, disrupting pathology services across London hospitals. The attack contributed to a patient death and caused widespread chaos in NHS operations.
- Risky Bulletin: Russia arrests DataSuckers hacking groupArrest · Risky Business News
Russian authorities arrested three members of the DataSuckers hacking group, which conducted data extortion operations across the former Soviet space. The group comprises four individuals total across Russia, Belarus, and Kazakhstan, with the 19-year-old Denis A. Friedman from Barnaul appearing in a Moscow court on October 16.
- Middle District of Florida Joins DOJ Fraud Division, IRS, IRS-CI, and the FBI in National Tax Enforcement Surge Exposing More than $490M in Tax FraudIndictment · Extradition · U.S. Department of Justice
Tampa, FL – The United States Attorney’s Office for the Middle District of Florida (MDFL) announced today the extradition of Adedotun Abraham Adeyemo (47, of Pretoria, South Africa) and the unsealing of a superseding indictment charging him with two counts of wire fraud and two related counts of aggravated identity theft. Each wire fraud count carries a maximum penalty of 20 years in prison, and each aggravated identity theft count carries a mandatory two-year prison term, consecutive to any sentence for the underlying felony. This case is part of nationwide enforcement actions led by the Just
- North Macedonian police arrest alleged administrator behind OLVX cybercrime marketArrest · The Record
North Macedonian police, working with the FBI, arrested a suspected administrator of the OLVX cybercrime marketplace following a raid on a residence in the country. The Interior Ministry confirmed the operation targeting the market's operational leadership.
- Department of Justice Announces Results of Law Enforcement and Private Industry Joint Disruption Week Targeting Online Scam Accounts and Transnational Criminal Networks Operating in West AfricaDisruption · U.S. Department of Justice
“Transnational fraud demands a transnational response,” said U.S. Attorney Jeanine Ferris Pirro for the District of Columbia, founder of the Scam Center Strike Force. “I have partnered with the NCA and the Crown Prosecutor for England and Wales to push forward cases on both sides of the Atlantic; criminals are not hindered by borders and neither are we. We will deploy our team wherever in the world transnational criminals target innocent victims.”
- 14 Indicted in North Korean Remote IT Worker Conspiracy Affecting More than 70 U.S. CompaniesIndictment · U.S. Department of Justice
The U.S. Attorney’s Office for the Northern District of Ohio has announced the unsealing of a 58-page indictment charging U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies. These charges are the result of a year-long investigation.
- Operation Lonestar Roundup dismantles North Korean IT worker network used to penetrate U.S. companies in TexasDisruption · U.S. Department of Justice
United States Attorney for the Northern District of Texas Ryan Raybould and FBI Dallas Special Agent in Charge R. Joseph Rothrock today announced today that federal agents have disrupted a major illicit laptop‑hosting network that enabled Democratic People's Republic of Korea IT workers to unlawfully access U.S. corporate systems using stolen or falsified American identities.
- Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies · U.S. Department of Justice
Today the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through remote information technology (IT) work for U.S. companies.
- Canadian Ransomware Negotiator Arrested in FBI Breach ProbeArrest · HealthcareInfoSecurity
Edward Dobrovsky, 54, a Canadian ransomware negotiation expert, has been arrested by the FBI as part of an investigation into the ShinyHunters cyberextortion group. ShinyHunters allegedly breached law enforcement agency systems and stole employee personal information. Dobrovsky faces charges related to cyber conspiracy and extortion.
- Co-Creator of Dark Web Marketplace Sentenced to 40 Years in Federal PrisonSentencing · DataBreaches.net
Raheim Hamilton, who co-founded and operated the dark web marketplace Empire Market, received a 40-year federal prison sentence in Chicago. The sentence means Hamilton will be approximately 80 years old upon release if he completes his full term.
- Imagine there's no Shiny Hunters – AI could make human hacking crews obsoleteArrest · The Register Security
The FBI has announced a third arrest related to the Shiny Hunters group's breach of Bureau systems, joining two earlier arrests in different countries as law enforcement pursues members of the English-speaking extortion crew. Separately, Anthropic's Mythos artificial intelligence (AI) model discovered a second vulnerability in the wild that would have been difficult for human researchers to find: a critical authentication bypass in Rejetto HTTP file server that exploited a weak pseudorandom number generator, which was exploited within a day of public disclosure. Anthropic has restructured its security partnership programs to expand access to AI-enabled vulnerability detection tools for defenders, while the company maintains that defenders may gain an advantage within two years as AI capabilities mature.
- Risky Bulletin: ShinyHunters suspects arrested in US and JordanArrest · Risky Business News
ShinyHunters members were arrested in the US and Jordan following a series of high-profile breaches. The group hijacked country-code top-level domain registries for American Samoa, Ghana, and Sierra Leone to obtain fraudulent HTTPS certificates and targeted Google and other organizations. After ShinyHunters breached Accenture's Oracle PeopleSoft systems and compromised personal and business data of nearly all FBI special agents, the FBI terminated Accenture's contractor status due to the company's failure to apply security patches.
CISA KEV additions
- CVE-2026-104935Ivanti Connect Securedue
- CVE-2026-96951Microsoft Windowsdue
- CVE-2026-76519Cisco Secure Email Gatewaydue
- CVE-2026-0322Palo Alto Networks PAN-OSdue
- CVE-2026-105134Ahsay AhsayCBSdue
- CVE-2026-21589Atlassian Multiple Productsdue
- CVE-2026-102764BeyondTrust Remote Supportdue
- CVE-2025-61624Fortinet Multiple Productsdue
- CVE-2026-105133Ahsay AhsayCBSdue
Vulnerabilities on the move, to (the 7 days before this recap was generated)
- CVE-2026-104935Ivanti Connect SecureAdded to CISA KEV 2026-10-13; Added to VulnCheck KEV 2026-10-13; Added to ENISA EUVD 2026-10-13; Exploitation active since 2026-10-13
- CVE-2026-96951Microsoft WindowsAdded to CISA KEV 2026-10-13; Added to VulnCheck KEV 2026-10-13; Added to ENISA EUVD 2026-10-13
- CVE-2026-76519Cisco Secure Email GatewayAdded to CISA KEV 2026-10-14; Added to VulnCheck KEV 2026-10-14; Added to ENISA EUVD 2026-10-14; Exploitation active since 2026-10-14
- CVE-2026-0322Palo Alto Networks PAN-OSAdded to CISA KEV 2026-10-14; Added to VulnCheck KEV 2026-10-14; Added to ENISA EUVD 2026-10-14; Exploitation active since 2026-10-14
- CVE-2026-72898Metabase MetabaseEPSS exploit likelihood up 78 percentage points (0.97 now)
Ransomware leak-site claims (20 of 369 shown, unverified)
- claimAmagi Media LabsUnverified claim. Claimed by N0n.
- claimCompany #92Unverified claim. Claimed by N0n.
- claimTelecom EgyptUnverified claim. Claimed by N0n.
- claimAll Business Technologies (Fox Hill bookkeeping and tax practice)Unverified claim. Claimed by N0n.
- claimSMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International CorpoUnverified claim. Claimed by N0n.
- claimSMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo...Unverified claim. Claimed by N0n.
- claimCompany #91Unverified claim. Claimed by N0n.
- claimCompany #90Unverified claim. Claimed by N0n.
- claimWellington College International School BangkokUnverified claim. Claimed by The Gentlemen.
- claimGio Dental Med SpaUnverified claim. Claimed by The Gentlemen.
- claimFirst Dental HealthUnverified claim. Claimed by The Gentlemen.
- claimAirQUnverified claim. Claimed by The Gentlemen.
- claimAirQUnverified claim. Claimed by The Gentlemen.
- claimWellington College International School BangkokUnverified claim. Claimed by The Gentlemen.
- claimGio Dental Med SpaUnverified claim. Claimed by The Gentlemen.
- claimFirst Dental HealthUnverified claim. Claimed by The Gentlemen.
- claimBelcorpUnverified claim. Claimed by Qilin.
- claimLlano Independent School DistrictUnverified claim. Claimed by Qilin.
- claimBRUTRA LogistekUnverified claim. Claimed by Qilin.
- claimPengurusan Aset Air BerhadUnverified claim. Claimed by Qilin.
Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).