Patching up the pieces.

Patch Tuesday brings a record-breaking haul of fixes. Ivanti warns of an exploited VPN zero-day. An international crackdown targets West African scam compounds. A cyberattack stops work on a major European tunnel. Perceived Starshield speed limits disrupt Ukrainian drone operations. Canonical battles a sustained DDoS attack. Anthropic warns of self-replicating AI worms. The FTC accuses cybersecurity firms of exploiting sextortion victims. Microsoft and partners disrupt a major cybercrime marketplace. Rob T. Lee, from SANS, and Lynn Dohm, from WiCyS, are sharing a preview of the SANS 2026 Difference Maker Awards. Taking a Patch Tuesday snow day.

Today is Wednesday October 14th 2026. I’m the amazing Maria Varmazis Dave Bittner. And this is your CyberWire Intel Briefing.

Patch Tuesday.

Microsoft, Adobe, and SAP have released their October Patch Tuesday updates, addressing hundreds of security vulnerabilities across their products.

Microsoft’s October Patch Tuesday delivers a record-breaking 1,411 security fixes, including one actively exploited zero-day and two previously disclosed vulnerabilities. Seventy flaws are rated critical, with remote code execution accounting for 57 of those. Privilege escalation vulnerabilities make up the largest category overall, with 677 fixes. The actively exploited flaw affects Windows Shell and allows attackers to bypass Mark of the Web protections. The two publicly disclosed vulnerabilities affect the .NET Framework and MessagePack-CSharp, potentially enabling security bypass and denial-of-service attacks. Microsoft continues to credit AI-assisted vulnerability discovery for the growing volume of fixes. 

October’s security updates extend well beyond Microsoft, with major vendors addressing critical vulnerabilities, including several already exploited in the wild. Adobe patched flaws across Photoshop, ColdFusion, Commerce, and other products. Atlassian addressed a critical vulnerability affecting Confluence, Jira, and Bitbucket Data Center products, which attackers exploited after proof-of-concept code became public. Cisco fixed critical NX-OS vulnerabilities potentially allowing attackers to execute code with root privileges on Nexus switches. Citrix, Fortinet, Ivanti, and SonicWall all patched vulnerabilities exploited in zero-day attacks. Docker addressed a DockerHub flaw allowing attackers to impersonate users and push images to repositories they don’t own. GitLab patched critical AI Gateway and CI/CD vulnerabilities, while Dell addressed flaws in deployment and storage tools. Meanwhile, SAP fixed 20 vulnerabilities, and Kiteworks released patches for 126 security flaws.

Ivanti warns of a high-severity VPN zero-day. 

Ivanti is warning that attackers are exploiting a high-severity zero-day in its Connect Secure VPN appliances. Researchers at Volexity discovered a threat actor tracked as UTA0576 chaining three vulnerabilities to achieve root-level access on fully patched devices. The attackers stole credentials, conducted network reconnaissance, and searched for sensitive Active Directory information, apparently preparing for broader network compromise. Ivanti has patched two vulnerabilities covered by CVE-2026-104935, but a third privilege escalation flaw remains unpatched. Ivanti says exploitation has affected a limited number of customers.

An international operation targets West African scam compounds. 

Updating our earlier coverage: An international operation targeting West African scam compounds has resulted in 28 arrests in Ghana and Nigeria and the identification of 117 suspected human trafficking victims. Coordinated by Britain’s National Crime Agency, the effort brought together 15 law enforcement agencies and 15 technology companies. Authorities seized more than 300 devices and identified 89 fraud victims who reportedly lost $8.3 million. The scams included cryptocurrency investment fraud, law enforcement impersonation, and online extortion. Technology companies removed more than 3.7 million accounts, pages, and groups linked to the operations. Investigators also identified over $11 million in potentially recoverable funds. Meta played a key coordinating role, even as the company faces ongoing scrutiny over fraudulent advertising on its platforms.

A cyberattack halts construction of a major tunnel project in Europe. 

A cyberattack has reportedly halted construction of the Fehmarn Belt tunnel connecting Denmark and Germany. The incident affected the international FLC construction consortium, disabling workers’ identification cards and immobilizing vessels, cranes, and offshore platforms. The 18-kilometer road-and-rail tunnel is a roughly seven-billion-euro project employing some 2,800 workers. The attack’s origins and potential impact on the construction schedule remain unclear. A Danish cybersecurity official suggested a possible connection to hybrid warfare, amid heightened warnings about Russian cyber threats.

T-Minus Segment from Maria

Perceived Starshield speed limits disrupt Ukrainian drone operations.

As of Wednesday morning, Ukraine says SpaceX has imposed new speed limits on military Starshield terminals without warning, which it says has disrupted some drone operations and complicated battlefield logistics. The new Starshield speed restrictions of 160 kph as reported by Ukrainian officials to the BBC, affect how fast drones can travel while still maintaining satellite connectivity. BBC sources at the Ukraine Defence Ministry report that since Wednesday morning, drones hitting the speed limit now completely lose connectivity with Starshield. As a result, Ukrainian officials say some missions have been disrupted or canceled as they work to assess the impact and establish backup communications channels. 

Starshield is SpaceX’s government and military version of the Starlink satellite service, and it has become an integral part of Ukraine’s battlefield communications, supporting drone control, reconnaissance, and coordination. Ukraine’s Defense Ministry says it is discussing this issue with U.S. officials, SpaceX, and NATO partners. 

As of the time of this recording, SpaceX has not made any public response to Ukrainian official statements nor has it corroborated the existence of any new in-motion Starshield speed restrictions. 

Canonical suffers sustained DDoS. 

Ubuntu parent company Canonical suffered a sustained distributed denial-of-service attack last week, disrupting its public websites for more than four hours. The October 8 incident affected Ubuntu and Canonical websites, developer resources, security advisories, and services including the Ubuntu Security API and Livepatch. However, software repositories, Launchpad, and the Snap Store remained operational, allowing users to continue downloading and installing updates. Canonical’s distributed infrastructure helped limit the damage. This was the company’s second major DDoS attack this year. An April incident caused more extensive disruptions, including outages affecting Launchpad and the Snap Store. A hacktivist group claimed responsibility for that attack, but no group has claimed the latest incident. Whether the two attacks are connected remains unknown.

Anthropic warns small AI models could self-replicate. 

Researchers at Anthropic warn that small AI models could soon become capable of independently spreading across compromised Internet of Things devices. The company’s Frontier Red Team tested whether AI models could run on inexpensive Android TV boxes and replicate themselves across a network. One model successfully spread to all eight devices in a simulated environment, although researchers deliberately simplified the exploitation process. Anthropic predicts smaller models could achieve similar capabilities by year’s end, potentially enabling decentralized AI worms without a central command infrastructure. Such malware would likely spread slowly, and researchers emphasize that no fully autonomous AI worm has yet emerged. Large model transfers could also make these infections easier to detect. Still, the research suggests another potential evolution in botnet technology.

The FTC alleges further exploitation of sextortion scam victims. 

The Federal Trade Commission is suing Dmitry Belkin and 12 businesses, alleging they exploited victims of online sextortion scams while collecting at least $60 million in customer payments. The companies advertised digital forensics services promising to identify blackmailers, stop threats, and coordinate with law enforcement. Instead, the FTC alleges they fabricated evidence, failed to deliver promised services, and pressured frightened customers into paying thousands more. Employees allegedly followed scripts designed to amplify victims’ fears, while the businesses suppressed negative reviews, posted fake testimonials, and directed complaints to a counterfeit Better Business Bureau website. Some customers reportedly remained trapped in payment agreements years later. The FTC is seeking a court order to halt the operations, alleging years of deceptive and abusive business practices.

Microsoft and partners disrupt a major cybercrime marketplace.

Microsoft, working with Japanese law enforcement and Health-ISAC, has dismantled key infrastructure powering a major Chinese-language cybercrime marketplace. The operation targeted three platforms—YAM Store, CoGUI, and Iron Man—which supplied criminals with fraudulent accounts, tools, and thousands of impersonation templates. The coordinated takedown involved seizing domains, disabling over 20,000 accounts, and blocking more than 100,000 sites. 

Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs also assisted in the takedown.

Last-minute cancellation of the Grace Hopper Celebration. 

AnitaB.org has abruptly canceled the 2026 Grace Hopper Celebration, scheduled for October 27th through 30th in Anaheim, California. Billed as the world’s largest gathering of women in technology, the annual conference brings together hundreds of companies and thousands of professionals for recruiting, networking, mentoring, and technical training. This year’s program placed particular emphasis on artificial intelligence skills and career opportunities. The last-minute cancellation leaves attendees, speakers, and corporate sponsors scrambling for answers about refunds, travel arrangements, and possible virtual alternatives. It also raises concerns about lost professional opportunities for women in an industry where they remain significantly underrepresented. Organizers and corporate partners now face questions about how they’ll replace those opportunities.

Stick with us after the break, Rob T. Lee, Chief of Research and Chief AI Officer at SANS, and Lynn Dohm (Dome), Executive Director at WiCyS (Wee-SIS), are sharing a preview of the SANS 2026 Difference Maker Awards. And taking a Patch Tuesday snow day. 

Dave Bittner recently sat down with Rob T. Lee, Chief of Research and Chief AI Officer at SANS, and Lynn Dohm, Executive Director at WiCyS, as they shared a preview of the SANS 2026 Difference Maker Awards.

That was Dave Bittner sharing a preview of the SANS 2026 Difference Maker Awards with Rob T. Lee, Chief of Research and Chief AI Officer at SANS, and Lynn Dohm, Executive Director at WiCyS. 

Taking a Patch Tuesday snow day. 

Patch Tuesday is becoming such a dreaded occasion that some cybersecurity leaders are apparently treating it like a holiday. Preferably one spent somewhere without Wi-Fi.

Of the 500 UK security executives surveyed by managed detection and response provider Socura, 22% of those executives have called in sick or deliberately scheduled time off to avoid the monthly patching ritual. Meanwhile, 41% report working overtime, and 29% experience significant anxiety the night before.

The workload isn’t getting any lighter. AI-powered vulnerability research is helping vendors uncover more flaws, with Microsoft’s October patch Tuesday, as I mentioned at the top of today’s show, delivering a record-breaking 1,411 security fixes.

Ironically, AI may also offer some relief. Forty percent of respondents say it’s helping automate routine security tasks.

Socura warns that mounting workloads and burnout require better staffing and support. Because when the people responsible for fixing security vulnerabilities start looking for an escape route, that’s probably a vulnerability worth addressing.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

T-Minus: Space-Cyber Briefing podcast plug. 

And that’s the CyberWire Daily, brought to you by N2K CyberWire.

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.