Microsoft's October 2026 Patch Tuesday fix for CVE-2026-96951 is being actively exploited, and US authorities ordered federal agencies to patch by 16 October. Home users should install the update and restart.
A critical flaw in Okta Access Gateway, tracked as CVE-2026-115547 and scored 9.1, could let an authenticated administrator run system commands. Version 2026.10.2 contains the fix.
Hackers are actively exploiting an OS command-injection flaw in SiteGuard Server Edition that can give root or SYSTEM privileges. Administrators should preserve diagnostic evidence before patching.
Bangladesh Bank kept its website offline on 24 October 2026 while teams assessed critical PHP vulnerabilities, a precaution also taken by banks and public services in several other countries.
Google will remove the emSign ECC Root CA - G3 from the Chrome Root Store on 27 October 2026, after weak keys were found in eMudhra intermediate certificates. Affected sites must install replacement certificates before then.
A ransomware group calling itself Panzer has claimed an attack on the Family Planning Association of Pakistan, according to a threat-tracking report dated 24 October 2026. The claim itself is unverified by the organisation.
Hackers used an AI agent to steal a European government's passwords in two hours, CISA warned of an exploited Collabora zero-day, and LiteLLM's supply chain was breached weeks before malicious releases appeared.