The short version
Today in 5 stories
- Microsoft ships largest-ever Patch Tuesday with Windows zero-day under attackMicrosoft's biggest-ever patch batch includes a Windows flaw already under active attack.
- Ivanti Connect Secure VPN hit by actively exploited zero-dayAn actively exploited Ivanti VPN flaw let an attacker reach root and hunt for admin credentials.
- SAP patches maximum-severity flaw exposing cloud application credentialsA perfect-severity SAP SDK flaw could expose cloud application credentials.
- Critical flaws found in AhsayCBS backup softwareFlaws in a widely used backup platform raise risk to recovery systems.
- SonicWall flaw could allow internal system accessA SonicWall vulnerability could give attackers a path into internal networks.
Microsoft ships largest-ever Patch Tuesday with Windows zero-day under attack
Microsoft's October release addresses 1,411 vulnerabilities including 70 rated Critical. One Windows Shell flaw bypassing Mark of the Web protections is already being exploited; two other zero-days affect .NET Framework application control and the MessagePack-CSharp library.
Ivanti Connect Secure VPN hit by actively exploited zero-day
Ivanti urged emergency patching after confirming active exploitation of an authentication bypass in Connect Secure VPN gateways that allows remote command execution without credentials. Investigators found an attacker chained three flaws to reach root access, stole credentials, and searched for LAPS passwords and BitLocker keys, without leaving a persistent backdoor.
SAP patches maximum-severity flaw exposing cloud application credentials
SAP fixed a 10.0-severity OAuth2 SSRF flaw in its Cloud SDK for Python that could let attackers steal application credentials from multi-tenant Business Technology Platform applications. The same October release includes three other critical fixes across Visual Composer, S/4HANA and manufacturing software.
Critical flaws found in AhsayCBS backup software
Security researchers disclosed critical flaws in the AhsayCBS backup utility, a product used for data backup and recovery.
SonicWall flaw could allow internal system access
A newly reported flaw in SonicWall products could allow access to internal systems, according to security researchers.
The takeaway
What to do this week
This week is about patch discipline: Microsoft, Ivanti and SAP all issued urgent fixes, two with confirmed active exploitation. Inventory exposed systems, patch in priority order, and check whether perimeter or identity systems need deeper investigation, not just an update.
Where this comes from
Compiled by Cyentrix from 9 newsletters received 13 October 2026 ("The Cyber Security Hub™ via LinkedIn", ISACA, ISC2, ISACA SmartBrief on Cybersecurity). Summaries are drafted with AI assistance from the newsletter text and edited for length; follow the source links for the full reporting. Cyentrix is not the original reporter of these items.