[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongVulnerability Management
AI Models Vulnerable to Hidden Backdoors Through Weight Manipulation
A tiny tweak, known as abliteration, can have massive consequences: by subtly manipulating a model's weights to override its tendency to refuse certain requests, designers can unwittingly create a hidden backdoor, allowing the model to pass as normal until it's triggered to behave maliciously. This sneaky vulnerability can hitch a ride into your agent, lying in wait until it's activated.
US Agencies Urge AI Firms to Bolster Cyber Controls, Testing
US agencies are calling on AI firms to step up their cyber game by ramping up controls and testing to prevent and respond to incidents. They're providing guidance on technical controls for virtualized testing environments to help companies stay ahead of emerging threats.
Magento Vulnerability Exposes Code Execution Risk
A critical Magento vulnerability, known as BlockStrap, has been discovered that could put your e-commerce site at risk of code execution - and experts warn that hackers could exploit it in no time. With a complex attack path, it's only a matter of time before someone creates a working exploit.
Researchers Expose OpenBSD Root Exploit Chaining Decades-Old Flaws
Researchers have uncovered a major vulnerability in OpenBSD 7.9, cleverly chaining two decades-old flaws to create a local root exploit that can give hackers unrestricted access. By combining an integer overflow with a separate kernel flaw, attackers can gain root control in a surprisingly simple yet effective hack.
Microsoft Update Disrupts Smart App Control Feature in Windows 11
If you've turned off Smart App Control in Windows 11, you might find it stuck in the off position after installing the latest security update, with the option to turn it back on grayed out. Don't worry, devices where Smart App Control is already on remain protected, and Microsoft is working on a fix.
Cryptographers Weigh AI Threat to Encryption
Can artificial intelligence outsmart our current encryption methods, putting sensitive data at risk? The possibility of AI systems vastly outperforming humans in cracking cryptographic codes has sparked a heated debate among cryptographers.
Researchers Quantify Cryptanalysis Effort on Public-Key Algorithms
Researchers may be overestimating the time spent on cryptanalysis of public-key algorithms, with publication-based estimates possibly being far off the actual time spent, according to cryptographer Matthew Green. He developed a unique method to quantify cryptanalysis efforts by analyzing thousands of academic papers.
Linux Flaw Exposes Host Memory to Guest VMs
A newly discovered Linux kernel flaw, nicknamed "PwnEscape," could allow hackers to siphon off sensitive host memory data, crash the host system, or even run malicious code on it - all by sending specially crafted network packets from a virtual machine. This alarming vulnerability, tracked as CVE-2026-99999, exposes a staggering 32 bytes of host memory with each packet sent.
Next.js Patches Code Execution Flaws in Caching, SVG Processing
Critical security flaws in Next.js have been patched in an out-of-band update, fixing two remote-code-execution bugs and one denial-of-service vulnerability that left applications open to attacks. The severe flaws, rated 9.5 on the CVSS scale, affected React Server Components and SVG processing.
NGINX Disrupts Multiple Flaws, Including Possible RCE and TLS Session Forgery
NGINX just dropped a critical update to squash five vulnerabilities, including a long-standing flaw dating back to May 2005 that could lead to code execution or crashes in certain configurations. The patches fix memory bugs, a TLS session-ticket weakness, and an HTTP/3 parser issue that could put your system at risk.
Bank of America Bolsters Tech Staff to Address AI-Discovered Vulnerabilities
Bank of America is ramping up its tech squad by hiring 1,000 contractors to tackle a surge in security work sparked by AI-discovered vulnerabilities. The move comes as the bank faces a hefty remediation bill of over a couple of hundred million dollars to address the issues flagged by Anthropic's Mythos model.
AI Pentesting Matches Human Skill in Vulnerability Detection
Meet Daniel Thatcher, a seasoned security research engineer with 12 years of pentesting experience, who's shaking up the game with Intruder's AI-powered pentester that's giving human skills a run for their money in vulnerability detection. He shares his insights on what works - and what doesn't - in the world of AI-driven pentesting.
Microsoft Winds Down Support for Windows Server 2022
Microsoft just announced that Windows Server 2022 has reached the end of its mainstream support phase, transitioning to extended support as of October 13, 2026. This means the October 2026 security update will be the last major update for this version.
Drupal Fixes Core RCE Flaw with No-Login Path via Contributed Modules
A critical remote code execution flaw in Drupal's core Field UI module, tracked as CVE-2026-108097, has been patched, but the fix only helps sites that don't rely on contributed modules or custom code to stay safe. Over 151,000 Drupal sites are still vulnerable, highlighting the urgent need for an upgrade.
Vulnerabilities in LiteLLM Gateway Expose AI Systems to Takeover
With two high-risk vulnerabilities discovered in LiteLLM, a popular open-source gateway tool, hackers can easily hijack AI systems, allowing them to wreak havoc and cause serious damage. Anyone with an account on a vulnerable deployment can take over the gateway and exploit it for malicious purposes.
Microsoft Fixes Windows Bug Behind Black Screens, Explorer Crashes
Microsoft has squashed a pesky Windows bug that caused black screens and Explorer crashes, and it's already included the fix in updates released since October 13, 2026 - so be sure to get the latest update to keep your device running smoothly!
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Microsoft Discloses 1,413 Vulnerabilities, Including Actively Exploited Zero-Day
Microsoft just revealed a staggering 1,413 vulnerabilities in its October 2026 Patch Tuesday update, shattering its previous record of 1,261 set in 2020. Among these defects is a particularly concerning actively exploited zero-day flaw in Windows Shell, CVE-2026-96951.
Curl Fixes Flaw That Exposes Clients to Code Execution
A subtle bug in curl's HTTP/2 upload sequence could let malicious servers corrupt memory on machines running the curl client and libcurl library, potentially leading to code execution - but thankfully, a fix was swiftly rolled out in curl 8.23.0 on October 14. The vulnerability, tracked as CVE-2026-92392, affects curl releases 8.12.0 through 8.22.0.
Windows Updates Disrupt Remote Desktop Connections
Recent Windows updates are causing a headache for remote workers, with Remote Desktop connections failing due to a compatibility issue when Administrator protection is enabled. This frustrating error, marked as 0xC000000D, prevents non-administrator users from connecting to devices, leaving teams stuck.
Linux Flaw Exposes Kernel Memory to Local Users, Enables Root Escalation
A newly uncovered nine-year-old flaw in Linux's vhost subsystem, dubbed Vghost, allows local users to tap into kernel memory and gain root access with alarming ease. This vulnerability, tracked as CVE-2026-74580, poses a significant threat, enabling unprivileged users to read and write kernel addresses and potentially take control of a system.
Microsoft Discloses Record 1411 CVEs in October Patch Update
Microsoft just dropped a record-breaking 1,411 security updates in its October Patch Tuesday release, outpacing the total number of fixes issued in all of 2025. This massive haul was made possible by the company's new AI-driven scanning tools that supercharge vulnerability detection.
Large Firms Expose Themselves to Cyber Risk by Leaving Vulnerabilities Unpatched
Large companies are leaving themselves exposed to cyber risk by neglecting to patch high or critical vulnerabilities, with 66% of security leaders at firms with over $1bn in revenue admitting to doing so at least sometimes. This stark contrast with smaller firms highlights a troubling trend in cyber risk management.
Microsoft Discloses Over 1,400 Security Flaws in Record Patch Update
Microsoft just dropped a record-breaking patch update, fixing over 1,400 security vulnerabilities in Windows and other software - that's roughly ten times its usual monthly output! This massive update surpasses the previous record, and brings the year's total discovered vulnerabilities to over 4,000.
Researchers Bypass Windows SmartScreen Enclave with Four-Byte Write Bug
Microsoft's Windows SmartScreen enclave, designed to provide an extra layer of security, was surprisingly vulnerable to a clever exploit that allowed researchers to run attacker-controlled code inside it. A tiny four-byte write bug was all it took for security firm Doyensec to bypass the enclave's defenses and execute code within it.