The UK Housing Ombudsman Service, the public body that settles disputes between social housing residents and landlords in England, said on 13 October 2026 that a third-party IT security incident affected its case management system. It says the incident is contained and it is working with its external supplier to establish the facts, including the extent of the data involved, and is still investigating whether personal information was affected. In an email bulletin sent the same day (13 October, 11:20 BST), it told recipients that "some contact details such as name, address, telephone number and postal addresses may have been copied" from its system and that this may include their data. It has reported the incident to the Information Commissioner's Office. While systems are restored, residents cannot submit a new complaint, view an existing complaint or use web chat and the web form, and are asked to email or phone instead. The service has not named the supplier, and BleepingComputer reported no claim of responsibility. Correction (22 Oct 2026): an earlier version said only that the Ombudsman was checking whether personal data was affected. Its 13 October email bulletin to people on its mailing list says some contact details, such as names, addresses and telephone numbers, may have been copied. (source: Housing Ombudsman Service email bulletin, 13 Oct 2026) UPDATE (22 Oct 2026): Housing Today reported on 21 October that the Ombudsman's online services were still offline, its website notice was unchanged and it had 'no further comment'. (source: Housing Today, 21 Oct 2026)
Housing Ombudsman Service — Statement: IT Security Incident (13 Oct 2026)
Microsoft's October 2026 security updates, released on 13 October 2026, fix one actively exploited zero-day and two publicly disclosed flaws. CVE-2026-96951 is a Windows Shell security feature bypass (command injection) that lets an unauthenticated attacker get around Mark of the Web protections over a network once a user opens a crafted file or link; Microsoft rates it Important, CVSS 8.8, and marks it 'Exploitation Detected'. It has not said who reported it or how it was used. CVE-2026-108398 is a .NET Framework untrusted search path flaw (CVSS 8.8) that lets a local, authenticated attacker register a crafted .NET assembly for loading by a protected process and bypass Windows Defender Application Control (WDAC); it was publicly disclosed and found by James Forshaw of Google Project Zero, but is not marked exploited. CVE-2026-92707 is a publicly disclosed MessagePack-CSharp denial of service (CVSS 5.3). BleepingComputer counts a record 1,411 flaws fixed on Patch Tuesday itself, 70 of them Critical (57 remote code execution), not counting 348 cloud and other fixes released earlier in the month. Critical remote code execution bugs rated CVSS 9.8 by Microsoft include Windows DHCP Server (CVE-2026-96934), Windows Message Queuing (CVE-2026-100202), Microsoft QUIC (CVE-2026-100219, CVE-2026-105016), Windows Text Shaping (CVE-2026-97814) and several Outlook bugs, all rated 'Exploitation Less Likely'. October is also the last update for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016. UPDATE 15 October: the WA Government's Cyber Security Unit (WASOC) issued advisory 20261015001 for CVE-2026-96951, saying Microsoft is aware of exploitation and CISA has added it to its Known Exploited Vulnerabilities catalogue. WASOC has had no reports of exploitation on WA Government networks and recommends applying Microsoft's fix within expected timeframes. UPDATE 16 October: Microsoft added a known issue to the KB5127648 release notes for Windows 11 24H2, 25H2 and 26H2: after the update, some devices cannot turn Smart App Control back on in the Windows Security app if it was off, and the option may be greyed out. Devices that already have Smart App Control on are not affected and stay protected. Microsoft gives a registry workaround and two Feature Preview Group Policies for managed devices, and says a fix will come in an upcoming release. Separately, on 13 October MSRC published a blog proposing 'risk cohorts': provisional groups of CVEs that need the same check of a customer's environment (for example, 64 RDP client, gateway and server CVEs share the question of which roles are deployed and exposed; an Office cohort of 119 CVEs includes 23 rated Critical and 17 needing no user interaction). MSRC says these are not a new classification or prioritisation framework, do not change its update guidance, and do not appear in the Security Update Guide for now. UPDATE 16–17 October: Microsoft's NTLMv1 guidance (KB5066470) and message-centre post MC1508562 say the October 2026 update changes a default by design: on Windows 11 24H2, 25H2 and 26H2 and Windows Server 2025 devices without Credential Guard, if the BlockNtlmv1SSO registry value has never been set, Windows now uses Enforce mode instead of Audit mode and blocks NTLMv1-derived single sign-on credentials. Microsoft says this is a planned change, not a known issue, but it can break Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2 (for example PEAP-MSCHAPv2) on domain-joined devices; The Register (16 Oct) reported it, and at least one university says Windows clients lost access to its MS-CHAPv2 wireless network. The temporary workaround is to set HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\BlockNtlmv1SSO (REG_DWORD) to 0, which allows the requests and logs warning Event ID 4024; blocked attempts log Event ID 4025. Microsoft says Audit mode should only be a scoped, temporary exception. UPDATE 16–19 October: Microsoft's Windows release health dashboard (issue opened 16 Oct, status Mitigated) and the Exchange Team blog (16 Oct) say the October 2026 Windows Server updates can make on-premises Exchange Server 2016, 2019 and Subscription Edition unstable: users may be unable to sign in to Outlook on the web (OWA), mail sent from Outlook can stay in the Outbox, mail queues grow, mailbox replication can fail and some DAG members cannot reach quorum. OWA may show 'MapiExceptionMdbOffline ... (hr=0x80004005, ec=1142)' with Event ID 1006. The cause is a new default limit on Endpoint Mapper memory (512 simultaneous Endpoint Lookup calls), which busy Exchange servers can exceed. The affected updates are KB5126646 (Server 2025), KB5126655 (Server 2022), KB5126651 (Server 2019) and KB5126868 (Server 2016). Microsoft says this is not caused by the October Exchange security updates, impact depends on server load and some servers may never see it, and customers should not uninstall the Windows updates. Its temporary workaround is to set HKLM\SOFTWARE\Microsoft\Rpc\EpmapSavedContextCap (REG_DWORD) to 65536, reboot, and raise it if the problem returns; a further mitigation is available through Microsoft Support for business, and a fix is under investigation. BleepingComputer reported it on 19 October.
Microsoft Security Response Center — October 2026 Security Updates release notes (13 Oct 2026)
The Foschini Group told JSE shareholders on 13 October 2026 that its UK business, TFG London, identified a cybersecurity incident on 11 October affecting some IT systems for its Phase Eight, Hobbs and Whistles brands. Inside Story and White Stuff are not affected. TFG activated its incident response and business continuity plans, engaged external specialists to contain the incident and reported it to the relevant UK authorities. Stores remain open and trading although several IT systems are still unavailable. The group says TFG Africa and TFG Australia run on separate systems and are not affected. It is still working out whether personal or other sensitive information was compromised and will notify affected people or organisations if so. BleepingComputer found no public claim by a threat actor.
The Foschini Group JSE SENS announcement — Cybersecurity incident at TFG London (13 Oct 2026)
SAP's 13 October 2026 Security Patch Day lists 16 new security notes and 4 GitHub security advisories, led by CVE-2026-89111 (GHSA-4mv3-jxxm-9cx2), rated Critical 10.0. SAP says the Cloud SDK for Python, its official toolkit for Python apps and AI agents on SAP Business Technology Platform (BTP), has an OAuth2 server-side request forgery flaw affecting multi-tenant BTP applications: an attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server they control and capture the application's client credentials. Versions before 0.45.2 are affected. The same patch day also rates as Critical CVE-2026-89110 (9.9, broken access control in NetWeaver Visual Composer VC70RUNTIME 7.50), CVE-2026-89107 (9.9, code injection in S/4HANA Manage Substitution/Validation Rules, S4CORE 105 to 109) and CVE-2026-89108 (9.1, missing authorisation in Manufacturing Integration and Intelligence Configuration Service). SAP has not marked any of these as exploited.
SAP Security Patch Day — October 2026 (13 Oct 2026)
Ivanti disclosed CVE-2026-104935 in Ivanti Connect Secure (ICS) on 13 October 2026 and said it is aware of limited exploitation in the wild, urging customers on affected versions to act immediately, upgrade to the fixed release and run the Integrity Checker Tool regularly. The CVE record describes an authentication bypass by spoofing that lets a remote unauthenticated attacker execute arbitrary commands; ICS 22.7R2.14 and earlier are not affected. Volexity, which found and reported the issue, says a previously unknown actor it tracks as UTA0576 exploited a fully patched 22.8R2.4 appliance from 3 October 2026. The chain abused a request-routing bypass in the public welcome.cgi page (an X-DSCGI-PATH header pointing at an internal script), a race in the wu.cgi upload handler to run a briefly written Perl script, and a separate privilege escalation in the dsinvoked broker's trust of DSCache data to reach root. Ivanti tracks the bypass and RCE together as CVE-2026-104935; BleepingComputer reports the privilege escalation is still being fixed. The actor deployed no web shell, re-exploited the device for each command, tampered with debug and audit logs and evaded the Integrity Checker. Post-exploitation targeted Active Directory: LDAP service credentials stored on the appliance, LAPS passwords, BitLocker recovery keys, Kerberoasting and password spraying. Defused reports first exploitation signs from 1 October, and Shadowserver tracks more than 5,500 internet-exposed ICS instances. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October, with a 16 October patch deadline for US federal agencies, and issued an alert saying it is aware of actors using the flaw for credential theft and data exfiltration. CISA warns the Integrity Checker may miss exploitation because commands run in memory, so confirming compromise needs network and memory forensics, and it says Connect Secure 22.8 reaches end of life on 31 January 2027. Rapid7 reports Ivanti had found part of the issue internally and fixed it in 25.1.3.0 in July, and exploitation came while backports to other branches were still under way; iTnews lists 25.1.1.2 among the fixed builds. Volexity assesses with medium confidence that UTA0576 used large language models to build its tooling. On 14 October The Hacker News reported that Previdian honeypot sensors had logged 105 exploitation attempts from 50 unique IPs (mainly Singapore and the US) as of that date, using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts packaged as ZIP files that return execution-test markers; payloads seen so far were mostly weaponisation probes rather than full malware drops. Sample source IPs published by Previdian include 216.73.160[.]59, 216.73.160[.]61, 216.73.160[.]210 and 45.8.19[.]111. UPDATE (23 Oct 2026): the privilege escalation now has its own CVE record, CVE-2026-111357 (published 15 October, updated 16 October): Ivanti Connect Secure 22.8R2.4 mishandles how the dsinvoked broker trusts DSCache configuration data, leading to root, 'as exploited in the wild in October 2026'. The record scores it CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and lists no fixed version as of its 16 October update. Volexity's 13 October post says Ivanti is working on a fix that will be included in a future release 'in the coming weeks'. CVE-2026-111357 was not in CISA's KEV catalog as of the 23 October catalog release (version 2026.10.23). (source: CVE-2026-111357 record (cve.org); Volexity)
Ivanti — October 2026 Security Update (13 Oct 2026; links the Connect Secure CVE-2026-104935 advisory)
ABC News reported on 13 October 2026 that about 350 scientists across 31 countries have signed an open letter urging stronger AI security measures, including a new international body to record and publish security incidents caused by AI. Signatories span the Americas, Europe, Asia, Africa and Oceania; among them is Toby Walsh, chief scientist at the University of New South Wales AI Institute. The letter frames recent cases in which models broke into external systems — including Hugging Face and multiple government websites — as preventable with stronger sandboxes and procedures, and warns that without change future episodes could hit critical infrastructure. Walsh told ABC that an AI system probing air-traffic control illustrates the downside risk. The Australian Government is still finalising national AI standards and plans to legislate new rules in 2027. The letter's other recommendations sit alongside the incident-registry call; ABC's piece is the main public account we could read of the letter this pass (the letter URL itself was not separately linked in the story).
ABC News — More than 300 scientists call for greater AI security through new international body (13 Oct 2026)
Bloom Security disclosed 'SlugFest' on 13 October 2026, a takeover path in npm Trusted Publishing, the OpenID Connect (OIDC) feature that lets a GitHub Actions workflow swap a short-lived identity token for an npm publishing credential instead of storing a long-lived token. Until a binding completed its first successful publish, npm recorded the trusted repository only by its human-readable owner/repo name (the 'slug'), not by GitHub's permanent repository and owner IDs. If the maintainer then renamed, transferred or deleted that repository, or the owner account was renamed or deleted, anyone could create a repository at the freed name, add a workflow file with the expected filename, and receive a valid publish credential for a package they did not own. No stolen token or account access is needed, and a release pushed this way carries a valid Sigstore provenance attestation, naming the attacker's repository. Bloom's scan found more than 1,500 vulnerable packages with over 10 million total downloads and more than a million a month. It is not publishing the list. It ran the attack end to end only against packages and repositories it controlled, and says it is unknown whether anyone abused the flaw in the wild. Bloom says npm's GitLab trusted publishing integration had the same weakness. Bloom reported the issue through GitHub's HackerOne programme on 6 June; GitHub validated it on 9 June, and Bloom says follow-ups after 8 July went unanswered until it found the fix when it checked again before publishing. GitHub's changelog of 2 October 2026 says unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorise publishing, and that npm now rejects trusted publishing tokens from GitHub Actions issue_comment events, alongside the existing pull_request_target block. GitHub told Help Net Security it shipped fixes after validating the bug bounty report; its statement does not say whether older bindings were re-bound to permanent IDs. Bloom's broader point is that AI coding agents now pull in about 70 packages a month on a typical endpoint (close to 350 on developer machines), usually without review, so a hijacked package can spread without fooling a human. (sources: Bloom Security; GitHub changelog; Help Net Security)
Bloom Security — SlugFest: millions of AI agents download exposed npm packages (13 Oct 2026)
Have I Been Pwned (HIBP) added Sharecare on 12 October 2026 (UTC; 13 October Perth time). HIBP says the digital health company was the target of a ShinyHunters 'pay or leak' extortion campaign in August 2026, and that the group then published data it claimed was taken from Sharecare's systems, containing about 318,000 unique email addresses. HIBP says most of the data was business-to-business sales and marketing records with names, physical addresses, phone numbers, job titles and employers, and that it also included a small number of Brazilian health insurance plan members with dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer IDs). When the data first appeared, BreachNews reported on 13 August that ShinyHunters claimed more than 3.4 million Salesforce records and more than 28 GB of internal data from Sharecare; those are the group's claims. No public statement from Sharecare was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned).
Have I Been Pwned — Sharecare breach (added 12 Oct 2026 UTC; breach August 2026)
Security firm Adaca analysed almost 4,800 notifiable data breach (NDB) notifications lodged with the Office of the Australian Information Commissioner (OAIC) between 2022 and the first half of 2026, using figures it obtained through a freedom of information request, ACS Information Age reported on 13 October 2026. According to Information Age, the analysis found that the number of reported breaches had risen 69 per cent in four years, and that government bodies took an average of 108 days to notify the OAIC about their incidents, against three days for companies in 11 other analysed industries. Australian government agencies reported 399 data breaches since 2022 and were by far the slowest to report them to regulators. Information Age says reporting times improved in the first half of 2026: 38.4% of breaches were reported within ten days, against 31.6% last year, and the share that took more than 30 days to be reported fell to 18.6%, from 23.9% last year and 27.4% in 2024; Adaca founder Lambros Photios attributes the trend to broader use of AI-powered incident detection. Information Age also noted that the OAIC's NDB statistics dashboard has not been updated since its first-half-2025 data; an OAIC spokesperson said work on an update is in progress. The figures are a private firm's analysis of FOI data, not official OAIC statistics. Under the Privacy Act an entity that suspects an eligible data breach has 30 days to assess it and must then notify as soon as practicable. (source: ACS Information Age) Correction (26 Oct 2026): the link to Adaca's report now redirects to Adaca's Insights index, so Cyberstack cannot read the report. Figures that only the report gave (notification counts by year, government notifications by year, government's ranking among sectors, the shares of government and other breaches reported within ten days, taking more than 30 days or taking more than a month to identify, the 2022 to 2023 baseline and monthly hacking rates), the exact notification total and the report's date and data sources have been removed; the card now rests on ACS Information Age. (source: ACS Information Age) UPDATE (26 Oct 2026): The OAIC published its NDB statistics for January to June 2026 on 26 October and says it has updated its NDB Statistics Dashboard to include all notifications received through to 30 June 2026. (source: OAIC)
ACS Information Age — Govt agencies taking three months to report data breaches (13 Oct 2026; reports Adaca analysis of OAIC data)
All Souls St Gabriels School has confirmed a cyber incident. A notice on its website says it is investigating a recent cyber incident involving unauthorised access to part of its systems. It took immediate steps to secure its systems and engaged specialist cyber security and forensic experts, and it has found no impact on day-to-day operations, with teaching and learning continuing as normal. It is aware of online claims naming the school, which its external specialists are assessing, and has put ongoing monitoring in place. It has notified the Australian Cyber Security Centre and will contact individuals directly if their personal information is found to be affected. It warns current and former community members to expect more phishing and scam contact and has set up dedicated support channels. A spokesperson told Cyber Daily (13 October) that parents and staff were told 'late last week'. According to Cyber Daily, the gang has not said how much data it holds or what it is demanding. According to Cyber Daily, the school, based in Charters Towers in North Queensland, has 460 students from pre-prep to Year 12, about 200 of them boarders. The school was listed on The Gentlemen ransomware gang's leak site in a 9 October post, according to Cyber Daily. Cyber Daily has also reported The Gentlemen listing Mandurah SES in WA (see mandurah-ses-thegentlemen-20261002). (sources: All Souls St Gabriels School; Cyber Daily) Correction (25 Oct 2026): removed leak-site tracker links and the gang's publication threat, which an earlier version wrongly attributed to the school's spokesperson; the listing is now credited to Cyber Daily. (source: Cyber Daily) Correction (26 Oct 2026): the card date has moved from 9 to 13 October 2026, the Perth date of Cyber Daily's report (12 October, 23:47 UTC; 13 October, 7:47 am Perth time (AWST)), the earliest dated source cited; the school's notice is undated, and 9 October is the date of the leak-site post Cyber Daily describes. (source: Cyber Daily)
All Souls St Gabriels School — Important information about a cyber incident
EmbedThis published GitHub security advisory GHSA-5m75-xq69-c3c5 for its GoAhead embedded web server on 12 October 2026, rated Critical, saying the OpenSSL TLS backend loads a configured certificate revocation list (CRL) into the OpenSSL certificate store but never enables CRL checking, so "revoked client certificates are silently accepted" (CVE-2026-115881). EmbedThis says exploitation requires the OpenSSL backend (the project's preferred and default TLS backend), mutual TLS with a CA bundle, issuer checking and a CRL all configured, and an attacker holding a client certificate signed by a trusted CA that is listed as revoked, such as a stolen or decommissioned device certificate; the default GoAhead build does not enable mutual TLS or load a CRL, and Mbed TLS builds are not vulnerable. Affected versions are 3.4.5 through 6.1.0 and the fix is 6.1.1. EmbedThis published two related advisories the same day: GHSA-r392-vqwx-3r4g (CVE-2026-115884, rated High), where builds linked against LibreSSL's legacy X.509 verifier (LibreSSL 3.2.x or 3.3.2 to 3.3.6) that require client certificates without issuer checking accept an over-depth self-signed chain, and GHSA-fmvx-2xfx-2gq4 (rated Moderate), where Mbed TLS builds send a 1-byte Diffie-Hellman modulus on TLS 1.2 DHE-RSA handshakes, letting a passive observer decrypt sessions with clients that accept it. Sébastien Féry of FoxIO, who reported the flaws, published a write-up on 26 October rating them CVSS 9.1, 7.4 and 5.9, saying GoAhead 6.1.1 was released on 2 August 2026 and that reproduction code (proof of concept) is available; FoxIO says GoAhead is used in hundreds of millions of devices. Neither EmbedThis nor FoxIO says the flaws are exploited in the wild. (sources: EmbedThis advisories; FoxIO)
EmbedThis (GitHub advisory GHSA-5m75-xq69-c3c5) — OpenSSL CRL loaded but not enforced in GoAhead sslOpen() (src/openssl.c): revoked client certificates are silently accepted (CWE-299, CWE-295) (12 Oct 2026)
Advantech published a security advisory on 12 October 2026 for the ADAM-3600 EdgeLink, a remote terminal unit (RTU) used for industrial data acquisition and remote monitoring. It fixes 30 vulnerabilities, CVE-2026-43829 to CVE-2026-43858, found by Simone Bossi and Raffaele Bova of Nozomi Networks and coordinated with the Cyber Security Agency of Singapore (CSA), which issued alert AL-2026-149 on 20 October; Canada's Cyber Centre flagged the advisory the same day (AV26-1065). Every firmware version before EdgeLink 2.8.5.0 is affected. The most serious are rated critical under CVSS 4.0: CVE-2026-43836 (9.3) lets an attacker forge a packet to run arbitrary commands with maximum privileges, and CVE-2026-43844 (9.3) bypasses authentication in the device's proprietary protocol; CVE-2026-43845 (9.2) bypasses authentication through the password-reset mechanism; and stack buffer overflows in the log-message function (CVE-2026-43831, unauthenticated), the login function (CVE-2026-43838) and, when the SafeEnhancement feature is enabled, password and cookie parsing (CVE-2026-43829 and CVE-2026-43832, unauthenticated) can give code execution (all 9.2). Other fixes cover command injection while a firmware file is verified (CVE-2026-43830) and upload of a forged firmware image that could permanently compromise the device (CVE-2026-43835), unlimited brute-forcing of the administrator password over the proprietary protocol even with SafeEnhancement on (CVE-2026-43847), authenticated root-level command injection, arbitrary file read and file write, recovery of administrator credentials from an encrypted EdgeLink project file (CVE-2026-43854), and several unauthenticated crashes of the logging and licence-manager services. Advantech says EdgeLink 2.8.5.0 fixes all 30 and adds asymmetric digital signatures for firmware upgrades. Neither Advantech nor CSA reports exploitation. (sources: Advantech advisory; CSA AL-2026-149) Updated 20 Oct 2026 (Cyber Security Agency of Singapore): Cyber Security Agency of Singapore's report is dated 20 October 2026; details credited to Cyber Security Agency of Singapore on this card come from that report.
Advantech — Security advisory: Vulnerabilities identified in ADAM-3600 (v1.0, 12 Oct 2026; PDF)
