This posting is here to collect cyber security news in October 2026.
I post links to security vulnerability news to comments of this article.
You are also free to post related links to comments.
This posting is here to collect cyber security news in October 2026.
I post links to security vulnerability news to comments of this article.
You are also free to post related links to comments.
311 Comments
Tomi Engdahl says:
CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory
https://kb.isc.org/docs/cve-2026-94300?fbclid=IwdGRjcAVILAxjbGNrBUgr6mV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEeseLFB7paQuKV6LE1nGtfeBB-DulHjCa1gwjiMz9l6oi_oOg4fJOQ0e0nEl8_aem_nv4BR7OfrTkbStQuSvuk9Q
BIND 9
Replaying GSS-TSIG signed UDP messages can result in memory corruption in “named”. An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.
CVSS Score: 8.1
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Tomi Engdahl says:
Blindsided by AI Agents, Big Banks Scramble to Beef Up Security
https://gizmodo.com/blindsided-by-ai-agents-big-banks-scramble-to-beef-up-security-2000829358?fbclid=IwVERDUAVILSlleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHgy1jwgdPMM8AGw20HYJIxe4_QQ_jcem07xE37UIoczgjjcYBMzdzjA2p4-s_aem_aP8Ub8qKKLsRtW5KngawOA
Tomi Engdahl says:
Russia-linked hackers used decentralised network in Ukraine cyberattack, ESET says
https://www.reuters.com/world/europe/russia-linked-hackers-used-decentralised-network-ukraine-cyberattack-eset-says-2026-10-22/?fbclid=IwVERDUAVILVVleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHoChep-78tp_ieoDK2mFz3QuGPBhrN2S5FML_HGZEEcndkdfMoyJRlbqXaGZ_aem_0NP-l8hSn6oVqd1kYNQWGQ
Tomi Engdahl says:
The government is issuing preparedness advice to households to keep emergency supplies that can last a few days
https://www.independent.co.uk/tech/emergency-preparedness-uk-cyber-security-cash-food-b3071531.html?fbclid=IwdGRjcAVIL2ljbGNrBUgvYmV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEexI7_M8zNgn9Qhq44lJcTuZbK2hzJaBf9MJ3r8P8fpGQ1v7jeS_PlPRUZ3iw_aem_tIwReV1hFBCshrhiyQaSlw
Tomi Engdahl says:
Node.js patches 10 security flaws, including a high-severity Brotli decoder bug that could allow RCE when apps decompress attacker-controlled data.
Patches are out for versions 22.x, 24.x, and 26.x.
Update Now ↓ https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html
Tomi Engdahl says:
Meta ordered to pay $25 BILLION.
A New Mexico court found more than 43 million violations tied to Facebook’s misleading data privacy promises.
The ruling stems from a lawsuit linked to the Cambridge Analytica scandal.
Full story ↓ https://thehackernews.com/2026/10/meta-ordered-to-pay-25-billion-after.html
Tomi Engdahl says:
“We’re understanding what’s in his mind with his interactions with the chatbot.” https://trib.al/7oe40VL
Not So Private
Man Arrested After Telling Claude About Plans to Shoot Up Daycare
“We’re understanding what’s in his mind with his interactions with the chatbot.”
https://futurism.com/artificial-intelligence/man-arrested-claude-plans-shoot-daycare?fbclid=IwdGRjcAVIN01jbGNrBUg3M2V4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEe3pnUqQl7NJDVxYYNOPhZmhlIdGVUTqHBhon3198_GohNZMiACnoUwyoJSt0_aem_DBfzXu_8jmJ6jy-x1gmNWg
A man in Sydney, Australia was arrested this week after telling Anthropic’s Claude that he wanted to kill children at a daycare near his home.
As the Sydney Morning Herald reported, 29-year-old David Lan Thackray was taken into custody on Sunday after his disturbing interactions with Anthropic’s Claude were flagged by Interpol. He was charged with using a carriage service to harass, menace, or offend, an Australian criminal law.
Tomi Engdahl says:
https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/?fbclid=IwdGRjcAVIOa1leHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHpCtAT1OCvYEHoB6-O3p2PV1jnUrA31GAXrMfMb2swaCLXRlWLnvSMjD6Axe_aem_wW1nehWOOw5N3skzLgOLrQ
Tomi Engdahl says:
AI is exposing security holes across the web. Cloudflare and Vercel executives explain the risks and why the internet could actually become safer.
AI is exposing security holes. The internet is freaking out and asking if it’s time to pull the plug. : https://mrf.lu/2vMcK
Tomi Engdahl says:
Execs and analysts are warning that major AI cyber threats could leave critical systems — from energy and water to healthcare — especially exposed.
What smart people are saying about AI unleashing an online ‘vulnerability tsunami’ : https://mrf.lu/2vBFL
Tomi Engdahl says:
“You are being watched.” https://trib.al/UntKjdN
Bot Brother
Bosses Deploying AI-Powered Spyware That Watches Workers Constantly
“You are being watched.”
https://futurism.com/artificial-intelligence/bosses-ai-software-watches-workers?fbclid=IwdGRjcAVIc7VjbGNrBUhzoGV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEe_ERwJ1cMUTfR1fMulz0YpawdR39p1NbS7vg2XsYkj1ZwmU8YDLUFFtI314w_aem_tIC_Hhb1NpKK4S09hteibw
Workplace surveillance is being supercharged by AI that lets employers create custom tools to watch their worker’s every move.
In the UK, the legal services company the Co-op is reportedly using AI models to constantly record and monitor what its human employees say and evaluate their interactions with customers.