Microsoft Patches Over 1,400 Vulnerabilities in October 2026 Security Update, Some Already Exploited
Microsoft released its monthly security updates on October 13, 2026, addressing more than 1,400 vulnerabilities across its product portfolio. The company assigned CVE identifiers to 1,407 issues and published one additional advisory without a CVE number.
The update includes fixes for 315 remote code execution vulnerabilities, 673 privilege escalation flaws, 252 information disclosure issues, 72 denial-of-service problems, 40 security feature bypass vulnerabilities, 27 spoofing issues, and 29 memory-related weaknesses.
Severity distribution shows 78 vulnerabilities rated as Critical and 1,329 rated as Important, with one classified as Moderate. Several of the patched flaws have already seen confirmed exploitation in real-world attacks.
Related Security Advisories
The same reporting period highlighted additional vendor updates, including an unpatched zero-day in Ivanti VPN products, 37 vulnerabilities fixed in Chrome, and multiple issues resolved in GitLab, AnyDesk, IBM Db2 Mirror for i, Ghostscript, NetScaler ADC/Gateway, IBM DataPower Gateway, and Nessus.
Related articles
CTEM Without the Hype: Understanding Gartner's Continuous Threat Exposure Management Framework
The article explains the evolution of vulnerability management from basic scheduled scanning to risk-based approaches and finally to Continuous Threat Exposure Management (CTEM). It positions CTEM as a comprehensive program introduced by Gartner in 2022 that integrates asset management, EASM, CAASM, automated pentesting, and business-context prioritization. The five-stage cycle of Scoping, Discovery, Prioritization, Validation, and Mobilization is detailed with practical examples such as protecting customer databases in an e-commerce environment. Gartner predicts organizations prioritizing CTEM will suffer three times fewer breaches by 2026, though only 16% have reached operational maturity. The piece also covers common implementation pitfalls and the emergence of the first Magic Quadrant for Exposure Assessment Platforms featuring vendors like Tenable, Qualys, and Rapid7.
Google Chrome Update Patches 37 Vulnerabilities Including Seven Critical Flaws
Google has released a security update for its Chrome browser that addresses 37 vulnerabilities across Windows, macOS, and Linux platforms. Seven of the issues are rated Critical, the highest severity level, while 29 are rated High and one is rated Medium. The update brings Chrome to versions 155.0.8059.80 on Windows and macOS and 155.0.8059.79 on Linux and macOS. Among the critical fixes is a buffer overflow in the ANGLE graphics component tracked as CVE-2026-110152, plus six Use After Free flaws affecting Browser, PDF, Network, Core, SVG, and Media components. The High-severity issues primarily involve Use After Free problems in V8, WebRTC, PDF, DOM, and Media. The single Medium issue is also included in the advisory.
Ivanti Connect Secure VPN Hit by Zero-Day Authentication Bypass Vulnerability CVE-2026-104935
Ivanti has disclosed a critical authentication bypass vulnerability in its Ivanti Connect Secure remote access product that allows remote attackers to execute arbitrary commands without authentication. The flaw, tracked as CVE-2026-104935, carries a CVSSv3.0 base score of 8.6 and has already been exploited in the wild against certain customer environments. Affected versions include 25.1.2.2, 25.1.1.1, and 22.8R2.4 along with earlier releases in those branches, while versions 22.7R2.14 and prior remain unaffected. Ivanti discovered the issue through its product security program and released the fix in version 25.1.3.0 during July. The company published its security advisory on October 13, 2026, confirming active exploitation of the zero-day in unpatched branches.
NICT Warns of A2B Attacks Where Reverse-Engineered Android Apps Expose Vulnerable Backend Servers
Japan's National Institute of Information and Communications Technology (NICT) has issued an alert on A2B attacks, in which publicly available Android apps are reverse-engineered to identify and target their backend servers. The technique, called App-to-Backend Attack, allows threat actors to discover internal server endpoints even when organizations do not publish connection details. Once identified, attackers exploit vulnerabilities, weak authentication, or misconfigured APIs on those servers, leading to unauthorized access and data theft. NICT notes that multiple recent membership-service breaches in Japan stem from this vector rather than flaws in the mobile apps themselves. The institute urges developers and operators to harden backend infrastructure, conduct thorough compromise assessments, and apply proper access controls. Related incidents include unauthorized access to Lawson ID services, Yakiniku King app member data, and Japan Post's postal app.