Security Industry Sources

Follow security research, antivirus tests and software updates from industry sources, with links to original reports and community discussions.
Live industry deskFresh security research, without the noiseScan the essentials, open the original report, or jump into a MalwareTips discussion.
Fine-tune the deskShow me the news I care about
Clear filters
Updated throughout the day

More industry reporting

20 fresh items on this page
Image from Zero Day Initiative for The October 2026 Security Update Review
Zero Day InitiativeSecurity updates

The October 2026 Security Update Review

Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release. Adobe Patches for October 2026 For the first part of the October release, Adobe released 11 bulletins addressing 174 unique CVEs in Adobe Dimension, Commerce, Substance 3D Sampler, ColdFusion, Photoshop, FrameMaker, Experience Manager, Substance 3D Stager, Content Credentials SDK, Bridge, and Substance 3D Designer. Here’s this month’s overview table: Adobe Patches for October 2026 Adobe Patches for October 2026 Bulletin ID Product CVE Count Highest Severity Highest CVSS Exploited Deployment Priority APSB26-152 Adobe Experience Manager 33 Critical 10.0 No 2 APSB26-144 Adobe ColdFusion 32 Critical 10.0 No 2 APSB26-153 Adobe Commerce 11 Critical 10.0 No 2 APSB26-163 Content Credentials SDK 30 High 8.6 No 3 APSB26-171 Adobe Dimension 7 High 8.6 No 3 APSB26-158 Adobe Photoshop 18 High 8.2 No 3 APSB26-170 Adobe Substance 3D Stager 16 High 7.8 No 3 APSB26-172 Adobe FrameMaker 10 High 7.8 No 3 APSB26
Read at Zero Day Initiative
SANS ISC
SANS ISCSecurity updates

October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)

Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited. 
Read at SANS ISC
Image from The Hacker News for Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
The Hacker NewsMalware & threats

Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off."
Read at The Hacker News
Image from Security Affairs for U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog
Security AffairsSecurity updates

U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is an authentication bypass issue caused by […]
Read at Security Affairs
Image from The Hacker News for Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
The Hacker NewsMalware & threats

Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that converts a personal account into an organization, Docker said in a security advisory on October 12.
Read at The Hacker News
Image from The Hacker News for Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
The Hacker NewsSecurity updates

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,
Read at The Hacker News
Image from Check Point Research for When LLM Gateways Go Wrong: Findings from LiteLLM
Check Point ResearchSecurity updates

When LLM Gateways Go Wrong: Findings from LiteLLM

TL;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. The most significant issues stemmed from a missing authorization check on the /config/update endpoint, which allowed any authenticated user (including low-privileged accounts) to modify the […] The post When LLM Gateways Go Wrong: Findings from LiteLLM appeared first on Check Point Research.
Read at Check Point Research Join the MalwareTips discussion
Image from Security Affairs for Anthropic Shows How Small AI Models Could Replicate Across IoT Devices
Security AffairsMalware & threats

Anthropic Shows How Small AI Models Could Replicate Across IoT Devices

Anthropic researchers show how small AI models could autonomously replicate across IoT devices, raising concerns about adaptive, AI-powered botnets. Anthropic published a paper this week that should make anyone who manages IoT infrastructure sit down for a moment. The research shows that small AI models are approaching the capability to replicate themselves autonomously across networks […]
Read at Security Affairs
Image from BleepingComputer for The MFA Gaps Attackers are Still Exploiting
BleepingComputerMalware & threats

The MFA Gaps Attackers are Still Exploiting

Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps. [...]
Read at BleepingComputer
Back
Top