Here are today’s top cybersecurity stories for Wednesday, October 14, 2026.
Microsoft Patches a Record 1,413 Flaws, Including One Exploited Windows Zero-Day
October Patch Tuesday fixes 1,413 vulnerabilities, with 1,102 in Windows. CVE-2026-96951, a Windows Shell security feature bypass rated CVSS 8.8, is exploited in the wild to evade Mark of the Web protections. CISA added it to the KEV catalog with an October 16 federal deadline. Two further flaws were publicly disclosed before the fixes. SecurityWeek BleepingComputer CyberScoop
Canada Joins Joint Disruption Week Against West African Scam Networks
The Justice Department announced results of a London-hosted operation with agencies from the United States, United Kingdom, Nigeria, Ghana, Canada, Australia, India, and New Zealand, plus INTERPOL. The operation produced 28 arrests, 117 rescued trafficking victims, and more than 3.7 million removed social media accounts. Officials identified more than $11 million in freezable funds. CyberScoop
Attackers Backdoor Nextcloud Servers Through Flaw in Collabora’s Built-in CODE App
CVE-2026-110447 is an unauthenticated command injection in the proxy.php script of the Collabora Online Built-in CODE Server app. Exploitation works while the app’s local document server is not running. Attacks began September 10 and planted PHP web shells. Version 26.4.303 fixes the flaw and requires Nextcloud 30 or later. The Hacker News
curl Patches HTTP/2 Upload Flaw After Proof of Concept Shows Code Execution
CVE-2026-92392 is a use-after-free in curl’s HTTP/2 upload handling and affects versions 8.12.0 through 8.22.0. Version 8.23.0 fixes it. A proof of concept demonstrated client-side code execution under strict conditions, and no attacks are reported. It is the first High-severity curl flaw since October 2023. The Hacker News
Microsoft and Health-ISAC Disrupt Chinese-Language Phishing Kit Ecosystem
Under a federal court order, Microsoft and Health-ISAC seized domains behind the YAM Store, CoGUI, and Iron Man phishing kits. Microsoft tracks the operators as Storm-2990 and links them to more than 1 billion phishing messages this year across more than 75,000 organizations. Microsoft disabled more than 20,000 YAM Store accounts. CyberScoop
DOJ Charges 14 in North Korean Remote Work Laptop Farm Scheme
Operation Lonestar Roundup produced an indictment against two US citizens and 12 others tied to a scheme targeting more than 70 companies from 2019 through 2025. Investigators seized about 187 computers and say the scheme collected about $3 million in pay. The FBI issued an updated advisory on the tactics involved. CyberScoop
Adobe Patches 176 Vulnerabilities Across 11 Products
The October update covers Experience Manager, ColdFusion, Content Credentials SDK, Photoshop, Substance 3D Stager, and Commerce. Experience Manager, ColdFusion, and Commerce carry critical flaws allowing code execution. Adobe says it knows of no in-the-wild exploitation. SecurityWeek
Hirudo Android Trojan Swaps Banking Apps for Patched Copies
ThreatFabric reports Hirudo replaces eight Indonesian banking apps with modified copies built to bypass their own security checks. Droppers disguised as shopping and entertainment apps spread through fake Google Play pages promoted in Meta ads. The malware relays Play Integrity requests to an operator-controlled server. The Hacker News
Trellix Survey: 95% of Companies Report an Insider Incident Involving AI Agents
Trellix surveyed 600 CISOs at companies with more than 1,000 employees. Detection takes about 7 hours and response about 8 more. 63% lack visibility into employee use of AI tools, and 69% worry about personal liability for insider incidents. Help Net Security
Stay tuned for today’s in-depth analysis posts.
