Cybersecurity News

SAP's Oct 13 Security Patch Day ships 16 new notes and 4 GitHub advisories. Highest severity: CVE-2026-89111 (CVSS 10.0) in SAP Cloud SDK for Python <0.45.2 — attacker-controlled tenant_subdomain can redirect OAuth2 token requests and exfiltrate client credentials in multi-tenant BTP apps. Fix: upgrade to 0.45.2+; workaround: allowlist tenant subdomains. Also Critical: NetWeaver Visual Composer broken access control (CVE-2026-89110, 9.9) and S/4HANA Manage Substitution/Validation Rules code injection (CVE-2026-89107, 9.9).

Meta told SecurityWeek that an outside group used a Meta employee's stolen credentials to access some company GitHub repositories. About 99% of what was taken was business/source code; ~1% was personal data stored against policy (some synthetic/anonymized test data). Roughly 1,500 people — mostly U.S. Meta employees — are being notified. Meta says no Meta product vulnerability and internal systems were not breached; secrets were rotated and new controls added to keep user data out of GitHub. Law enforcement and GitHub were engaged.

Microsoft's October Patch Tuesday marks this Windows Shell security feature bypass (CVSS 8.8) as 'Exploitation Detected'. CISA added it to KEV on Oct 13 (listed as a Windows command injection) with an Oct 16 federal due date. Patch Windows endpoints first.

Authentication bypass by spoofing leading to remote command execution (CVSS 8.6). Listed in CISA KEV on Oct 13 with an Oct 16 due date. Apply Ivanti's fix and review appliance integrity.

Record-scale Microsoft release (reporting outlets cite ~1,411–1,419 Microsoft CVEs depending on counting). Actively exploited: Windows Shell MotW bypass CVE-2026-96951 (CVSS 8.8, CISA KEV due Oct 16). Publicly disclosed before patch (not known exploited per Microsoft/SANS): .NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707. High-value not-known-exploited: Exchange RCE CVE-2026-70571 (8.1) and AD Domain Services RCE CVE-2026-70229 (8.1), both 'Exploitation More Likely'; Outlook RCEs (e.g. CVE-2026-70242); Message Queuing RCE CVE-2026-100202 (9.8). Severity and exploitability labels are Microsoft's.

Unit 42 reports attacks dropping a webshell then a fileless XMRig miner. Fixed in 16.0.49, 17.3.10 and 17.4.4. Not in CISA KEV as of Oct 13; NVD has no entry yet.

Broadcom VMware vCenter path traversal that lets a network-adjacent attacker execute code. CISA added it to KEV on Aug 18 with an Aug 21 federal due date and marks known ransomware campaign use. A separate dark-web monitor also claimed an exploit for sale (~$10k) on Oct 13; treat that as secondary noise. Patch vCenter and keep it off the public internet.

Alongside October Patch Tuesday, MSRC published guidance that groups CVEs by shared deployment, exposure or trust-boundary questions, so one assessment covers many CVEs. MSRC is explicit that cohorts don't replace per-CVE assessment or change update guidance: exploitation status and severity still decide priority.

Attackers remotely forced defrost cycles on vulnerable Danfoss refrigeration controllers (obsolete AK-SM800/AK-SC355 or unpatched AK-SM800A), with reports of programmed temps up to ~50°C. Coopérative U's CEO confirmed impact from Oct 11; Groupement Mousquetaires reported ~150 Intermarché + 30 Netto stores; Carrefour ~80 of 6,000; Casino said ~5% of Monoprix. Paris prosecutor opened a large-scale cyber-attack investigation. OT reminder: keep ICS management interfaces offline or VPN-segmented — Claroty previously found thousands of similar controllers internet-exposed.

Auth bypass chained with Replication Receiver RCE gives SYSTEM. Huntress observed webshells and a disguised crypto miner. The first fix was incomplete: install hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9), reboot, then hunt for compromise. Not in CISA KEV as of Oct 13.

Patchstack reports first exploitation on Oct 7. Update the plugin or remove it. We could not reach a primary advisory page today, so treat details as preliminary. Not in KEV as of Oct 13.

Pre-auth SSRF in the Work Place interface (advisory SNWLID-2026-0017). Upgrade to 12.4.3-03670 or 12.5.0-03082; note 12.5.0-02952, the September zero-day fix, is now listed as affected. Canada's Cyber Centre cites open-source reports of exploitation. Not in KEV as of Oct 13.

Since Sept 8, 2026, MSRC has published machine-readable CSAF VEX documents for every Microsoft CVE, extending the Azure Linux pilot from Oct 2025. Feed your scanner from msrc.microsoft.com/csaf/vex/ to cut false positives. It doesn't add any updates you have to deploy.