Booz Allen conducted tests in an isolated OT lab demonstrating that AI agents can autonomously navigate unfamiliar operational technology (OT) environments and achieve complex objectives, including moving physical equipment, within minutes. The AI models reached an industrial control network from a perimeter compromise in just over 16 minutes across multiple scenarios. Existing defenses slowed but did not consistently stop these autonomous agents. The study highlights the convergence of cybersecurity and physical security threats posed by autonomous AI in OT environments and warns that traditional security approaches like security through obscurity are insufficient. It recommends focusing on making OT environments harder to traverse, removing implicit trust, and detecting consequential industrial changes quickly. The report does not provide specific vulnerabilities or exploits but raises concerns about the speed and precision of AI-driven attacks on OT systems.
Microsoft addressed a known issue affecting Always On VPN connections that occurred after installing the September 2026 Windows 11 security updates. The problem caused VPN connectivity disruptions but has since been resolved by Microsoft.
IronCircle, a cybersecurity boot camp provider affiliated with several universities, abruptly shut down in June 2026, leaving many students with unpaid tuition debts and no job placement support. The program, which charged up to $18,900, was criticized for poor course functionality, misleading job prospects, and inadequate student support. Despite partnerships with over 20 universities, IronCircle operated with minimal oversight, was not accredited, and did not comply with many federal regulations protecting students. The sudden closure left students unable to access courses and struggling with private loan repayments. The Department of Education has issued guidance on third-party university partners, but enforcement appears limited.
The United Kingdom has imposed economic sanctions on Cryptomus, a cryptocurrency payment platform linked to facilitating illicit transactions benefiting Russian entities, including ransomware, narcotics, darknet markets, and other cybercrime services. Cryptomus, also known as Heleket, has processed billions in transactions associated with various criminal activities. The sanctions freeze Cryptomus assets in the UK and prohibit British companies from doing business with it. This action follows prior Canadian fines and targets the broader infrastructure supporting Russia's wartime economy. Cryptomus has circumvented previous penalties by rebranding and continuing operations without KYC controls. The sanctions represent a significant enforcement step by a Five Eyes country against a cryptocurrency operation incorporated within another Five Eyes jurisdiction.
Harmonic Security, a cybersecurity startup focused on protecting workforce AI usage, announced a $50 million Series B funding round to expand its engineering and go-to-market teams in the US and UK. The company provides a platform that secures AI tools used by employees, covering browser-based AI, desktop AI tools, and agentic workflows. Their solution classifies AI tasks, identifies usage, and offers real-time control to mitigate risks such as personal-account use and sensitive data exposure. Harmonic leverages custom small language models to analyze AI interactions in context, enabling organizations to apply controls and gain visibility into AI use cases that improve workflows.
US law enforcement arrested two individuals involved in a multi-year scheme facilitating North Korean IT workers to fraudulently obtain remote employment at US companies by using laptop farms. The suspects housed and configured laptops issued by victim companies to make IT workers appear as if they were working from the US, using fake IDs and VPN/proxy infrastructure to mask their real locations. The operation disrupted 40 locations in Texas, seizing 187 laptops and related equipment. The scheme generated over $3 million in fraudulent revenue and targeted over 70 US companies across multiple sectors. The FBI warns that IT workers use facilitators to evade detection and recommends an 'identity in depth' approach for detection and mitigation.
Recent Windows updates may cause Remote Desktop connection failures for non-admin users when the "Administrator protection" security feature is enabled. Microsoft has confirmed this issue but no specific vulnerability or exploit details are provided.
This report discusses the presence of orphaned VBA projects embedded inside AutoCAD DWG files. These VBA projects are stored within OLE files embedded in the DWG files. Some DWG files contain VBA projects that are orphaned, meaning the pointer to the embedded VBA project is zero, but the embedded OLE file with the VBA code still exists. AutoCAD does not recognize or execute these orphaned VBA projects. The report includes a method to detect and extract these embedded VBA projects using custom scripts and tools.
This content is a request for participation in an academic survey related to a cybersecurity project. It does not describe a security threat or vulnerability.
This entry is a daily security news update from the SANS Internet Storm Center (ISC) dated October 14th, 2026. It provides general information about the ISC Stormcast podcast and related resources but does not contain any specific security threat, vulnerability, or exploit details.
An OpenAI employee was arrested for secretly installing a sophisticated audio recording device in a conference room to capture sensitive company conversations. The device was concealed in a USB port behind a television and discovered by OpenAI, which promptly reported the incident to the FBI and terminated the employee. The FBI investigation is ongoing, and there is no evidence that the employee accessed or exfiltrated proprietary data such as model weights, source code, or customer information. The employee had unauthorized access to the conference room and used company tools to gather information about office locations and meeting schedules. The incident highlights insider threat risks involving physical espionage within a technology company.
A Saudi OpenAI engineer was arrested for allegedly planting a hidden recording device in an executive conference room at OpenAI's San Francisco offices. The device was intended to secretly record sensitive conversations. This incident involves insider threat and physical espionage within a corporate environment.
Microsoft has released the Windows 10 KB5126657 extended security update as part of the October 2026 Patch Tuesday. This update includes multiple security fixes and some bug fixes and changes. No specific vulnerabilities or exploits are detailed in the provided information.
Microsoft has announced that Windows 11 version 24H2 Home and Pro editions have reached end of support as of October 13, 2026. These editions will no longer receive monthly security or non-security updates, including protections against the latest security threats. Users are advised to upgrade to Windows 11 version 26H2, which is currently rolling out and will be supported until October 2029. Enterprise and Education editions of Windows 11 24H2 remain supported until October 12, 2027. The end of support means devices running these Home and Pro editions will not receive further security patches, potentially increasing exposure to vulnerabilities if not upgraded.
The U.K. Housing Ombudsman Service is investigating a security incident involving a third-party IT system that affected its case management system. Details about the nature of the incident, impact, or remediation status have not been disclosed.
Microsoft released cumulative updates KB5127648 and KB5126653 for Windows 11 versions 23H2, 24H2, 25H2, and 26H2. These updates include the October 2026 Patch Tuesday security patches addressing hundreds of vulnerabilities, along with various bug fixes and new features such as emoji updates, File Explorer improvements, Bluetooth enhancements, and accessibility features. The updates are mandatory and unify fixes across the supported Windows 11 versions.
Google has adjusted its Chrome bug bounty program by increasing rewards for complex memory safety vulnerabilities after previously reducing payouts. The changes focus on incentivizing reports of memory safety flaws with higher base rewards and specific bonuses for fuzzing innovations. Non-memory safety issues receive moderate rewards if they lead to fixes. This restructuring aims to better align incentives with impactful vulnerability discovery amid evolving threat landscapes influenced by AI.
TFG London experienced a cybersecurity incident affecting IT systems used by its Phase Eight, Hobbs, and Whistles fashion brands. The attack caused system disruptions, though physical stores remained operational. Other brands under the group and operations in Australia and Africa were not impacted. The incident was detected on October 11, 2026, prompting activation of incident response and engagement of external cybersecurity experts. There is no confirmed evidence of customer data compromise at this time, but investigations continue. Customers are advised to be vigilant against phishing and social engineering attacks. No threat actor has publicly claimed responsibility, and no exploit details are available.
This content is a discussion post about the revamped SANS course SEC573, which focuses on AI-powered security automation using Python, large language models, and MCP. It is a user inquiry seeking opinions and recommendations about the course's value and preparation tips.
Attackers continue to exploit gaps in multi-factor authentication (MFA) coverage by using stolen credentials to access VPNs, RDP, and Windows systems that rely solely on passwords. The issue highlights that protecting only cloud applications is insufficient, and organizations need to address authentication weaknesses across all access points to prevent unauthorized access.