Some days have a theme. Today’s theme is “attackers love the stuff you can’t quickly take offline”: VPN gateways, update rails, and your users’ trust in downloaded files.

Today's Top 5

1. 1,411 Microsoft fixes: October Patch Tuesday is record-breaking, and buried in the pile are three zero-days. The scary part is how fast defenders will have to triage what actually matters. Source
2. Ivanti zero-day chain: Ivanti Connect Secure’s CVE-2026-104935 is being exploited, and the campaign reportedly chained multiple bugs for root-level execution on “fully patched” boxes. If your VPN is your front door, this is the lock pick. Source
3. Trump Phone leak claim: A ransomware crew says it grabbed data tied to “Trump Phone” customers, with reporting noting the post reads more like a leak drop than an encryption event. The proof questions are the whole story here. Source
4. Windows MotW bypass: Microsoft says CVE-2026-96951 is actively exploited to bypass Mark of the Web protections. If you rely on MotW as a speed bump, someone is already driving around it. Source
5. PaperCut scripting RCE: PaperCut’s bulletins keep getting sharper, with CVE-2026-14780 tied to RCE via the scripting subsystem if optional features are enabled. It’s the classic “we only turned it on for one workflow” trap. Source

Why today matters: The common thread is control plane exposure. VPN appliances and endpoint trust markers are being treated as bypassable, not defensive. When attackers can get code execution at the edge and strip away MotW cues, your phishing and patch windows collapse into the same problem.

Alright, let’s get into the receipts.

Data Breaches

1. Hackers claim Trump Phone customer data leak (BYOD): Reporting says the BYOD group posted data tied to “Trump Phone” customers on its leak site, with multiple outlets noting the incident reads more like an extortion data post than a confirmed encryption event. Treat this as unverified until the sample data and victim statements line up. Source: TechRadar
2. Interseguro listed on ransomware extortion site (Direwolf): Peruvian outlet reporting says insurer Interseguro appeared in a cyber alert on October 13, 2026, after the Direwolf ransomware group allegedly posted DNI and financial-related data claims on a dark web portal. The operational impact is unclear, but it is a reminder that “listed” often precedes real-world notifications by weeks. Source: Infobae
3. Direct Communications reports service disruptions from cyberattack traffic: CSIDB notes Direct Communications reported unusually high traffic consistent with a DDoS-style event that caused outages and service disruptions for customers in Eagle Mountain. No data exposure has been established, but these incidents routinely get paired with follow-on access attempts. Source: CSIDB
4. Bayer named in new leak-site claim (Black X): Security Arsenal summarized new leak-site listings from the “BLACK X” ransomware group, including a listing naming Bayer. As always, leak-site claims are not confirmation, but this is exactly the moment to hunt for credential reuse and exposed remote access. Source: Security Arsenal

Security Research

1. Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935): BleepingComputer reports exploitation activity and notes Volexity’s findings of a chained attack path that reached unauthenticated root-level execution, including log tampering. If you run ICS, assume you need forensics, not just a patch. Source: BleepingComputer
2. Microsoft Patch Tuesday hits a record: 1,411 vulnerabilities: BleepingComputer breaks down the release and calls out the actively exploited Windows Shell bypass and two publicly disclosed zero-days, plus Microsoft’s new “risk cohort” prioritization approach. Big number months are where backlog becomes your real adversary. Source: BleepingComputer
3. Windows Shell MotW bypass is the exploited zero-day (CVE-2026-96951): CSO Online highlights that the exploited zero-day is a Mark of the Web bypass, and notes the volume of Windows Shell issues this year. MotW bypasses are “phish multiplier” vulnerabilities, not niche edge cases. Source: CSO Online
4. Rapid7 ETR on Ivanti Connect Secure exploitation: Rapid7’s write-up provides defender-focused context on CVE-2026-104935, affected products, and why emergency patching matters when edge devices are being actively targeted. This is a good one to forward to your network team. Source: Rapid7
5. PaperCut NG/MF RCE in scripting subsystem (CVE-2026-14780): PaperCut’s security bulletin explains the conditions under which you are affected and the fixed versions, with emphasis on the optional Print and Device Scripting feature. Optional features are where “we never threat modeled that” lives. Source: PaperCut

Top CVEs

1. CVE-2026-104935: Ivanti Connect Secure authentication bypass by spoofing, reported as actively exploited in the wild. Successful exploitation can enable unauthenticated command execution against the VPN gateway, which often becomes your lateral movement starting point. Source
2. CVE-2026-96951: Windows Shell security feature bypass affecting Mark of the Web protections, flagged as actively exploited. MotW bypass means downloaded payloads lose friction and detection assumptions change overnight. Source
3. CVE-2026-108398: .NET Framework security feature bypass, publicly disclosed, that Microsoft says could allow bypass of Windows Defender Application Control enforcement under certain local attacker conditions. If WDAC is part of your containment story, this is not a “later” patch. Source
4. CVE-2026-14780: PaperCut NG/MF remote code execution via the scripting subsystem, impacting instances with optional scripting enabled and older versions. Print infrastructure is still a weirdly privileged place to leave sharp objects. Source
5. CVE-2026-92707: MessagePack-CSharp denial of service in .NET, patched in Microsoft’s October release. Not every DoS is a pager event, but high-volume parsing bugs can become a cheap way to degrade services in a coordinated campaign. Source

Podcasts & Talks

1. SANS Stormcast (Oct 14, 2026): Patch Tuesday overload, Ivanti exploited, Adobe critical fixes: A tight daily listen if you need a fast prioritization checklist to hand to ops teams, especially on weeks where both Windows and VPN edge gear are on fire. Listen: SANS Internet Storm Center

Final Words

Today is what “control plane risk” looks like in practice: edge appliances that can be popped without creds, and user-safety signals like MotW that can be bypassed at scale. The uncomfortable implication most coverage skips is that your patch program and your phishing program are now the same program, because bypasses turn any attachment into an incident response drill.

This week, do three things:

• Patch Ivanti Connect Secure for CVE-2026-104935 immediately, then run an incident-oriented review of auth logs and admin actions because patching does not remove an attacker already on the box.
• Prioritize Microsoft’s fix for CVE-2026-96951 across endpoints that handle email attachments and downloaded archives, and validate MotW propagation behavior in your browser and EDR stack.
• Inventory PaperCut NG/MF instances and disable optional scripting features you do not actively use, then update to a fixed build for CVE-2026-14780 if scripting is enabled.

Your turn: If a leak-site claim hit your exec chat tomorrow about your brand, do you have a single owner who can answer “is this real” in 60 minutes with evidence, not vibes? Hit reply to this email with your take, or drop a comment on the web version. I read every reply.

Know someone running Ivanti Connect Secure who still treats VPN appliances as “set-and-forget”? Forward them this issue, it costs 30 seconds and the alternative costs a weekend. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!