> InfoSec News Nuggets – 10/14/2026

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days Microsoft’s October 2026 Patch Tuesday addresses a record-breaking 1,411 vulnerabilities, 70 of them rated critical, including one actively exploited zero-day and two that were publicly disclosed. The exploited flaw, CVE-2026-96951, is a Windows Shell command injection bug that lets attackers bypass Mark of the Web protections, while one of the disclosed flaws, a .NET Framework issue found by Google Project Zero, can be abused to bypass Windows Defender Application Control and run code inside a protected process. The release is also the final security update for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016, and the record count is attributed to Microsoft’s growing use of AI to find and fix vulnerabilities.   Ledger says hardware implant in cryptocurrency wallets stole recovery phrases Ledger warned that hardware wallets sold through Southeast Asian reseller CryptoBilis contained hidden implants that read the 24-word recovery phrase off the device screen during setup and transmitted it over LTE using an embedded eSIM, letting attackers drain victims’ funds on October 9. Because the implant leaves the Secure Element untouched, tampered devices may still pass Ledger’s authenticity checks. The company is telling CryptoBilis buyers not to set up unused devices and to move funds to a new wallet with a new recovery phrase, and says it is reviewing reports of implants in other signers and locations, while the reseller has paused all Ledger sales and shipments.   CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records Researchers have detailed CyberXero, a Russian-speaking, financially motivated initial access broker that pairs commodity tools like Cobalt Strike with an AI orchestration layer built on Claude Code and the open-source PentAGI agent. Its automated pipeline exploits WordPress and e-commerce flaws worldwide, with a single run confirming access to 429 admin panels and dropping 32 web shells in 61 seconds, while a second, hands-on campaign targets Ukrainian energy and critical infrastructure and has exfiltrated more than 628,000 records from four organizations. Logs recovered from the actor’s exposed open directory show repeated session resets and fake authorized-pentest framing used to get around model refusals, though several refusals held.   European supermarket giant limits operations amidst cyberattack Ahold Delhaize has taken systems offline after a cybersecurity incident disrupted Dutch supermarket chain Albert Heijn, knocking out its website, mobile app, customer service and online grocery deliveries. Sister brands Etos, Gall & Gall and Belgium’s Delhaize are also affected, though physical stores remain open and checkouts still work, with loyalty discounts unavailable and electronic shelf labels possibly showing outdated prices. The company has not disclosed the cause of the incident, whether customer or employee data was compromised, or when services will be restored.   H&M Investigating Possible Data Breach Fashion retailer H&M Group is investigating claims by the ShinyHunters cybercrime group that it was breached, with the company acknowledging online chatter about a potential incident involving a limited scope of its data. A spokeswoman said that so far there is no indication its data environment has been compromised and that no further details can be shared while the investigation is ongoing. ShinyHunters is a financially motivated group known for phishing campaigns and abusing cloud misconfigurations, and was recently linked to the exposure of sensitive FBI employee information. The post InfoSec News Nuggets – 10/14/2026 appeared first on AboutDFIR - The Definitive Compendium Project.