Network Security

Enterprise VPN appliances are supposed to guard the edge of the network. This week, one of the most widely used of them became the way in.

Marvell Technology, Microsoft and Oracle have formed a new working group under the Open Compute Project to standardize a piece of security hardware that has traditionally lived outside the server. The group, organized under the OCP Security Track, will define open specifications for an integrated hardware security module designed for cloud and hyperscale data centers.

Microsoft's October Patch Tuesday, released on October 13, 2026, is the largest in the company's history. Cisco Talos counted 1,415 vulnerabilities addressed across Microsoft products, including 85 rated critical, 67 of them remote code execution flaws. Computer Weekly noted that the total exceeds the number Microsoft fixed in all of 2023, and that it shatters the previous record of roughly 1,000 flaws set just last month, which itself had passed a mark of a little over 600 set in July. By comparison, the October 2025 release addressed about 175 flaws.

Self-managed GitLab servers need an urgent update. On October 12, GitLab released emergency patches for a maximum-severity vulnerability in its CI/CD Regular Expression Compiler, warning that the flaw could allow an unauthenticated attacker to execute arbitrary code on the GitLab server itself.

Quantum computing company IonQ has agreed to acquire Elisity, an enterprise Zero Trust security firm, in an all-stock transaction valued at up to 1.3 billion dollars. The deal, announced Monday, includes up to 150 million dollars in earnout payments tied to the performance of the Elisity business after closing.

On October 10, 2026, ransomware intelligence trackers reported that the group "Redact" had listed DexCom — the Nasdaq-listed continuous glucose monitoring maker with roughly 4.97 billion dollars in revenue and about 11,100 employees — on its dark-web leak site, alleging it exfiltrated 3.3 terabytes of company data. Treat that claim carefully: this is an attacker-side allegation only. DexCom has not publicly confirmed any incident, no regulatory filing has surfaced, and no independent forensic evidence has corroborated the listing.

Cisco published security advisory cisco-sa-ngoam-rce-LWKQ4BU on October 7, 2026, covering three critical vulnerabilities — CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501 — in the Next Generation Operation, Administration, and Maintenance (NGOAM) feature of NX-OS software on Nexus 3000 and standalone-mode 9000 Series switches. Each scores CVSS 9.8: an unauthenticated remote attacker can send crafted packets to an IP interface and execute code with root privileges, or crash processes and force device reloads in a denial-of-service attack.

The most lucrative ransomware operation of the year never encrypted a single file. According to internal chat logs leaked this week and analyzed by blockchain forensics firm Crystal Intelligence, a cybercrime collective known as Silent Ransom Group — also tracked as Luna Moth — claims it collected roughly $207 million from 27 law firms between April and September 2026 using nothing more than phone calls, social engineering, and the threat of publishing stolen data.

The FBI and the Department of Justice announced October 8 that they have seized seven domains and disrupted two hacking tools tied to Flax Typhoon, the China-linked threat group U.S. authorities associate with Integrity Technology Group, a Beijing-based information-security company Washington says holds contracts with the Chinese government. The operation targeted reconnaissance and spear-phishing infrastructure that prosecutors say was used to scan — and in some cases infiltrate — critical infrastructure networks in the United States and abroad.

A ransomware group calling itself Chaos announced on October 9, 2026 that it had exfiltrated 1,500 gigabytes of data from Astrana Health, Inc., a California-based physician-management company whose network supports roughly 20,000 affiliated medical providers. The group claims the theft followed Astrana's decision not to negotiate with the attackers, and says the stolen trove includes patient diagnoses and personal information.