Cybersecurity

Proofpoint has agreed to acquire Varonis Systems in an all-cash transaction valued at about 6.3 billion dollars, the companies announced on October 15, 2026. The definitive agreement brings together Proofpoint, a specialist in protecting people and AI agents against cyber threats, with Varonis, a Miami-based firm focused on data and AI security. Proofpoint is a portfolio company of private equity firm Thoma Bravo.

Enterprise VPN appliances are supposed to guard the edge of the network. This week, one of the most widely used of them became the way in.

Marvell Technology, Microsoft and Oracle have formed a new working group under the Open Compute Project to standardize a piece of security hardware that has traditionally lived outside the server. The group, organized under the OCP Security Track, will define open specifications for an integrated hardware security module designed for cloud and hyperscale data centers.

Microsoft's October Patch Tuesday, released on October 13, 2026, is the largest in the company's history. Cisco Talos counted 1,415 vulnerabilities addressed across Microsoft products, including 85 rated critical, 67 of them remote code execution flaws. Computer Weekly noted that the total exceeds the number Microsoft fixed in all of 2023, and that it shatters the previous record of roughly 1,000 flaws set just last month, which itself had passed a mark of a little over 600 set in July. By comparison, the October 2025 release addressed about 175 flaws.

Self-managed GitLab servers need an urgent update. On October 12, GitLab released emergency patches for a maximum-severity vulnerability in its CI/CD Regular Expression Compiler, warning that the flaw could allow an unauthenticated attacker to execute arbitrary code on the GitLab server itself.

Quantum computing company IonQ has agreed to acquire Elisity, an enterprise Zero Trust security firm, in an all-stock transaction valued at up to 1.3 billion dollars. The deal, announced Monday, includes up to 150 million dollars in earnout payments tied to the performance of the Elisity business after closing.

On October 10, 2026, ransomware intelligence trackers reported that the group "Redact" had listed DexCom — the Nasdaq-listed continuous glucose monitoring maker with roughly 4.97 billion dollars in revenue and about 11,100 employees — on its dark-web leak site, alleging it exfiltrated 3.3 terabytes of company data. Treat that claim carefully: this is an attacker-side allegation only. DexCom has not publicly confirmed any incident, no regulatory filing has surfaced, and no independent forensic evidence has corroborated the listing.

Cisco published security advisory cisco-sa-ngoam-rce-LWKQ4BU on October 7, 2026, covering three critical vulnerabilities — CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501 — in the Next Generation Operation, Administration, and Maintenance (NGOAM) feature of NX-OS software on Nexus 3000 and standalone-mode 9000 Series switches. Each scores CVSS 9.8: an unauthenticated remote attacker can send crafted packets to an IP interface and execute code with root privileges, or crash processes and force device reloads in a denial-of-service attack.

The most lucrative ransomware operation of the year never encrypted a single file. According to internal chat logs leaked this week and analyzed by blockchain forensics firm Crystal Intelligence, a cybercrime collective known as Silent Ransom Group — also tracked as Luna Moth — claims it collected roughly $207 million from 27 law firms between April and September 2026 using nothing more than phone calls, social engineering, and the threat of publishing stolen data.