Wednesday’s brief: a Windows bug already under attack, then Ivanti VPNs, SAP and Fortinet

Good morning. Microsoft’s October updates are out and one Windows bug in them is already being used in attacks. Ivanti VPN owners have a worse morning: a zero-day chain that got root on fully patched boxes. SAP and Fortinet round out the list. Here is the order we would work through it.

Lead Story

Microsoft’s October Patch Tuesday fixes a Windows Shell bug attackers already use. It gets booby-trapped files past the download warning; CISA wants it patched by Friday. See the patch order →

Also Worth Your Attention

Attackers chained Ivanti Connect Secure zero-days to get root on patched VPNs. Upgrade today, then check Active Directory. Upgrade and hunt →

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

SAP’s October patch day brings four critical notes, two at 9.9 for S/4HANA and Visual Composer. Book the SAP notes →

Fortinet fixes no-login bugs in FortiSIEM and FortiSandbox. Not exploited yet. Check your versions →

Also on the radar: the GitLab critical fix we covered yesterday now has its public CVE record, CVE-2026-97229. Rapid7 found that an attacker needs a way to plant a CI/CD configuration in a repository, which open self-registration provides (Rapid7).

Slack paste: Wed Oct 14: (1) Oct Windows cumulative updates + restarts, email laptops first; CISA due Fri for CVE-2026-96951. (2) Ivanti Connect Secure to 22.8R2.5 / 25.1.1.2 / 25.1.3.x, rotate its AD service account. (3) SAP notes 3805589 and 3797111. (4) FortiSIEM 7.5.1 / FortiSandbox 5.0.7 or 4.4.10.

Go Deeper

Get this in your inbox every weekday morning: subscribe to the Daily Brief.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].