This week in cyber: 13–19 October 2026

This week at a glance

Each week we pick the stories that matter most to ordinary people, IT teams and small businesses, explain them in plain words and end each one with what to do. Where a number or claim is not yet confirmed, we say so. For last week's bigger picture, see our October 2026 roundup.

1. Ivanti VPN zero-day: patch now

On 13 October Ivanti warned that a flaw in Ivanti Connect Secure, a VPN gateway many organisations use for remote access, was already being exploited before a fix was available. The flaw (CVE-2026-104935) lets a remote attacker get past authentication and run commands on the device. The US cybersecurity agency CISA added it to its list of known exploited vulnerabilities the same day. Researchers said the attacker also used a second, still unpatched flaw.

What to do (IT teams): install Ivanti's fixed version straight away, outside the normal patch cycle, then check for signs of compromise even after patching, because a VPN that was already breached stays breached. This is the same lesson as our post on FortiBleed: the devices at the edge of the network deserve the closest watching.

2. Spyware delivered through online adverts

On 15 October the University of Toronto's Citizen Lab reported what it described as the first observed case of mercenary spyware delivered through targeted online adverts. An Israeli company, Discover-Tech, bought ad space through mainstream advertising networks. When one of its ads loaded, hidden code checked whether the viewer was a chosen target. Most people saw nothing unusual; selected targets were sent on to Candiru spyware without clicking anything (a "zero-click" attack). Al Jazeera provided evidence that at least 45 of its devices were targeted in 2024 and 2025.

After the report, Google and several ad companies removed the accounts and blocked the domains involved.

What to do: this kind of attack is aimed at specific people such as journalists and activists, not the general public. Still, keeping your browser and operating system updated and using a reputable ad blocker reduce the risk from malicious ads, which are also used for ordinary scams.

3. Crypto wallets with a hidden spy chip

On 13 October Ledger's security team confirmed that some of its hardware crypto wallets sold by one reseller in Southeast Asia, CryptoBilis, contained an added implant. It captured the 24-word recovery phrase during setup and sent it out over a mobile (LTE) connection. Researchers estimated losses of more than $86 million, but Ledger said that figure is not verified. Ledger asked the reseller to stop sales, and rival maker Trezor cut back its own reseller network.

What to do: buy security devices only from the maker or an authorised shop, check the packaging, and never use a recovery phrase that came pre-written with a device. If you lost funds this way, contact the police before opening the device.

4. A backup service used to reach Microsoft 365 accounts

ConnectWise disabled its Cloud Backup service (formerly SkyKick) on 17 October after attackers stole a credential the service uses to connect to customers' Microsoft 365 tenants. According to the security firm Huntress and reports on the incident, the attackers signed in as the backup application itself, so no user passwords or MFA prompts were involved. At least 173 tenants had confirmed unauthorised sign-ins. ConnectWise said it had no evidence that backup archives were accessed. How the credential was stolen had not been disclosed.

What to do (Microsoft 365 admins): review Enterprise applications in Entra ID and remove apps you no longer use, check what permissions each app has, and look at sign-in logs for app (service principal) sign-ins from unusual places. Third-party apps with wide access are part of your attack surface. Our note on identity and access management explains the basics.

5. Supermarket group Ahold Delhaize goes offline

On 12 October Ahold Delhaize, the group behind Albert Heijn and Delhaize in Europe and Food Lion, Stop & Shop and Hannaford in the US, said it had a "security issue" and took some systems offline. Websites, apps and customer service were disrupted for several brands, but the company said its stores stayed open. At the time of writing nobody had claimed responsibility and it was not clear whether any data was taken.

What to do if you shop there: nothing for now, but be wary of emails or texts about refunds, loyalty points or "account problems" that mention these brands. Scammers often use news like this.

The habits that cover most of this

1. Patch internet-facing devices first: VPNs, firewalls and remote-access tools.
2. Review third-party access: apps connected to Microsoft 365 or Google Workspace, and suppliers with admin rights.
3. Buy security hardware from trusted sources and set it up yourself.
4. Keep browsers updated and be careful with ads and links after any big news story. See our October scam alerts.