Share on social
Oct 15, 2026
Lorem ipsum
This story appeared in our weekly cybersecurity newsletter Beacon. Sign up to get weekly updates on the latest news, findings and insights, straight to your inbox every Thursday at 10AM.
Top Story This Week:
Microsoft breaks Patch Tuesday record again with 1,400+ CVEs
Microsoft's October Patch Tuesday fixed 1,411 CVEs, an all-time high that tops its July and September records and exceeds the roughly 1,100 fixes it shipped across the whole of 2025. The surge is linked to Microsoft's use of AI to hunt for flaws in its own products, including its multi-model agentic scanning harness, MDASH, which the company had already warned would bring a flood of patches.
The release includes one actively exploited zero-day, CVE-2026-96951, a Windows Shell security feature bypass (CVSS 8.8) that needs no privileges and can be triggered by a crafted file delivered via phishing, messaging or a malicious site.
Two further flaws were publicly disclosed before patching. A .NET Framework bypass of Windows Defender Application Control (CVE-2026-108398) and a MessagePack-CSharp denial-of-service bug (CVE-2026-92707).
Of 70 critical vulnerabilities, 57 are remote code execution flaws, including a 9.8-rated Outlook Reading Pane bug (CVE-2026-70242) that needs no click or authentication.
Why it Matters
This record is a symptom of a system that has become very good at finding problems, not a sign of worse code. AI is compressing years of manual code review into weeks, so disclosure volume now scales with the tooling while remediation capacity stays fixed.
Mid-year research put H1 2026 at over 35,000 CVEs industry-wide, yet only about 0.24% had reached CISA's KEV list. That looks reassuring, but it's a floor that rises as exploitation is confirmed, and it reflects better discovery rather than better fixing.
Defenders must prioritise correctly across tens of thousands of flaws, while attackers need just one left exposed. With fixed-severity scores and raw CVE counts as the guide, teams cannot tell which handful of fixes matter to their own environment right now. Security teams now have more findings, alerts and exposures than they could ever realistically remediate, so the real challenge has shifted from finding threats to prioritizing them according to real world threats.
What this Means for Practitioners
Map new CVEs to the assets you actually run, and separate internet-facing systems from internal-only or already mitigated ones.
Prioritise on exploitability, business criticality and live attacker activity, not CVSS or CVE counts alone. Start with the exploited Windows Shell flaw and the no-click Outlook bug.
Move fast on exposures that are both confirmed exploitable and being targeted; the .NET bypass has no workaround and is rated "exploitation more likely."
What this Means for Security Leaders
Accept that raw patching velocity won't scale as disclosure volume keeps growing, and shift from vulnerability management to exposure management: what is reachable, exploitable and worth fixing first.
Don't read a low exploitation rate as proof of progress; it signals better discovery, not better remediation.
Plan for team capacity and burnout, given one in five UK CISOs are dodging Patch Tuesday, by cutting noise rather than adding more patch work.
Discover More
Breaking Discourse's Image Pipeline
During a security audit of Discourse, a popular open-source forum platform powering over 22,000 communities including OpenAI, Atlassian, and Cloudflare, our Searchlight Labs team discovered two vulnerabilities affecting default configurations. Read the full technical breakdown to learn more about our research.
How a Single Slip Handed Over a Darknet Empire
Our latest report examines a vulnerability in GoBalance, a load-balancing tool widely used by darknet sites, that lets anyone recover a site’s master signing scalar from nothing more than its publicly available data. Read the full technical analysis, the timeline of events, and an explanation of how the affected software works.
Weekly News Digest
Asos Confirms Hackers Sent 'Unauthorised' Notification to App Users
While the hackers claimed to have compromised Asos’s Snowflake instance, the company stated that it found no evidence of unauthorised activity on the platform. However, it did admit that customers’ personal information may have been accessed via “third-party platforms that we use to communicate with customers". This would explain how hackers were able to take the somewhat unorthodox approach of informing Asos app users of the compromise via push notification. Though it is not currently believed that payment details or account passwords were accessed, customers are still being advised to change their passwords and be vigilant of suspicious activity related to their account.
Cyberattack Hits Hundreds of French Supermarkets, Heating Fridges to 122°F and Sparking Fires
At time of writing no one has claimed responsibility for the attack, which is said to have also affected supermarkets in other European countries. In addition to being described as “extremely serious and unprecedented”, the attack was characterised as the “weaponization of food” by European Commissioner for Agriculture and Food Christophe Hansen. The intrusion vector is believed to be a vulnerability in software provided by Danfoss, which allows retailers to manage the temperature of cold units remotely. Danfoss stated that affected units were older models which could no longer receive security updates, adding that it had “long advised” customers to keep systems updated with the latest firmware.
Hackers Access Data of 8.8 Million People in Denmark in 'Extremely Serious' Breach
Denmark is investigating a major cyberattack that exposed the personal data of 8.8 million people, in what authorities have described as an “extremely serious” security breach. Hackers gained unauthorised access to the country’s national population register through a Danish company with legitimate access to the system, compromising names, addresses and personal identification numbers. Danish authorities have launched an investigation to establish who was responsible and assess the full extent of the incident, while warning the public to remain vigilant against potential scams and identity fraud.
Searchlight tells you which of your exposures attackers are actually discussing and targeting, complete with expert profiles on the adversary, so your prioritization reflects real-world attacker interest instead of a severity score. The exposures Searchlight discovers that have active attacker attention rise to the top of the queue.
The exposure window is the period between a vulnerability or misconfiguration existing and it being discovered and remediated. As exploitation timelines have shortened to hours in many cases, shrinking this window - rather than just improving time-to-response after a breach - has become the primary objective of a mature security programme.
Preemptive Threat Exposure Management helps security teams find, validate, and prioritize exposures before they become incidents. It combines visibility into your external attack surface with real-world threat context, so teams can focus on what attackers are actually targeting.
Searchlight observes which exposures attackers are actively discussing and targeting, and moves those to the top of your queue with the actor context attached. Two findings with the same severity score can carry very different real-world risk, and your prioritization follows the risk.
Traditional vulnerability management measures success by volume - how many vulnerabilities were found or patched - and largely assumes defenders have time between disclosure and exploitation. PTEM shifts the objective to reducing exploitable exposure continuously, incorporating real-world attacker context that traditional vulnerability management never accounted for.
