Good morning!

A DOJ complaint charges an OpenAI engineer with planting a covert recorder as Meta traces a GitHub breach to one employee's stolen credentials. It takes a conference room or a login to reach company secrets.

Here are the 7 things you don't want to miss:

1. 🔒 CISA flags an exploited zero-day in Ivanti Connect Secure

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities list on October 13: an authentication bypass in Ivanti Connect Secure that allows unauthenticated command execution. CISA says attackers are using it for credential theft and data exfiltration, and warns Ivanti's Integrity Checker Tool may not detect it because commands run in memory. Volexity reports a third flaw in the chain, a privilege escalation, is unpatched. (CISA)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. 🛠 Microsoft's Patch Tuesday tops 1,400 flaws

Microsoft's October update fixed more than 1,400 flaws, beating September's record of nearly 1,000; at least 78 are rated critical. Among them is CVE-2026-96951, a Windows Shell security-feature bypass affecting Windows 10, 11 and some Server versions, which Microsoft marks as already exploited. Nobody's backlog needs fourteen hundred priorities. (KrebsOnSecurity)

4. ⚖️ DOJ charges an OpenAI engineer over a hidden recorder

The Justice Department charged Abdulrahman Alfozan, an OpenAI engineer since July 2025, with using a device to intercept oral communications, alleging he concealed it in the USB port of a television in an executive conference room. OpenAI found it on or about September 30; he was arrested October 9 and faces up to five years if convicted. (Department of Justice)

5. 💾 Meta's GitHub repositories fell to an employee's stolen credentials

Meta is notifying roughly 1,500 people, most of them U.S. employees, after an outside group used an employee's stolen credentials to reach some of its GitHub repositories. The company says 99% of what was taken was business data in the form of software code and 1% personal data, and it does not believe the attackers were specifically after its data. The credential mattered more than the code it opened. (SecurityWeek)

6. 🤖 Why LiteLLM's gateway trusted any authenticated user

Check Point Research reports that its assessment of LiteLLM v1.77.7, an open-source gateway routing requests to model providers, found a missing authorization check that let any authenticated user rewrite the gateway's configuration (CVE-2026-35029), plus a redirect flaw that can expose provider API keys (CVE-2026-59823). Both are fixed in 1.83.9. (Check Point Research)

7. 👓 Why the EU wants smart glasses to announce themselves

The EU's data protection board adopted a statement on smart glasses on October 13, warning that cameras and microphones in ordinary-looking frames can record bystanders without their knowledge, especially in hospitals, schools and workplaces. It says recordings should be made obvious, and that producers and app providers cannot transfer their obligations to users. (European Data Protection Board)

Bonus. Threat Road Tip Of The Day

Take ten minutes today to see which accounts can change configuration rather than just read it. Most audit logs answer that in one screen, and the recent-changes list is usually shorter than you fear and more useful than you expect.

Disclosure: Topic #2 in this newsletter is a promotion for Threat Road's Cyber Security Labs. Nothing else in this issue is sponsored.