October Patch Tuesday: The real problem isn’t the number of vulnerabilities

Posted in Commentary with tags on October 13, 2026 by itnerd

1,413 vulnerabilities in October can make patching feel unmanageable, but Tyler Reguly argues that volume alone is a distraction. With 26 2026 Microsoft CVEs appearing in CISA’s KEV catalog, security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act.

By Tyler Reguly, Associate Director, Security R&D, Fortra

Recently, I’ve argued that numbers are meaningless. This month’s number, 1413, is no different. There are, however, numbers that hold meaning. 26, for example, is how many 2026 Microsoft CVEs have shown up in the CISA KEV. Last year, that number was 30, and the year before was 32. That means less than 1% of vulnerabilities patched by Microsoft this year are known to be exploited. That’s an important number… but 1413 definitely isn’t.

I’ve talked to some people recently who’ve commented on the number of vulnerabilities announced this year, and I’ve spent a lot of time trying to think of how to explain it to them.

In the US, there are around 5000 movies available in the Netflix catalog depending on which source you look at. At any given moment, you care about one or two of those movies – the one you want to watch and, maybe, the one you want to watch next. The rest are just background noise. You prioritize those movies based on what you want to see, which is decided by your preferences. You don’t need to care about every vulnerability, just the one you are going to patch next, which you prioritize based on factors that matter to your organization. The rest of the vulnerabilities… background noise, no different than that random 1970’s creature feature that keeps showing up on your recommendations, even though you’ll never watch it.

“Pop Quiz, Hotshot” has always been one of my favorite quotes and today I’m directing that statement toward all the CISOs out there with teams actively working on Patch Tuesday. I want each of you to ask yourselves these 5 questions, to see if you really understand those teams work and if you are setting them up for success.

  1. Is your team feeling patch fatigue – how tired/stressed are they?
  2. Do you and your team truly understand your organization’s prioritization metrics?
  3. How complete is your organization’s asset inventory?
  4. Are you adequately resourced in terms of people, hardware, and software?
  5. What single wish list item do they have that would make their lives easier? Have you ever asked?

The answers to these questions may open your eyes to the needs of your team and help make them a happier, more productive group of individuals.

French Supermarkets Pwned In Overnight Cyberattack

Posted in Commentary with tags on October 13, 2026 by itnerd

You might want to get about securing critical infrastructure of all sorts. I say that because French supermarkets were pwned in epic fashion. Everyone is reporting on it. I happened to pick Time Magazine:

The Paris prosecutor’s office opened an investigation on Monday into an overnight cyberattack on refrigeration systems at hundreds of French supermarkets. Hackers raised the temperature of refrigerators and freezers, sparking fires and causing food to spoil.

In a statement to TIME, French retailer Les Mousquetaires, which runs supermarket chains Intermarche and Netto, said damage from the attack could amount to several million euros in losses.

“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” Dominique Schelcher, CEO of French supermarket chain Cooperative U, posted on X.

France’s National Cybersecurity Agency (ANSSI) confirmed to TIME that it is investigating the attack “both at the national level, to accompany potential victims, and at the European level to coordinate with its counterparts.” 

Maggie McDaniel, Global Head of Intelligence, iCOUNTER had this to say:

“Nobody had to break into hundreds of supermarkets one at a time. Retailers say the refrigeration controllers were managed by suppliers and maintenance contractors working across several chains, so one kind of access reached many brands in a single night. Attackers look for exactly that kind of shared supplier when picking a target. It also shows a gap in how most organizations think about third-party risk. Vendor programs usually focus on software providers and IT service firms. The contractor who can reach your store’s cooling system from outside rarely gets the same scrutiny, even though, as this showed, losing that system means throwing out food and closing stores. Some of these organizations never bought the equipment directly, because it came in through contractors. Retailers should start by mapping which suppliers can reach their store equipment remotely, which of those systems no longer get security updates, and how that access is controlled and logged. The intelligence question matters just as much. Security teams should be watching for attackers targeting their suppliers, not only themselves, because when one shared supplier is compromised, every customer it serves is exposed at once. An annual vendor questionnaire won’t show you what a supplier has left connected to the internet.”

Attacks on critical infrastructure are here. It’s beyond time to do something about this. So if you need a wake up call, consider this to be it.

Ridge Security Launches RidgeOne, a Self-Contained Appliance for AI Pentesting and Red Teaming

Posted in Commentary with tags on October 13, 2026 by itnerd

Ridge Security today announced RidgeOne, a self-contained solution that brings autonomous AI-powered penetration testing and agentic red teaming to mid-sized organizations. Combining Ridge Security’s RidgeGen® agentic security validation platform with an open-weight AI model running on NVIDIA DGX Spark, RidgeOne enables organizations to perform deep security testing within their own environment without sending sensitive testing data to an external AI provider or incurring ongoing AI token costs. Ridge Security is also joining the NVIDIA Inception Program, which provides startups with resources and support to help accelerate the development of innovative technologies.

For organizations with limited AI or security resources, accessing advanced security testing capabilities can be a challenge. RidgeOne is designed to make autonomous security testing easier to deploy and more accessible, giving organizations a way to use AI-driven offensive security without having to build their own AI infrastructure or maintain a separate AI environment.

RidgeOne is designed to provide several practical advantages:

  • Easy to deploy. RidgeOne provides AI-powered security testing without requiring organizations to build and maintain separate AI infrastructure.
  • Predictable costs. Running an open-weight model locally eliminates ongoing token costs associated with external AI services.
  • Portable. The appliance can be moved and deployed across different network segments, making it useful for organizations with distributed or segmented environments.
  • Deep security testing. RidgeOne can autonomously test IT infrastructure, networks, web applications, APIs, Active Directory, hosts and IoT/OT environments, including multi-step attack paths.
  • Private by design. Testing activity and sensitive security data remain within the customer’s environment rather than being sent to an external AI provider.

The solution is built around a validated reference configuration based on the NVIDIA DGX Spark compact AI system, with 128 GB of unified memory shared between the AI model and RidgeGen. RidgeOne can be deployed in a VMware environment and brought online in five steps, without requiring customers to build separate AI infrastructure.

In testing, Ridge Security ran RidgeOne against OWASP Juice Shop and completed a full autonomous penetration test without operator involvement. The assessment produced 32 verified findings, including 19 critical and high-severity findings, over approximately 10 hours, without making any external AI calls. The system also connected separate findings into a multi-step attack path.

That ability to connect the dots is central to RidgeGen. Rather than stopping at individual vulnerabilities, the platform can reason across findings, test whether weaknesses can be chained together and provide evidence that security teams can use to prioritize fixes.

As attackers increasingly use AI to automate and accelerate their operations, organizations need ways to put the same technology to work on the defensive side. RidgeOne gives security teams a portable way to bring autonomous testing capabilities into their own environments, whether they are testing a corporate network, a restricted segment or a different environment altogether.

RidgeOne is now available for organizations looking to deploy private, autonomous security testing within their own environments.

Airrived Named a Leader in the IDC MarketScape: Worldwide Standalone AI SOC Platforms 2026 Vendor Assessment

Posted in Commentary with tags on October 13, 2026 by itnerd

Airrived has been named a Leader in the IDC MarketScape: Worldwide Standalone AI SOC Platforms 2026 Vendor Assessment (doc # US54127026, September 2026).

Airrived Co-founder and CEO Anurag Gurtu said, “Being named a Leader in the IDC MarketScape for standalone AI SOC platforms is recognition of a problem security teams already know. Alert volume has outrun headcount, and a copilot on top of the existing stack does not close that gap.

Airrived turns business users into AI experts.

Airrived, a Gartner Cool Vendor in Agentic AI Security, is an enterprise-grade Agentic OS and Sovereign AI Platform that lets business and domain experts build, deploy, and govern autonomous AI — without becoming AI engineers.

Users bring the domain expertise. Airrived brings the reasoning, enterprise context, orchestration, governance, and infrastructure needed to turn that expertise into autonomous systems capable of reasoning, collaborating, deciding, and acting.

Unlike copilots, which mainly assist users, or developer frameworks, which require teams to engineer agents from scratch, Airrived lets enterprises automate complex, multi-step work across cybersecurity, IT, and business operations.

The platform combines deep reasoning, Agentic Mesh, Context Lake, multi-agent orchestration, governance, and end-to-end Agentic Observability — plus pre-built agents and applications that dramatically shorten the path from AI experimentation to production.

Built for the Sovereign AI Enterprise.

Airrived gives enterprises full control over where and how their AI runs. It can be deployed in the cloud, in customer VPCs, on-premises, on private GPU infrastructure, or in fully air-gapped environments — keeping data, models, agents, context, and AI operations under customer control at all times.

That removes a major barrier to enterprise AI adoption: organizations can put autonomous AI directly into the hands of the people who understand the business, without requiring them to master the underlying technology.

With adoption across Fortune 150 enterprises and organizations worldwide, this recognition follows a string of major product advancements from Airrived — including Agentic Observability and Sovereign Agentic AI — as the company continues advancing its vision for governed, autonomous AI across the enterprise.

Liquibase Secure Now Available in Google Cloud Marketplace and Microsoft Marketplace

Posted in Commentary with tags on October 13, 2026 by itnerd

Liquibase today announced that Liquibase Secure is now available in Google Cloud Marketplace and Microsoft Marketplace, joining its existing listings in AWS Marketplace and Snowflake Marketplace. The expanded availability is part of Liquibase’s commitment to being easy to do business with: customers can buy Liquibase Secure through the channel that fits their organization and govern database change wherever their applications and data run.

This extended availability comes as the way software is built is changing quickly. Developers are shipping more frequently, AI coding assistants are generating more code, and agents are beginning to participate across the software delivery lifecycle. That means more database change, from more sources, moving toward production faster.

Liquibase Secure gives enterprises one governed path for standardized change, whether it was written by a developer, generated with AI, or initiated through an automated workflow.

Buy Through the Cloud. Govern Across the Enterprise.

With the addition of Google Cloud Marketplace and Microsoft Marketplace, Liquibase Secure is now available in multiple marketplaces. Buying through a marketplace lets organizations work through the cloud accounts and procurement processes they already have, simplify vendor onboarding, and consolidate billing alongside their other cloud spend. Customers can continue to buy directly from Liquibase or through its partners.

More Change Requires Better Control

AI coding assistants are already generating more code, which means more database change moving through the software delivery lifecycle. Now AI is moving beyond assistance. Agents can generate SQL, modify schemas, propose migrations, and increasingly take action through automated workflows.

The problem isn’t whether a database change was written by a human or AI. The question is what governs that change before it reaches production and what evidence is left behind after it does.

That becomes even more important as software delivery becomes more autonomous. An agent may generate a change, automated systems may validate and deploy it, and no person may manually touch it along the way. Enterprises still need to know what changed, who or what initiated it, what controls were applied, and what ultimately reached production.

Liquibase Secure puts governance and proof of control directly into the database delivery process. Organizations can:

  • Automate database change through version-controlled CI/CD workflows.
  • Stop risky changes before production with automated policy checks.
  • Govern changes made by humans and AI with the same policies and approvals.
  • Maintain an audit trail for database changes made by humans and AI agents.
  • Detect drift and out-of-band change across environments.
  • Recover faster with versioned change history and rollback context.

With Change Intelligence in Liquibase Secure, teams gain centralized visibility into database deployment activity, risk, drift, and policy outcomes across environments.

As software delivery becomes more autonomous, governance can’t depend on a human being in the loop. It has to be built into the path to production.

Availability

Liquibase Secure is available now in Google Cloud Marketplace and Microsoft Marketplace.

For more information about Liquibase Secure, visit Liquibase.com.

Nearly 14 million credentials exposed in public database

Posted in Commentary with tags on October 13, 2026 by itnerd

Cybersecurity researcher Jeremiah Fowler discovered a publicly accessible database containing 13.7 million credentials. The database appeared to be connected to Vibetech, an India-based AI software development and IT services company.

The exposed database contained:

  • Personally identifiable information (PII) linked to individuals worldwide, including names, phone numbers, email addresses, passwords, and bank account details.
  • Records that appeared to have been aggregated from previous security incidents.
  • Data that could not be matched to known public breach disclosures, suggesting additional or previously unknown datasets.

You can read Jeremiah’s full findings on ExpressVPN’s blog here: https://www.expressvpn.com/research/vibetech-data-exposed

Sauce Labs Announces Support for Apple’s Foldable iPhone Duo

Posted in Commentary with tags on October 13, 2026 by itnerd

Sauce Labs today announced plans to support Apple’s new foldable iPhone Duo, with advance device reservations now open ahead of the Duo’s Friday, Oct. 23, release date. With the new form factor, teams need to verify application correctness with the new layout and other device-specific characteristics before release. Sauce Labs customers can use AURA, the company’s release assurance platform, to automatically author, run, and analyze tests against iPhone Duo.

Phone Duo pairs a 5.4-inch outer display with a 7.6-inch folding display, which changes windowing, layout, and UI interaction models. Apps built for single-screen iPhones need validation before they reach users on the new device.

What’s available

  • Real and Virtual Device Clouds: Physical iPhone Duo devices and iPhone Duo simulators are available for automated and live testing.
  • Guidance and best practices: Expert advice on adapting apps to the foldable, dual-screen UI.

Enterprises across industries have already reserved private iPhone Duo device access to validate mission-critical applications before broad consumer adoption.

Customers interested in private device access can contact their Sauce Labs account team to coordinate ordering and onboarding.

DataBee Accelerates the Future ofCyber Risk Automation

Posted in Commentary with tags on October 13, 2026 by itnerd

DataBee®, a Comcast Company, today announced major advancements to its cyber risk management platform, including the next evolution of DataBee Continuous Controls Monitoring (CCM), new innovations in DataBee Frontier AI Defense, and expanded capabilities for DataBee User Access Review (UAR). Together, these advancements help organizations automate the manual work behind monitoring controls, assessing application exposures, and reviewing user access while reducing the cost, complexity, and effort required to manage cyber risk.

At the core of the announcement is a unique AI-native federated architecture that enables organizations to analyze cybersecurity data where it resides rather than first moving, normalizing, and consolidating it for analysis. While federated analytics has long been common in domains such as financial services and customer relationship management, cybersecurity data has historically been far more fragmented, heterogeneous, and difficult to analyze across systems.

Building on years of cybersecurity data expertise and a library of more than 340 connectors, DataBee has engineered new generative AI capabilities that can connect to structured, semi-structured, and unstructured security data, calculate key measurements, and retrieve only the information needed for analysis. The result is less implementation complexity, faster time-to-value, and quicker access to actionable cyber risk insights.

Reimagining Continuous Controls Monitoring

DataBee, a Comcast company, was included as a Sample Vendor in the Continuous Controls Monitoring category of the 2026 Gartner report, “Hype Cycle™ for Cyber-Risk Management, 2026”, 27 April 2026, Deepti Gopal, Pedro Pablo Perea de Duenas.

The next evolution of DataBee CCM applies new architecture to help organizations measure control effectiveness without a major data infrastructure project. AI-assisted connector creation accelerates onboarding, while flexible monitoring enables teams to define the controls, metrics, dashboards, and frameworks that matter most to their business. Users can then Ask DataBee questions about their security control posture to identify gaps, understand risks, receive recommendations for metrics to measure specific controls, and understand changes in control risks along with guidance on how to improve.

DataBee CCM provides explainable, rigorous, data-backed measurements and enables organizations to reuse control results across multiple regulatory, security, and business frameworks, creating a simpler path to continuous risk reporting and faster answers to cyber risk and compliance questions.

Beginning this quarter, select organizations can experience DataBee CCM through a complimentary two-week trial program. Organizations interested in early access can register now to secure a place in the program.

Frontier AI Defense: From Vulnerability Findings to Faster Remediation

Every vulnerability scanner can tell teams what is vulnerable. DataBee helps them understand what matters and who can fix it.

As AI-powered attacks accelerate exploitation, modern security teams are drowning in findings while struggling to answer three fundamental questions: How important is it? Who owns it? What should we do next? DataBee for Frontier AI Defense automatically connects vulnerabilities to the business-critical applications they affect, helping organizations quickly identify the responsible owners and accelerate remediation efforts.

DataBee’s proprietary, patent-pending entity resolution technology correlates and deduplicates information across scanners, CMDBs, application inventories, and operational systems to create a single record for each business application. By connecting vulnerabilities to the applications they impact and identifying the owners responsible for remediation, the solution helps organizations eliminate one of the most common causes of patching delays: determining who needs to take action. Combined with advanced analytics and business risk prioritization, this enables faster patching, smarter resource allocation, and measurable reductions in cyber risk.

Extending Identity Governance to Legacy Applications

User access reviews remain one of the most persistent challenges in identity governance. While many governance solutions focus on cloud and SaaS applications, organizations frequently rely on spreadsheets, manual processes, and ad hoc evidence collection to review access across mainframe, on-premises, and custom-built systems, leaving critical portions of the enterprise outside an automated governance process.

DataBee User Access Review closes this gap by identifying applications requiring review, establishing ownership, generating reviewer populations, and preserving the evidence and traceability needed for compliance and audit programs. By complementing existing identity governance investments, DataBee helps organizations extend governed access reviews across modern and legacy environments through a more complete and automated process.

Cybersecurity Awareness Month Webinar Series

To mark Cybersecurity Awareness Month, DataBee is hosting three educational webinars for CISOs, Cyber GRC leaders, and BISOs seeking to modernize their cyber risk management practices:


Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.

Hype Cycle is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.  

MoneyGram hack claimed by The Gentleman, 60M customers at risk

Posted in Commentary with tags on October 12, 2026 by itnerd

The Gentlemen ransomware gang has claimed an attack on MoneyGram, one of the world’s largest payment networks, and is threatening to release the stolen data. MoneyGram serves 60 million active customers across more than 200 countries. 

Rebecca Moody, Head of Data Research at Comparitech: 

“The Gentlemen has become one of the most prolific ransomware groups of recent years and isn’t known for fabricating its claims. MoneyGram needs to issue a statement as soon as possible to either reassure its customers that a breach hasn’t occurred or warn them of any potential unauthorized access to its systems.

Financial organizations are a key target for ransomware groups because of the highly sensitive data they deal with. The Gentlemen has claimed 46 attacks on such entities so far this year. 

Also of note is its attack on a South African tech company, MIP Holdings. This took place in June 2026, with MIP paying The Gentlemen a ransom to delete the stolen data. However, The Gentlemen has now started targeting MIP’s clients and is issuing them with their own ransom demand. This serves as a key reminder that paying a ransomware group to delete data doesn’t guarantee any data will be deleted. In MoneyGram’s case, regardless of whether or not negotiations are successful, individual customers could be contacted by the group. Therefore, MoneyGram’s customers and employees should be on high alert for any potential phishing messages and unauthorized account activity.”

Brian Higgins, Security Specialist at Comparitech:

“It’s very early in the incident response timeline but that’s no reason for anyone who may be affected should this attack prove genuine not to be extra vigilant whilst more details become available. It’s not MoneyGram’s first rodeo so there’s a good chance they will be able to offer decent information and advice as things progress, so it would be a good idea to monitor their comms output. Unfortunately these days more and more people are aware of the personal mitigations they should be considering; changing passwords, monitoring accounts, ignoring and reporting unsolicited contact and checking they have two-factor authentication applied wherever possible etc, but given the volume and diversity of the potentially vulnerable client base on this occasion it’s worth checking in with family, friends and others in your community to make sure they are doing the same. Nobody wants to be worried about their personal financial info being compromised going into Thanksgiving and Christmas so it can only help to look after each other where you can.”

Comparitech in August published a study of The Gentleman ransomware, which can be read here: https://www.comparitech.com/news/the-gentlemen-ransomware-stats-on-attacks-ransoms-data-breaches/

Inside ICMacOS: From an Infostealer to a Persistent RAT

Posted in Commentary with tags on October 12, 2026 by itnerd

SOCRadar researchers have just published a new analysis of ICMacOS (also marketed as Icarus macOS), a Malware-as-a-Service infostealer for macOS that has been actively advertised on Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, since early September 2026.

Key findings include:

  • Rapid evolution: Within weeks of its public launch, ICMacOS moved from one-shot credential and wallet theft to a persistent remote access trojan, adding LaunchAgent persistence and a live WebSocket-based shell that lets operators run commands on infected Macs in real time
  • Developer and enterprise exposure: The malware specifically harvests SSH keys, AWS, Kubernetes and cloud CLI credentials, Git tokens, and .env files, creating a potential pathway from a single compromised Mac into broader enterprise infrastructure and the software supply chain
  • Convincing social engineering: ICMacOS is delivered through ClickFix pages that trick victims into pasting terminal commands, then displays a fake “System Preferences” dialog to capture the user’s login password and validates it against the local Keychain
  • Wide collection scope: Targets include browser credentials and cookies across Chromium, Safari, and Firefox, 29 browser extensions covering crypto wallets and password managers, desktop crypto wallets, the macOS Keychain, Telegram, WhatsApp, Discord, iMessage, and Apple Notes; the latest version adds Steam, Outlook, clipboard contents, and additional password managers
  • Commercial operation: The stealer is sold by an actor using the handle GlowComa, operating under the MADHASH crypto-draining affiliate group, at $699 per week, $1,199 every two weeks, or $1,699 per month, and it is configured to avoid infecting systems in Russia and CIS countries

For full details, the analysis can be found here: https://socradar.io/blog/icmacos-infostealer-rat/