Cyber Security News for October 12 2026 - Daily DefSec Brief
Show notes
1. GlobalProtect bypass still feeds ransomware — CVE-2026-0257 — Fixed: 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6, or the matching hotfix — Do: Patch GlobalProtect and review VPN sessions — https://security.paloaltonetworks.com/CVE-2026-0257
2. Fake "security audit" workflow steals CI secrets — Do: Search your repos for unexpected workflow files — https://socket.dev/blog/ghostaction-cloud-credentials
3. Public root exploit for AnyDesk on Linux — Fixed: 8.0.3 — Do: Update AnyDesk on Linux hosts — https://github.com/v12-security/pocs/tree/main/anydesk
4. One prompt exposed every AgentCore agent — Do: Scope down every AgentCore execution role — https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model
5. Old Windows loses Windows Update in 2027 — Do: Find unsupported and stuck Windows machines — https://learn.microsoft.com/en-us/windows/release-health/windows-message-center
6. AWS PowerShell tools logged console passwords — CVE-2026-107783 — Fixed: 5.0.306 — Do: Upgrade AWS Tools for PowerShell — https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/
7. Exposed Nvidia GPU exporters leak telemetry — CVE-2026-47483 — Fixed: DCGM 4.5.3 — Do: Take the DCGM Exporter off the internet — https://github.com/NVIDIA/product-security/blob/main/2026/5857/5857.md
8. Two letters slip lookalike domains past Chrome — Do: Watch for lookalikes of your domains — https://www.theregister.com/security/2026/10/10/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers/5302383
9. Update: Denmark's CPR breach ran on "123456" — Do: Ban common passwords on partner accounts — https://databreaches.net/2026/10/10/123456-password-used-in-massive-danish-cpr-data-breach/