Cyber Security News for October 13 2026 - Daily DefSec Brief
Show notes
1. GitLab fixes a 10.0 pre-login code execution flaw — CVE-2026-97229 — Fixed: 19.4.2, 19.3.5 or 19.2.8 — Do: Upgrade self-managed GitLab — https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
2. Windows 11 23H2 Enterprise updates end in November — Do: Find and upgrade Windows 11 23H2 machines — https://learn.microsoft.com/en-us/windows/release-health/windows-message-center
3. Attackers warmed freezers at French supermarkets — Do: Take vendor-managed equipment off the open internet — https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/
4. Free AI credits came with a rerouted coding agent — Do: Check where your coding agents send their traffic — https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages
5. Cheap Android phones ship as proxy exit nodes — Do: Keep unmanaged phones off the internal network — https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
6. Agent frameworks ran a tool call the model refused — Do: Put the permission check in the tool — https://arxiv.org/html/2610.13651v1
7. VMware's MFA for ESX comes in a paid add-on — Do: Keep SSH off on your ESX hosts — https://www.theregister.com/virtualization/2026/10/13/vmware-is-pushing-so-many-patches-it-thinks-users-need-new-tools-to-manage-the-flood-1/5302172