Cyber news on October 14, 2026

1. 0112:00 UTC

   Harmonic Security raises $50M to classify and control workplace AI traffic

   2 outlets · first: SiliconANGLE Security

   Machine summary Harmonic Security announced a $50 million Series B led by Crosspoint Capital Partners, lifting total capital raised to $76 million, SecurityWeek reported. The company says small language models read each AI interaction in context to classify the task, enabling real-time control over browser-based AI, desktop AI tools and agentic workflows.

   1. Crosspoint Capital Partners led the round, with participation from existing investors, according to the company's announcement.
   2. The company was founded in 2023 by CEO Alastair Paterson and CTO Bryan Woolgar-O'Neil, who previously founded Digital Shadows, which ReliaQuest acquired.
   3. Harmonic's platform classifies employee AI tasks across browser-based AI, desktop AI tools and agentic workflows, and applies real-time controls, according to SecurityWeek's description of the product.
   4. The company stated that small language models are used to interpret each AI exchange in its context. Its Usage Intelligence layer operates on that same engine, surfacing AI use cases that generate value.
   5. According to Harmonic, the money raised will go toward growing the company's engineering and go-to-market workforces across the US and UK.

   Reported by SiliconANGLE and securityweek.com.

   • SecurityWeek
   • small language models
   • Digital Shadows
   • Usage Intelligence
   • Harmonic Security
   • SiliconANGLE

2. 0210:48 UTC

   Microsoft: Windows updates may cut Remote Desktop access for non-admin users

   2 outlets · first: bleepingcomputer.com Vulnerability

   Machine summary The company pointed to enterprise-managed devices used as Remote Desktop hosts and shared a workaround that disables the feature through policy management.

   1. Microsoft said Remote Desktop attempts may fail with error 0xC000000D and the message "The token that was passed to the function is invalid," BleepingComputer reported on 2026-10-14
   2. Administrator protection began rolling out with the KB5067036 preview cumulative update in October 2025 for Windows 11 24H2 and 25H2, the reports state
   3. Microsoft said the issue primarily affects enterprise-managed devices used as Remote Desktop hosts with Administrator protection on, regardless of how the feature was enabled
   4. BleepingComputer reports Administrator protection is enabled by default in the Windows 11 24H2, 25H2 and 26H2 security baselines from the Microsoft Security Compliance Toolkit
   5. Microsoft's stated workaround is to disable Administrator protection via policy; Intune or Group Policy users would reset the "User Account Control Type Of Admin Approval Mode" policy, the reports say

   Reported by bleepingcomputer.com and CyberSecurityNews.

   • Microsoft
   • BleepingComputer
   • Windows 11
   • Microsoft Security Compliance Toolkit
   • Group Policy
   • KB5067036

3. 0312:58 UTC

   Ivanti patches Connect Secure zero-day used since at least Oct. 1

   2 outlets · first: bleepingcomputer.com Vulnerability

   Machine summary Ivanti released fixes on Tuesday for CVE-2026-104935, a high-severity authentication bypass in Connect Secure that the company said had seen limited in-the-wild exploitation. Shadowserver tracked more than 5,600 internet-exposed Connect Secure hosts, and CISA added the flaw to its actively exploited list on Tuesday.

   1. CVE-2026-104935 is a high-severity authentication bypass in Ivanti Connect Secure that lets an unauthenticated remote attacker run arbitrary commands in low-complexity attacks requiring no user interaction, according to Ivanti's advisory and CISA.
   2. Volexity reported that an actor it tracks as UTA0576 chained this flaw with two others since at least October 3 to obtain unauthenticated root-level code execution, with the bypass and RCE both tracked as CVE-2026-104935.
   3. Defused said it first saw in-the-wild abuse of CVE-2026-104935 on October 1; CISA said exploitation has occurred since at least that date and added the flaw to its actively exploited list on Tuesday.

   Reported by bleepingcomputer.com and Dark Reading.

   • CISA
   • Volexity
   • Ivanti
   • Defused
   • Shadowserver
   • UTA0576

4. 0422:56 UTC

   Palo Alto Networks patches PAN-OS management flaw exploited in attacks

   2 outlets · first: bleepingcomputer.com Vulnerability

   Machine summary The company said it observed very limited exploitation and issued fixes for PAN-OS 10.2 through 12.2, while CISA added the flaw to its Known Exploited Vulnerabilities catalog with an October 17 remediation date for federal agencies.

   1. The company said "very limited exploitation" of the flaw had been observed against its management interface, and that no special configuration is needed for the vulnerability to be exploitable, SecurityWeek and BleepingComputer reported.
   2. Affected products include PAN-OS on PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances; Palo Alto Networks said Cloud NGFW and Prisma Access are not affected, BleepingComputer reported.
   3. Suraj Siddharudh, senior principal product security researcher with Palo Alto Networks, found the flaw internally, and a few IP addresses were shared by the company as indicators of compromise, the reports said.

   Reported by bleepingcomputer.com and securityweek.com.

   • CISA
   • Palo Alto Networks
   • Prisma Access
   • PA-Series
   • Panorama
   • Cloud NGFW

5. 0522:34 UTC

   Ransomware group Aur0ra claimed Costa Solutions data in April 2026

   1 outlet · first: claimdepot.com Data breach

   Machine summary Costa Solutions detected suspicious network activity on April 17, 2026 and later determined unauthorized activity ran April 15–20, 2026, according to Claim Depot. On April 29, 2026 a group calling itself Aur0ra posted a claim on a Tor-hosted dark web site stating it held data belonging to the organization, and a file review concluded Aug. 10, 2026 that personal information may have been in the data taken.

   1. Costa Solutions reported a breach affecting approximately 22,482 people in the U.S., including 19,758 Texas residents (Claim Depot)
   2. Unauthorized network activity occurred between April 15 and April 20, 2026; the company detected suspicious activity on April 17, 2026, the report says
   3. A group calling itself Aur0ra posted a claim on a dark web site via the Tor network on April 29, 2026 stating it had obtained company data
   4. The company's file review concluded Aug. 10, 2026 that personal information may have been in the data taken without authorization
   5. Starting Sept. 9, 2026, individuals received notification letters, while filings were made to the attorneys general offices in Indiana, Massachusetts, and New Hampshire.

   Reported by claimdepot.com.

   • Aur0ra
   • Costa Solutions LLC
   • Tor
   • Claim Depot

6. 0614:27 UTC

   Microsoft ships fixes for Always On VPN failures from September updates

   1 outlet · first: bleepingcomputer.com Vulnerability

   Machine summary Microsoft released the KB5127648 and KB5127646 cumulative updates to address Always On VPN connection failures that BleepingComputer reports followed the September 2026 Windows 11 security updates. According to Microsoft's description, connections configured for automatic protocol selection or fallback across IKEv2 and SSTP could stall in a Connecting state or fail after an initial attempt, with later attempts returning 'The specified port is already in use'. The report states the issue affected up-to-date systems running Windows 11 24H2 and later, and that Microsoft shared a mitigation of pinning the VPN profile to a single protocol.

   1. Microsoft released cumulative updates KB5127648 and KB5127646 on Tuesday to address Always On VPN connection failures reported by BleepingComputer
   2. The report states that Microsoft confirmed the problem via an alert about its service, which went out to IT administrators toward the end of September 2026.
   3. The failures appeared on up-to-date systems running Windows 11 24H2 and later after the September 2026 Windows 11 security updates, the report says
   4. Microsoft said connections could stay stuck in a Connecting state or fail after an initial attempt failed, and later attempts could return 'The specified port is already in use'

   Reported by bleepingcomputer.com.

   • Microsoft
   • BleepingComputer
   • Windows 11
   • SSTP
   • Windows 11 24H2
   • IKEv2

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.