Cyber News Bytes: What’s Happening in Cybersecurity This Week

Before the headlines: if you want to build the kind of hands-on skill that gets you noticed in interviews, not just theory you can recite, my 5 Technical Cybersecurity Projects course walks you through five real, resume-ready projects.

This week's stories are a great case study in why practical skills matter more than ever.

Now, four stories worth your time. →

1. CenterPoint Energy's breach exposed Social Security and driver's license numbers for over 1 million Texans, and customers still hadn't been told

A report filed with the Texas Attorney General shows a CenterPoint Energy data breach affected 1,062,060 Texas residents. The exposed data includes names, addresses, Social Security numbers, and driver's license numbers. The Houston-based utility first learned of the problem in September when a third party posted online claiming to have stolen customer data, and it confirmed unauthorized access in an SEC filing that said electric and gas service was unaffected.

When the Texas filing went public, CenterPoint had not yet notified the affected customers, and the company says it is still working with outside experts to determine who will get notices. Class action lawsuits have already been filed in multiple states. The person who posted the data reportedly claimed a much larger haul of around 7.5 million records, a figure CenterPoint has not confirmed.

Why it matters: Many people learned about this from the news instead of a letter, which is a good reminder that you can't count on a company to warn you quickly. If you're a CenterPoint customer, consider freezing your credit now rather than waiting for a notice, and watch for scam calls and texts that reference your account.

Read more at ABC13 Houston

2. Microsoft's October Patch Tuesday was a record, with more than 1,400 fixes and a Windows zero-day already under attack

Microsoft's October 13 security update fixed a record-breaking number of vulnerabilities, with most counts landing around 1,411 to 1,415, and about 1,100 of them affecting Windows. One is being actively exploited: CVE-2026-96951, a Windows Shell flaw that lets attackers bypass Mark of the Web, the label that makes Windows and Office warn you before opening files downloaded from the internet. CISA gave federal agencies until October 16 to patch it, and two other flaws were publicly disclosed before fixes shipped, though no exploitation has been confirmed for those.

Microsoft says it is increasingly using AI platforms to find and fix flaws, which helps explain the huge total. The update also arrives as Windows 11 version 24H2 Home and Pro reach end of support, meaning those PCs stop receiving security fixes unless they are upgraded.

Why it matters: A Mark of the Web bypass means a booby-trapped download can skip the warnings that normally stop you. Install this month's updates soon, and if you or your family are on Windows 11 24H2 Home or Pro, upgrade to a supported version so you keep getting protection.

Read more at BleepingComputer

3. One stolen backup app credential gave hackers a way into 173 Microsoft 365 environments

Huntress and Microsoft are tracking an active supply chain attack in which hackers stole a credential belonging to ConnectWise Cloud Backup, formerly SkyKick, a Microsoft 365 backup tool used by managed service providers. Within about two and a half hours on October 15, the attacker used it to pull Microsoft Graph access tokens and sign in to partner and customer tenants, and Huntress had confirmed 173 affected tenants as of October 17.

Because backup tools need broad permissions, the stolen credential could reach mail, OneDrive, SharePoint, Teams, and directory data in every tenant where the app was installed. The sign-ins authenticated as the application itself, so no user passwords or MFA prompts were involved. In at least one tenant, a second ConnectWise app assigned itself the Global Administrator role. ConnectWise has suspended Cloud Backup application access while it investigates.

Why it matters: The apps you have connected to Microsoft 365 are part of your attack surface, and one vendor's stolen secret can open the door to hundreds of customers. Review the third-party apps in your tenant, remove the ones you don't need, and ask your IT provider whether you're affected.

Read more at The Hacker News

4. Hackers have been quietly exploiting an Ivanti VPN zero-day since early October, and the patch may not tell the whole story

Ivanti and CISA warned that CVE-2026-104935, an authentication bypass in Ivanti Connect Secure, is being exploited in the wild. It lets an unauthenticated attacker run arbitrary commands on the VPN appliance, and Defused saw exploitation starting around October 1. Volexity says a group it tracks as UTA0576 chained this bug with two other flaws to steal credentials and data, and CISA added it to its Known Exploited Vulnerabilities catalog on October 13, the same day Ivanti shipped fixes.

The attackers re-exploited the device for every command, tampered with logs, and ran code in memory, which can slip past Ivanti's Integrity Checker Tool. Ivanti has also said it is still working on a fix for a privilege escalation flaw in that chain. The same week, Palo Alto Networks disclosed an exploited PAN-OS zero-day, CVE-2026-0322, which CISA gave federal agencies until October 17 to fix.

Why it matters: VPNs and firewalls sit at the front door of most networks, and attackers keep targeting them first. If you run Ivanti Connect Secure, update right away, assume you could already be compromised, follow CISA's hunting guidance instead of relying only on the integrity checker, and keep management interfaces off the public internet.

Read more at BleepingComputer

This week's stories all came down to trusted things going wrong: a utility sitting on a million Social Security numbers, a record pile of patches, a backup app holding the keys to hundreds of environments, and a VPN meant to keep attackers out.

Building the hands-on skill to find and close gaps like these yourself is exactly what turns knowing about security into actually doing it.

Stay secure out there,

Sandra | Cyber With Sandra