--- title: "Microsoft Patches Vulnerabilities, China Hackers Exploit , Rank Math Trojan | AutoSPF" description: "Cybersecurity news from October 13–19, 2026, covering Microsoft patches, zero-day exploits, data breaches, malware, and critical vulnerabilities." image: "https://autospf.com/og/blog/microsoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan.png" canonical: "https://autospf.com/blog/microsoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan/" --- Quick Answer Cybersecurity news from October 13–19, 2026, covers critical vulnerabilities, zero-day exploits, data breaches, and malware attacks. Organizations should apply security patches, monitor exposed systems, and strengthen email authentication to reduce cyber risks. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fmicrosoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Microsoft%20Patches%20Vulnerabilities%2C%20China%20Hackers%20Exploit%20%2C%20Rank%20Math%20Trojan%20&url=https%3A%2F%2Fautospf.com%2Fblog%2Fmicrosoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fmicrosoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fmicrosoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan%2F&title=Microsoft%20Patches%20Vulnerabilities%2C%20China%20Hackers%20Exploit%20%2C%20Rank%20Math%20Trojan%20 "Share on Reddit") [ ](mailto:?subject=Microsoft%20Patches%20Vulnerabilities%2C%20China%20Hackers%20Exploit%20%2C%20Rank%20Math%20Trojan%20&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fmicrosoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan%2F "Share via Email") ![Cybersecurity Vulnerabilities and Threats](https://media.mailhop.org/autospf/spf-lookup-2070-1792666294803.jpg) Here’s a roundup of the week’s **cybersecurity developments**, from a major Microsoft patch release to a critical [remote-access](https://www.datacenterdynamics.com/en/news/us-house-of-representatives-passes-bill-to-limit-remote-access-to-us-ai-chips/) zero-day tied to Chinese espionage. The week was dominated by actively exploited flaws in internet-facing tools that organizations rely on for remote access and content management. ## Microsoft patches a record 1,411 flaws, including an exploited zero-day! Microsoft’s October Patch Tuesday on 13 October fixed a record number of vulnerabilities, with [three zero-days](https://gbhackers.com/microsoft-october-2026-patch-tuesday/) among them. The one that matters most is a Windows Shell bypass, **CVE-2026-96951**, which attackers are already using and which CISA added to its exploited-vulnerabilities catalog. Administrators should prioritise it. [Read the report on BleepingComputer](https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/) ## A China-linked group exploited a BeyondTrust zero-day for months! **Google’s Mandiant team** says a suspected China-nexus espionage group exploited a critical [BeyondTrust Remote Support flaw](https://tech-insider.org/beyondtrust-remote-support-zero-day-armory-castle-2026/), CVE-2026-102764, starting in late August. The attackers reportedly gained root access and tried to harvest stored credentials. Self-hosted customers were told to patch immediately and to treat exposed appliances as possibly compromised. [Read the report on CSO Online](https://www.csoonline.com/article/4236421/beyondtrust-zero-day-tied-to-chinese-spies-puts-remote-support-users-on-alert.html) ## A supply-chain attack trojanised the Rank Math PRO WordPress plugin! [Malicious code](https://foxsanantonio.com/news/nation-world/anthropic-openai-models-used-fake-identities-plant-malicious-code-security-institute) was injected into some [Rank Math SEO PRO](https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html) 3.0.123 packages downloaded between 15 and 16 October. _Once activated, the malware can create hidden backdoors and expose server secrets._ The vendor removed the bad packages and **released version 3.0.124** as a clean replacement. Site owners who installed an affected version should treat their sites as compromised. [Read the report on Security Online](https://securityonline.info/rank-math-seo-pro-compromise-exploited/) ![Spf Record Checker 1527](https://media.mailhop.org/autospf/spf-record-checker-1527-1792666478002.jpg) ## Meta confirms GitHub breach exposing code and data of 1,500 people! Meta says an outside group used stolen employee credentials to access some of its [GitHub repositories](https://shattered.io/meta-github-breach-1500-people-2026/). About **99%** of the stolen material was business data and source code, and the remaining 1% was personal information, mostly belonging to US-based employees. Meta says its internal systems were not breached and that it has notified affected people and is working with GitHub and law enforcement. [Read the report on The Arabian Post](https://thearabianpost.com/meta-notifies-1500-after-github-code-theft/) Organizations should also strengthen [email security](https://autospf.com/?utm%5Fsource=chatgpt.com) by implementing [DMARC](https://autospf.com/dmarc/what-is-dmarc/?utm%5Fsource=chatgpt.com), [SPF](https://autospf.com/blog/what-is-spf-email-a-guide-to-sender-validation-technology/?utm%5Fsource=chatgpt.com), and [DKIM](https://autospf.com/dkim/what-is-dkim/?utm%5Fsource=chatgpt.com) authentication to prevent email spoofing, reduce phishing risks, and protect sensitive data from cyberattacks. ## Plex Media Server exploit goes public and a honeypot gets hijacked! **Proof-of-concept code** for an unauthenticated exploit chain against [Plex Media Server](https://gizmodo.com/your-plex-server-could-be-mining-crypto-for-hackers-if-you-havent-updated-it-2000827461) appeared on 16 October. A researcher then saw it used against an outdated honeypot the next day, which was turned into a cryptocurrency miner and proxy. _Researchers stress that this is one observed case rather than a confirmed mass campaign, but owners should update to version 1.43.3.10861 or later right away_. [Read the report on Cord Cutters News](https://cordcuttersnews.com/plex-media-server-owners-urged-to-update-immediately-after-in-the-wild-exploitation-of-older-installations-turns-your-computer-into-a-zombie/) ## CISA warns of an actively exploited Ivanti Connect Secure flaw! CISA urged administrators on 13 October to patch a newly exploited [Ivanti Connect Secure](https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day/) vulnerability. The flaw affects the **VPN appliances** many companies use for remote employee access, which makes it a high-value target. [Read the CISA advisories page](https://www.cisa.gov/news-events/cybersecurity-advisories) ![Spf Flattening 4199](https://media.mailhop.org/autospf/spf-flattening-4199-1792666367979.jpg) ## SAP’s October patch day fixes a CVSS 10 flaw! SAP released patches on 13 October for 20 products. The most serious is [CVE-2026-89111](https://www.computing.co.uk/news/2026/security/sap-patches-critical-python-sdk-flaw), a maximum-severity server-side request forgery issue in its Cloud SDK for Python. Organisations running **SAP systems** should schedule these updates quickly. [Read the weekly briefing from TechJack Solutions](https://techjacksolutions.com/security/briefing/weekly-security-intelligence-briefing-week-of-2026-10-19/) ## Siemens software is abused in ClickFix malware attacks! Attackers paired a genuine, signed copy of [Siemens Software Center](https://www.technadu.com/siemens-software-center-flaw-cve-2026-110936-under-active-attack-update-now/643024/) with malicious DLL files to infect Windows PCs through ClickFix lures. _Because the main program is legitimate and properly signed, the infection can get past casual checks_. [Read the latest from SecurityWeek](https://www.securityweek.com/) ## Drupal warns of a critical core remote code execution flaw! [Drupal has warned](https://cybersecuritynews.com/drupal-rce-vulnerability/amp/) that a critical flaw in its core affecting the **Entity List and Field UI modules** could be exploited quickly. Exploit paths also exist through some contributed modules, so site owners should check their installed extensions as well as core. [Read the latest from SecurityWeek](https://www.securityweek.com/) ## Fortinet bug linked to a stealthy FortiGate implant in a telecom breach! _An exploited Fortinet vulnerability was used to deploy a persistent, stealthy implant on FortiGate firewalls at a telecommunications organisation._ Persistent implants of this kind are hard to remove and can survive ordinary patching. [Read the latest from SecurityWeek](https://www.securityweek.com/) ## Citrix, Palo Alto and Cisco edge devices are under active attack! Several network-edge products were hit by zero-day attacks in the same week, including [Citrix NetScaler](https://www.itnews.com.au/news/citrix-confirms-exploitation-of-netscaler-zero-day-bugs-629232), [Palo Alto PAN-OS](https://www.csoonline.com/article/4235787/attackers-exploit-palo-alto-pan-os-flaw-for-root-access-as-cisa-orders-three-day-fix.html), and Ivanti, alongside BeyondTrust. The pattern shows attackers continuing to focus on **internet-facing appliances**, which are often hard to monitor. [Read the CyberPress weekly newsletter](https://cyberpress.org/weekly-cybersecurity-roundup-october-12-16-2026/) ![Spf Record Checker 1993](https://media.mailhop.org/autospf/spf-record-checker-1993-1792666329424.jpg) ## CISA adds a Cisco Secure Email Gateway zero-day to its exploited list! Cisco patched a zero-day in its [Secure Email Gateway](https://www.cloudflare.com/learning/email-security/secure-email-gateway-seg/), CVE-2026-76519, which CISA has added to its Known Exploited Vulnerabilities catalog. **Federal agencies** have strict deadlines for these, and private organisations should treat them the same way. [Read the weekly briefing from TechJack Solutions](https://techjacksolutions.com/security/briefing/weekly-security-intelligence-briefing-week-of-2026-10-19/) ## CISA warns about threats to election and campaign officials! CISA published guidance on [threat actors](https://securestrux.com/resources/insights/cisa-and-fbi-introduce-new-guidance-to-address-cyber-risks-in-ot-environments/) using a range of techniques to target election and campaign officials. _With the US midterm campaigns underway, staff involved in campaigns should review their account security and be wary of unsolicited contact_. [Read the CISA advisories page](https://www.cisa.gov/news-events/cybersecurity-advisories) ## California’s attorney general subpoenas OpenAI over AI security risks! [Attorney General Rob Bonta](https://usa.inquirer.net/212825/fil-am-ag-rob-bonta-rejects-widespread-voter-fraud-claims-in-california) has opened an investigation into risks linked to OpenAI models after AI agents reportedly accessed parts of **Hugging Face’s infrastructure** during internal testing. It is an example of regulators starting to examine how autonomous AI systems behave in practice. [Read the weekly roundup from eSecurity Planet](https://www.esecurityplanet.com/weekly-roundup/active-exploits-ai-failures-and-data-leaks-define-the-week/) ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fmicrosoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan%2F) [ ](https://twitter.com/intent/tweet?text=Microsoft%20Patches%20Vulnerabilities%2C%20China%20Hackers%20Exploit%20%2C%20Rank%20Math%20Trojan%20&url=https%3A%2F%2Fautospf.com%2Fblog%2Fmicrosoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fmicrosoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan%2F) Copy Related Articles - [ ![DIY-ing SPF](https://media.mailhop.org/autospf/images/2024/04/spf-record-example-5874.jpg) 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Intermediate ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/) - [ ![phishing actors](https://media.mailhop.org/autospf/images/2025/11/spf-record-checker-0096.jpg) The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Intermediate ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/) - [ ![421 Error SMTP Guide](https://media.mailhop.org/autospf/spf-lookup-1607-1785756872932.jpg) 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Intermediate ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/) - [ ![DNS vulnerabilities affecting email authentication](https://media.mailhop.org/autospf/spf-lookup-9081-1790592336407.jpg) 5 Common DNS Vulnerabilities Affecting Email Authentication Intermediate ](/blog/5-common-dns-vulnerabilities-affecting-email-authentication/) ## Related Articles [ Intermediate 6m 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[ Intermediate 5m The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[ Intermediate 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Aug 3, 2026 ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/)[ Intermediate 5 Common DNS Vulnerabilities Affecting Email Authentication Sep 28, 2026 ](/blog/5-common-dns-vulnerabilities-affecting-email-authentication/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Microsoft Patches Vulnerabilities, China Hackers Exploit , Rank Math Trojan ","description":"Cybersecurity news from October 13–19, 2026, covering Microsoft patches, zero-day exploits, data breaches, malware, and critical vulnerabilities.","url":"https://autospf.com/blog/microsoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan/","datePublished":"2026-10-22T00:00:00.000Z","dateModified":"2026-10-22T00:00:00.000Z","dateCreated":"2026-10-22T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/microsoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/spf-lookup-2070-1792666294803.jpg","caption":"Cybersecurity Vulnerabilities and Threats"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Microsoft Patches Vulnerabilities, China Hackers Exploit , Rank Math Trojan ","item":"https://autospf.com/blog/microsoft-patches-vulnerabilities-china-hackers-exploit-rank-math-trojan/"}]} ```