This Week in Security (Oct. 12–18, 2026): Windows Zero-Day, Ledger Spy Chip & More

Quick answer

• Windows: install the October update now. It fixes an actively exploited zero-day, and Windows 11 24H2 Home and Pro just stopped getting updates.
• Ledger wallets: bought one from reseller CryptoBilis? Don’t set it up. Already did? Move your crypto to a new device with a new recovery phrase.
• Old NAS or camera recorders: attackers hijacked unpatched D-Link and Ubiquiti gear to resell owners’ internet bandwidth.
• Android: new scam protections for texts and calls are rolling out. Watch for the opt-in setting.
• Burger King Japan: 11.18 million app records exposed. Expect phishing if you used the app.

---

1. Microsoft’s record Patch Tuesday fixes an exploited Windows zero-day

What happened: Microsoft’s October 13 updates fixed a record 1,411 flaws, including one zero-day already being exploited in attacks: CVE-2026-96951, a Windows Shell bug that lets attackers slip past “Mark of the Web,” the warning you normally get before opening a downloaded file. (BleepingComputer, SecurityWeek)

The bigger deal for home users: Microsoft says Windows 11 version 24H2 Home and Pro reached end of updates on October 13, 2026. This month’s patch is the last one those editions get. (BleepingComputer, Microsoft release info)

Who’s affected: every Windows PC, and especially anyone still on 24H2 Home or Pro.

What to do:

• Go to Settings → Windows Update and install everything.
• Check your version under Settings → System → About. If it says 24H2, install the newer feature update Windows Update offers.
• Heads-up: Microsoft says that if you’d previously turned Smart App Control off, you may not be able to turn it back on after this update. PCs already running it stay protected. (BleepingComputer)

Extra layer: antivirus helps catch the malicious downloads this kind of bug is used for. → [AFFILIATE LINK PLACEHOLDER: Bitdefender] (We may earn a commission.)

2. Ledger confirms spy chips in wallets sold by one reseller

What happened: Ledger confirmed that some hardware wallets sold through CryptoBilis, a Southeast Asian reseller, had a hidden implant added inside the case. When the device showed its 24-word recovery phrase during setup, the implant read it off the screen and sent it to attackers over a cellular (LTE) connection. Ledger says its chip, software and servers were not hacked. This was tampering after the devices left its control. (Ledger, BleepingComputer)

Ledger hasn’t confirmed total losses. On-chain researchers estimated up to $93.2 million across 300+ wallets. (CoinDesk)

Who’s affected: people who bought Ledger devices from CryptoBilis. Researchers also found tampered units from third-party marketplace sellers. (BleepingComputer)

What to do:

• Bought from that reseller and haven’t set it up? Don’t.
• Already set it up? Ledger advises moving funds to a new device with a new recovery phrase.
• Everyone: buy security hardware direct from the maker or an authorized retailer, never from a “half-price” marketplace listing.

3. Hackers hijack old D-Link and Ubiquiti devices to sell your bandwidth

What happened: GreyNoise found a “proxyjacking” campaign that broke into at least 143 devices in 34 countries. The attackers installed a bandwidth-sharing app without permission, so strangers’ traffic ran through victims’ internet connections and the attacker collected the payouts. (BleepingComputer, GreyNoise)

Who’s affected: owners of D-Link ShareCenter NAS boxes and Ubiquiti UniFi Video recorders with old, known flaws. Hikvision and Dahua recorders were also targeted. (GreyNoise)

What to do:

• Unplug or replace old network storage and camera recorders that no longer get updates.
• Don’t expose them to the internet. Turn off remote access you don’t use.
• Update the firmware on your router and anything else that’s always on.

4. Android adds new AI scam protections for texts and calls

What happened: On October 14, Google announced new scam defenses: an opt-in Enhanced protection mode in Google Messages that checks suspicious chats and unfamiliar links, scam alerts in chat-app notifications on more phones, and safeguards against call-forwarding and screen-sharing tricks. Enhanced protection rolls out “in the coming weeks.” (Google, The Verge)

Who’s affected: Android users. Features arrive gradually and vary by device.

What to do:

• Keep Google Messages and your phone updated.
• When Enhanced protection appears in Messages settings, consider turning it on.
• Rule of thumb that never changes: if someone asks you to forward calls, share your screen or “verify” a code, hang up.

5. Burger King Japan app breach exposes 11.18 million records

What happened: Burger King’s Japanese operator said attackers accessed the system behind its official app between October 2 and 7, exposing about 11.18 million member records: names, emails, phone numbers, birth dates and more. It says credit card numbers weren’t stored there, and it hasn’t confirmed any password leak. (BleepingComputer, Kyodo News)

Who’s affected: users of Burger King Japan’s app.

What to do: expect convincing phishing that uses your real name and birthday. Don’t click links in “Burger King” emails or texts. And if you reused that password anywhere, change it.

---

This week’s 5-minute checklist

• ☐ Windows Update installed, and you’re off 24H2 if you use Home or Pro
• ☐ Phone and apps updated
• ☐ Old NAS or camera recorders unplugged or updated
• ☐ No reused passwords on shopping and food apps
• ☐ 2FA on for email and banking. → How to turn on 2FA everywhere

Stop reusing passwords for good: a password manager makes a unique one for every app. → [AFFILIATE LINK PLACEHOLDER: 1Password] (We may earn a commission.)

On public Wi-Fi a lot? A VPN encrypts your traffic on networks you don’t control. → [AFFILIATE LINK PLACEHOLDER: NordVPN] (We may earn a commission.)

Covers news from October 12–18, 2026. Details can change as investigations continue, so check the linked sources for the latest.