Last Week in Tech - Ivanti's Unpatched Chain, a Record 1,400-Fix Patch Tuesday, and the Essential Eight Gets a Successor

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

G'day and welcome to Last Week in Tech from Tech Talks with Kinsoft. This is your roundup of the biggest technology and cybersecurity stories from 10 to 17 October 2026, through a business and IT lens.

Ivanti Connect Secure zero-day. Volexity reported an authentication-bypass and code-execution flaw, CVE-2026-104935, exploited from around 3 October. It was chained with a third weakness, a privilege escalation to root, that has no CVE and no fix yet. Ivanti says a fix is due in the coming weeks, as of the end of last week.

A record Microsoft Patch Tuesday. Roughly 1,400 vulnerabilities fixed on 13 October, with experts pointing partly to AI-assisted discovery. We look at what that volume means for patching rhythm in a small team.

Cisco Secure Email Gateway. A flaw reported as exploited, with fixes that shipped a month before the advisory and no fix at all for the 16.0 release line.

ASD Essentials. The Australian Signals Directorate has launched the successor to the Essential Eight, moving away from the maturity-level ladder.

Ahold Delhaize. The retail group, with more than 9,400 stores, took systems offline after a security incident confirmed on 12 October. Cause and data impact are not yet known.

AI and the cost of fixing bugs. Bank of America's CEO described 1,000 contractors brought in to patch vulnerabilities surfaced by AI, and an Australian wealth firm has been penalised $1.35 million over cyber security failures.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Volexity; Rapid7; The Hacker News; Dark Reading; CSO Online; BleepingComputer; Cyber Daily; ITnews; CNBC via Benzinga and ITPro; ASIC media release 26-244MR.