BTH News: October 16, 2026
Microsoft sets a Patch Tuesday record, the FBI raids North Korean laptop farms in Texas, cryptocurrency hardware wallets get some unwanted modifications, and an OpenAI employee faces charges over an alleged listening device. Here's what caught my attention in cybersecurity this week.
Microsoft Fixes More Than 1,400 Vulnerabilities. Now What?
Remember when Patch Tuesday meant a manageable collection of security updates?
Microsoft released fixes for more than 1,400 vulnerabilities this week, setting a new record. BleepingComputer counted 1,411 vulnerabilities, while CrowdStrike reported 1,413. Both reported three zero-days, including one that was already being exploited.
That's a lot of vulnerabilities. And an awful lot of work for the people responsible for keeping systems patched.
But I think the more interesting question is what organizations are supposed to do with all this information.
I've written about this before in How to Prioritize Vulnerability Remediation (Without Losing Your Mind). My position hasn't changed. Organizations need to stop treating CVSS scores as their primary patching strategy.
A critical vulnerability on an isolated system isn't necessarily a greater risk than a medium-severity vulnerability on an Internet-facing server that's actively being exploited.
And with AI accelerating vulnerability discovery, the problem is only getting bigger.
In The Mythos Discovery, I discussed how AI is challenging traditional vulnerability disclosure and remediation processes. Microsoft's latest Patch Tuesday is another reminder that the volume of vulnerabilities is becoming difficult to manage using traditional approaches.
The answer isn't simply to patch everything faster. Organizations need to understand what's exposed, what's being exploited, and what presents the greatest risk to their business.
As I've said before, attackers follow opportunity, not scoring systems.
Read more: CrowdStrike's October 2026 Patch Tuesday analysis and BleepingComputer's coverage.
The FBI Raids North Korean Laptop Farms in Texas
When you hear about federal agents raiding more than 40 locations in Texas, you probably don't picture them searching for laptops.
But that's exactly what happened.
On October 13, the Department of Justice announced an operation targeting networks that allegedly helped North Korean IT workers obtain remote jobs at American companies.
From September 21 through September 25, FBI agents searched more than 40 residences across Texas and seized approximately 187 laptops and KVM devices. The broader enforcement action involved more than 70 U.S. companies, and authorities also announced charges and two arrests.
The scheme was surprisingly elaborate.
According to investigators, North Korean workers used stolen or fabricated identities to get hired for remote positions. Their American accomplices allegedly received company-issued laptops, kept them running in U.S. homes, and installed remote-access software so the workers could connect from overseas.
The companies thought they had hired American-based employees. In reality, they may have been providing North Korean operatives with access to corporate systems.
I've covered this threat before in The Spy Who Applied to Code, which examined a fraudulent job applicant who tried to get hired by cryptocurrency exchange Kraken.
What’s particularly interesting is the scale of the infrastructure supporting the deception: 187 laptops and KVM devices in more than 40 American homes, all allegedly helping North Korean workers pose as employees of American companies.
It's one thing to falsify a résumé or use a VPN. It's another to establish an entire network of computers inside American homes to make the deception more convincing.
Remote work isn't the problem. The problem is assuming that a computer's physical location tells you who's actually operating it. IT and HR departments need to work closely together to properly screen applicants and put controls in place so company assets and access are only granted to vetted, authorized personnel.
Read more: U.S. Department of Justice announcement.
Someone Put a Spy Chip in a Cryptocurrency Wallet
Cryptocurrency hardware wallets often look like a thumb drive, a USB device, or a small smartphone. They are used to keep the private keys for cryptocurrency, such as Bitcoin, offline instead of on a computer. That is generally considered a more secure way to protect it.
But what happens when someone modifies the hardware before you buy it?
Ledger, a French cryptocurrency hardware-wallet company, says criminals purchased genuine devices, opened them, installed malicious components, and then resold them to unsuspecting buyers through resellers in Southeast Asia.
When buyers entered the recovery phrases used to access their cryptocurrency, the malicious components captured those phrases. That gave the attackers what they needed to access and drain the wallets.
This is a little like purchasing a second-hand laptop from someone. You have no idea what is on it. Did the previous owner accidentally, or purposefully, install malware? Did they make hardware changes that could give them remote access?
The company says the attack did not exploit a vulnerability in its chips, operating system, or servers. Instead, the devices were modified after leaving the company's control. Ledger characterizes the incident as a localized distribution attack rather than a systemic supply-chain compromise.
A perfectly secure product isn't much help if someone installs malicious components inside it before it reaches the customer.
Always be careful when purchasing technology, especially anything with Internet connectivity or access to valuable accounts. Buy from reputable sources. If you purchase products such as laptops or cryptocurrency wallets second-hand, understand that you may get more than you bargained for, and end up with less than you had.
Read more: Ledger's response to the hardware implant attack.
An OpenAI Employee, a Listening Device, and a Conference Room
What this guy allegedly did was pretty crazy.
According to the federal complaint, a chatbot account associated with an OpenAI employee’s wife was used to ask how to build, customize, conceal, and remotely access an audio recorder.
An OpenAI engineer was arrested on October 9 after investigators alleged that he placed a concealed recording device in an executive conference room at the company's San Francisco offices.
According to the federal complaint, OpenAI personnel discovered the device on September 30. Investigators allege that surveillance footage and other evidence subsequently linked an employee to the device. OpenAI says it has no indication that model weights, source code, or customer data were improperly accessed or exfiltrated.
The employee has been charged with using or endeavoring to use a device to intercept oral communications. He has not been charged with espionage, and the allegations have not been proven in court.
The device was plugged into a USB port behind a television in an OpenAI executive conference room. For some reason, it was wrapped in toilet paper. Did he think that made it look less suspicious? Its contents were also encrypted.
OpenAI security personnel found the device during a sweep. CCTV footage later showed the employee near the executive conference room on multiple dates and, on October 5, looking behind the television where the device had been placed.
Organizations spend enormous amounts of money protecting their networks, applications, and data. Yet sensitive information is also discussed in conference rooms, displayed on monitors, and shared in conversations.
Physical security and insider threats remain important parts of information security.
You can have excellent firewalls, endpoint protection, and multifactor authentication. None of those controls will stop someone from placing a microphone in the wrong room.
Cybersecurity has never been just about hackers.
Read more: U.S. Department of Justice announcement.
BTH News is a roundup of interesting cybersecurity stories, technology developments, and occasional oddities from around the world. Thanks for reading!
Enjoyed this article?
Subscribe to Between The Hacks for practical cybersecurity, real-world stories, and fresh perspectives on the technologies shaping our digital future.
