Malwarebytes Labs Reviews Security Events From October 12 to October 18, 2026

Malwarebytes Labs published a weekly security review covering events from October 12 to October 18, 2026. The report highlights significant software patches from Google and Microsoft alongside emerging threats involving artificial intelligence and privacy violations. Security professionals can use this summary to track the most urgent developments in the threat landscape during that specific week.

Google addressed 37 security flaws in its Chrome browser during this period. According to the Malwarebytes Labs summary, seven of these bugs were rated as critical. Simultaneously, Microsoft issued a record number of patches in its regular Patch Tuesday update. The report notes that at least one of the Windows flaws is already being exploited in the wild, making immediate updates essential for system administrators.

Emerging AI and Privacy Threats

Artificial intelligence tools are presenting new risks to users and institutions. Malwarebytes Labs reports that Anthropic warned about AI worms that could spread across smart devices. Additionally, a police department received a fake murder tip generated by Anthropic’s Claude AI model. These incidents illustrate the potential for AI systems to generate harmful or deceptive content that impacts public safety and operational integrity.

Privacy concerns also dominated the news cycle. The Federal Trade Commission alleged that a sextortion help firm took $60 million from victims. In another case, Grindr users’ sensitive data was shared through ad auctions without valid consent. Furthermore, researchers found that a common password, 123456, was linked to nearly 9 million personal records, highlighting ongoing credential hygiene issues.

Device and Application Vulnerabilities

Hardware and application security remained a focus of the review. Malwarebytes Labs noted that the Eiliko robot companion exposes private chats and can be hijacked by attackers. In France, hackers targeted supermarket fridges, causing food to spoil across the country. These physical and digital breaches demonstrate how interconnected devices can be manipulated to cause tangible harm to consumers and businesses.

Phishing tactics are also evolving to target AI assistants and job seekers. Scammers created fake Calendly pages posing as Meta Careers to steal Facebook and Google logins. Meanwhile, phishing emails are now specifically baiting AI assistants. The report warns that spray-and-pray job applications could make it harder for individuals to spot employment scams, adding another layer of complexity to identity verification.

What should you do?

Organizations should prioritize applying the latest patches for Chrome and Windows immediately. Administrators must verify that systems are protected against known exploits, especially those already under attack. Users should review privacy settings on smart devices and social applications to limit data exposure. Monitoring for unusual activity on AI-powered tools and verifying the authenticity of job offers can help mitigate emerging social engineering risks.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe: Malwarebytes Labs

• Apply all available updates for Google Chrome and Microsoft Windows to address known critical vulnerabilities.
• Review privacy settings on smart home devices and social apps to prevent unauthorized data sharing.
• Verify the authenticity of job offers and links before entering credentials or personal information.
• Monitor AI assistant interactions for unusual requests or potential phishing attempts.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many Chrome bugs were fixed in the October 2026 update?

Google fixed 37 security flaws in Chrome, including seven critical bugs, during the week of October 12 to October 18, 2026.

Is the Windows flaw mentioned already being exploited?

Yes, Malwarebytes Labs reports that the Windows flaw addressed in the record Patch Tuesday update is already under attack.

What amount did the FTC allege the sextortion firm took?

The FTC alleges that the sextortion help firm took $60 million from victims.