Microsoft Ships a Record 1,400 Fixes and Cuts Off Windows 11 24H2, the FBI Arrests an OpenAI Employee for Bugging a Boardroom, and Character.AI Files for Bankruptcy
By Noah Smith, Owner & Consultant, KeyChange Technologies · October 14, 2026
Your Wednesday AI and IT news recap covers Tuesday, October 13 into Wednesday, October 14, 2026. Microsoft's monthly update day was a record breaker with an attack already in progress, the FBI arrested an OpenAI employee for allegedly bugging an executive conference room, and Character.AI filed for bankruptcy. Here is what matters for your business.
📌 The AI and IT news at a glance
- Microsoft ships a record 1,400+ fixes, one already under attack, and ends updates for Windows 11 24H2 Home and Pro.
- The FBI arrests an OpenAI employee accused of hiding a recording device in an executive conference room.
- Character.AI files for Chapter 11 bankruptcy, with Disney bidding $20 million for some of its assets.
- A judge orders OpenAI to hand over hiring records in Apple's trade secrets lawsuit.
- Meta says hackers used one employee's stolen login to take code and personal data on about 1,500 people from GitHub.
- The Justice Department says North Korean fake IT workers earned $3 million from about 70 US companies.
- A cyberattack knocks out systems at UK fashion brands Hobbs, Whistles and Phase Eight.
- Norway fines Microsoft's former ad unit Xandr a record €8.6 million over Grindr user data.
- A power outage scrambles ticket counters and delays flights at Austin's airport.
- Google Play now lets you run private, vibe-coded apps built just for you.
- Elon Musk's SpaceXSI bundles X Premium, Grok and Cursor into one subscription.
- Google starts rolling out reusable "skills" in the Gemini app, but delays them in Workspace.
🔝 Top story
Microsoft ships a record 1,400+ fixes, one already under attack, and ends updates for Windows 11 24H2 Home and Pro
Microsoft's October Patch Tuesday landed on October 13 with more than 1,400 security fixes across about 300 products, the largest monthly release the company has ever shipped and the second month in a row to set that record. BleepingComputer counted 1,411 flaws and Tenable counted 1,407; either way, around 70 are rated Critical. Microsoft Excel alone accounted for 69 of them, which matters because Excel files are one of the most common things people open from email.
The one to act on first is CVE-2026-96951, a Windows Shell flaw that Microsoft says attackers were already exploiting before the fix existed. It lets a booby-trapped file slip past "Mark of the Web," the Windows feature that flags downloaded files and triggers those "are you sure you want to open this?" warnings. In practice, an attacker emails or messages someone a file, and Windows fails to treat it as suspicious. On the same day, Windows 11 version 24H2 Home and Pro reached end of support: Microsoft says the October update is the last one those editions will get. Microsoft's answer is to move to Windows 11 26H2, which is rolling out in phases now. Enterprise and Education editions of 24H2 are supported until October 12, 2027.
In short: Microsoft fixed a record 1,400-plus security flaws, including one Windows bug already used in attacks, and stopped updating Windows 11 24H2 Home and Pro.
What it means for your business: Every Windows PC in your office needs this month's update installed and a restart, and any machine on 24H2 Home or Pro needs to move to 26H2, or it stops getting security fixes from here on.
My take: Ignore the headline number; nobody can triage 1,400 bugs by hand, and you do not need to. What you need is two simple checks this week: are your updates installing automatically and actually finishing with a restart, and which version of Windows is each machine on? Small offices often buy laptops with Windows 11 Pro and never think about the version again, so 24H2 is probably more common in your building than you would guess. The exploited bug is also a nice reminder that the "this file came from the internet" warning is a safety net, not a guarantee. Unexpected attachments still deserve a phone call.
Source: BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days and BleepingComputer: Windows 11 24H2 Home and Pro reached end of support
🤖 AI
The FBI arrests an OpenAI employee accused of bugging an executive conference room
Federal prosecutors charged Abdulrahman Alfozan, a Saudi national who joined OpenAI's product team in July 2025, with using an electronic device to intercept oral communications. According to prosecutors, a recording device was plugged into a USB port on the back of a television in an executive conference room at OpenAI's San Francisco office. OpenAI found it, placed a camera on the spot, and the camera allegedly recorded Alfozan looking behind the TV. He was fired and arrested on October 9, about a week after the device was found, and faces up to five years in prison if convicted.
OpenAI described the device as "sophisticated," with encryption, audio monitoring and a way of sending data out designed to avoid detection, and said it had "no indications" he accessed or took model weights. FBI Director Kash Patel said the scheme was meant to capture sensitive conversations about OpenAI's "super intelligence technology," but the purpose has not been established in court, and neither Alfozan nor his lawyer could be reached for comment.
In short: An OpenAI employee was arrested and charged after a hidden recording device was found behind a TV in an executive meeting room.
What it means for your business: The most valuable thing in many companies is what gets said in the conference room, and the threat can be someone who already has a badge.
My take: You are not OpenAI, and nobody is flying in spies for your quarterly planning meeting. But the lesson scales down nicely. Conference room TVs, speakerphones and "smart" displays all have USB ports and microphones, and almost nobody ever looks behind them. Also notice how OpenAI caught it: they did not panic or confront anyone, they quietly put a camera on the spot and waited. That is a calm, effective playbook if you ever suspect an insider.
Character.AI files for bankruptcy, and Disney bids $20 million for some of its assets
Character.AI, the chatbot app where people talk with AI personas and that had 20 million monthly users by late 2024, has filed for Chapter 11 bankruptcy, TechCrunch reported on October 13. A court filing puts its assets and liabilities each in the $50 million to $100 million range. CEO Colin Adams cited "significant legal, regulatory, and operational headwinds": the company faced lawsuits, including one from the mother of a 14-year-old Florida boy who died by suicide, a Texas investigation over child safety, and struggled to make money after Google paid $2.7 billion in 2024 to license its models and hire back its founders.
Disney has agreed to buy some assets for $20 million plus a non-exclusive license to the technology, though higher bids are still possible, and the sale is expected to close in late November or early December. The app keeps running for now, but Adams said "the platform will be wound down" if no workable bid emerges.
In short: Character.AI filed for Chapter 11, with Disney lined up to buy some of its assets for $20 million and the service at risk of shutting down.
What it means for your business: AI startups can disappear fast, even popular ones, so any AI tool your business depends on needs an exit plan for your data.
My take: A company that was worth billions on paper two years ago is now selling assets for $20 million. That is the AI market in one sentence: huge usage is not the same as a working business. Before you build a workflow around a smaller AI vendor, ask two questions: can I export my data and prompts in a usable form, and what is my plan B if they vanish in 60 days? It is the same advice I would give about any software vendor; AI just makes the timeline shorter.
Source: TechCrunch: Just 5 years in, interactive chatbot platform Character.AI files for bankruptcy
A judge orders OpenAI to hand over hiring records in Apple's trade secrets lawsuit
US District Judge Edward Davila granted Apple fast-tracked access to OpenAI's interview materials from its interviews with former Apple employees who applied for hardware and robotics roles. OpenAI must turn over materials it has already gathered within five days and other related records within 14 days. That can include interview checklists, scripts, technical presentations and records showing where interviews referenced Apple technology. Apple can also see private LINE messages between people named in the case, and the judge approved depositions of OpenAI employees Chang Liu and Alyssa Peng and of OpenAI's chief hardware officer, Tang Yew Tan, all three former Apple employees.
The judge did not give Apple everything: he denied quick access to OpenAI's research in specific areas such as metal finishes and power management, while leaving the door open for narrower requests. Apple filed the suit in July, alleging former employees downloaded confidential files and that ex-Apple staff at OpenAI coached candidates on what to bring to interviews.
In short: A federal judge ordered OpenAI to quickly produce hiring and interview records in Apple's trade secrets case over former Apple employees.
What it means for your business: When you hire from a competitor, what they bring with them, and what your interviewers ask for, can end up in front of a judge.
My take: These are allegations, and OpenAI has not lost anything yet. But the practical lesson is for anyone who hires experienced people: tell candidates in writing not to bring files from their old job, and train interviewers not to ask for them. It costs nothing and is the kind of paper trail you will be glad to have if a former employer ever comes calling.
Source: TechCrunch: Judge orders OpenAI to turn over hiring records in Apple trade secrets case
🛡️ IT and security
Meta says hackers used one employee's stolen login to take code and personal data on about 1,500 people
Meta began notifying about 1,500 people, mostly its own US employees, on October 13 that their personal information was taken when an outside group got into some of its GitHub code repositories using one employee's stolen credentials. Meta says 99% of what was taken was business data, mainly source code for some products. The other 1% was personal data that had been saved in the repositories by mistake, against company policy, and a big share of what looked like personal data was actually fake test data.
Meta said "this was not a vulnerability in any Meta product, and Meta's internal systems were not breached." It cut off the attackers, brought in GitHub and law enforcement, changed the passwords and keys stored in those repositories, and is adding scanning to catch personal data uploaded by mistake. Affected people are being offered credit and dark web monitoring, and Meta does not believe the attackers were specifically after its data.
In short: Hackers used a stolen Meta employee login to copy code and some personal data from Meta's GitHub repositories, affecting about 1,500 people.
What it means for your business: One reused or stolen password can open the door to your cloud accounts, and customer data has a way of ending up in places it was never supposed to be.
My take: Two takeaways, and neither requires a security team. First, every cloud account your business uses, including whatever your web developer uses to store your site's code, needs multi-factor login, ideally passkeys or an app, not text messages. Second, find out where copies of customer data live. Meta's leak happened because personal data sat in a place meant for code. In a small business, that is the spreadsheet on someone's personal Dropbox or the export emailed "just this once."
Source: SecurityWeek: Meta says hackers took code, personal data of 1,500 in GitHub breach
The Justice Department says North Korean fake IT workers earned $3 million from about 70 US companies
The Justice Department announced on October 13 that it arrested two US men, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, and charged them with wire fraud, money laundering and identity theft after raiding more than 40 homes across Texas in late September and seizing 187 laptops. Prosecutors say the pair ran "laptop farms" from 2019 to 2026: they kept company-issued laptops in their homes so North Korean workers, hired remotely under fake or stolen identities, appeared to be working from inside the US. Several Chinese and North Korean nationals were also indicted.
The scheme earned more than $3 million from about 70 US companies in 17 states, including healthcare, cybersecurity, retail and manufacturing firms. The FBI says North Korea "continues to deploy remote IT workers using stolen identities to infiltrate American companies," and is now subcontracting work to freelancers in South Asia and West Africa and recruiting low-income Americans to host laptops.
In short: Federal prosecutors charged two Americans with hosting laptops that let North Korean workers pose as US-based remote employees at about 70 companies.
What it means for your business: If you hire remote contractors or developers you have never met in person, you could be paying a sanctioned government without knowing it.
My take: This is not just a big-company problem; small firms that hire remote developers off freelance sites are a favorite target because their checks are lighter. Cheap defenses: do at least one live video call with the camera on, ship equipment only to an address that matches verified ID, and be suspicious of a candidate whose shipping address keeps changing or who pushes to be paid somewhere unusual. If something feels off, it is fine to slow down the hire.
A cyberattack knocks out systems at UK fashion brands Hobbs, Whistles and Phase Eight
TFG London, the UK arm of South Africa's Foschini Group, said it detected a cyberattack on October 11 that hit the IT systems behind its Phase Eight, Hobbs and Whistles brands, and disclosed it on October 13. Websites went down and back-office functions like order processing and stock visibility were affected, though the company said "physical stores remain open for customers." Its other brands, The Inside Story and White Stuff, and its operations in Australia and Africa were not affected.
TFG London says it activated its incident response and business continuity plans and brought in outside experts. It has not confirmed whether customer data was taken and says it will notify people if so, and no hacking group has claimed the attack. It lands in a rough few weeks for UK retail, after ASOS confirmed a customer data breach and H&M said it found no sign of compromise after online claims it had been targeted.
In short: A cyberattack disrupted websites and back-office systems at TFG London's Hobbs, Whistles and Phase Eight brands, while stores stayed open.
What it means for your business: "Stores open, website down" is the classic shape of a modern cyberattack, so it is worth knowing how you would sell and fulfill orders with your main systems dark.
My take: The detail I like here is that the company had business continuity plans ready to activate. That is the difference between a bad week and a lost quarter. If you are a customer of these brands, expect phishing emails that mention your orders, and be extra careful with any "refund" or "update your payment details" message. If you run a shop, write down, on paper, how you would take payments and track orders for three days without your main system.
Source: BleepingComputer: TFG London cyberattack disrupts systems at Hobbs and Whistles retailers
Norway fines Microsoft's former ad unit Xandr a record €8.6 million over Grindr user data
Norway's Data Protection Authority fined Xandr €8.6 million (about $9.6 million), the largest penalty it has ever issued, for passing Grindr users' personal data, including data that revealed their sexual orientation, to potentially thousands of companies through real-time ad bidding. The regulator found Xandr was jointly responsible with Grindr for getting users' consent, and that Xandr simply assumed Grindr had done it. The violations ran from July 2018 to April 2020, after a 2020 complaint from Norway's consumer council and the privacy group noyb.
Microsoft bought Xandr in late 2021 and folded the brand into Microsoft Ads in 2023. Microsoft says it is reviewing the decision and assessing its options, and Xandr has three weeks to appeal.
In short: Norway fined Microsoft-owned Xandr a record €8.6 million for sharing Grindr users' sensitive data through ad auctions without proper consent.
What it means for your business: "We assumed our partner handled consent" is not a defense; if you receive or pass along customer data, regulators can hold you responsible for it too.
My take: The number is small for Microsoft, but the principle is what matters. Plenty of small businesses run marketing pixels, ad tags and data-sharing integrations they set up years ago and never revisited. Once a year, list every outside service that receives your customers' data and confirm you actually have permission to share it. Six years from violation to fine is also a reminder that these bills arrive long after the decision that caused them.
A power outage scrambles ticket counters and delays flights at Austin's airport
A partial power outage that began around 5:18 p.m. on Tuesday, October 13 hit parts of the Barbara Jordan Terminal at Austin-Bergstrom International Airport, taking down systems including airline ticket counters. Airlines adjusted arrival and departure schedules and many flights were delayed, though officials were not aware of cancellations at the time. TSA screening and baggage claim kept working.
Most affected systems started coming back around 6:40 p.m., and airport officials said at 8:08 p.m. that power had been restored across the airport. The cause is under investigation.
In short: A partial power outage at Austin's airport knocked out ticket counter systems and delayed flights for about three hours on Tuesday evening.
What it means for your business: Most "IT outages" are really power, cooling or network outages, so your continuity plan should start with the building, not the software.
My take: Notice what kept running: screening and baggage claim. Somebody decided those systems were critical and protected them. Do the same exercise for your office: which two or three things absolutely must work if the power drops, and are they on a battery backup that has actually been tested this year? A $150 UPS on the internet router and the payment terminal buys a surprising amount of calm.
Source: CBS Austin: Flights delayed at Austin airport as crews work to restore power following outage
🧰 New tools for builders and business AI
Google Play now lets you run private, vibe-coded apps built just for you
Google announced on October 13 that people can build an app by describing it to AI in Google AI Studio and then run it on their own Android phone through Google Play, without publishing it to the public store. These personal apps use your regular Google account, do not show up in Play search, and are not shared with anyone else. Google's Sam Bright framed it as moving from "there's an app for that" to "there's an app for me."
It is available first to US users 18 and older, and apps still have to follow Play's normal policies. In the coming months, Google plans to let you share personal apps with a small trusted group such as family, and to let popular ones move to the public store after review.
In short: Google Play now lets US adults run private apps they built with AI in Google AI Studio on their own Android devices.
What it means for your business: A simple internal tool, such as a job checklist or a pricing calculator, can now live on an Android phone without a developer or a public app listing.
My take: This is a nice, low-risk way to try "build your own tool." Start with something that does not touch customer data, like an inspection checklist or a quote calculator. The sharing feature, when it arrives, is the part to watch for small teams. Until then, treat it as a personal productivity experiment, not a company system.
Source: TechCrunch: Google Play now supports private, vibe-coded apps built just for you
Elon Musk's SpaceXSI bundles X Premium, Grok and Cursor into one subscription
SpaceX Super Intelligence (SpaceXSI) launched "The X Subscription," a single plan that combines X Premium, the Grok chatbot and agent, and the Cursor AI coding tool. It comes in five tiers: Free, Plus at $8 a month, Premium at $30, Super at $100 and Ultra at $200, with AI usage limits rising at each level. The latest Grok models require Premium or above.
Existing X Premium+ subscribers can keep their current plan or upgrade, and the company says the comparable new tier costs the same or less. The upgrade option is rolling out gradually.
In short: SpaceXSI combined X Premium, Grok and Cursor into one subscription with tiers from free to $200 a month.
What it means for your business: If your developers already pay for Cursor, compare the bundle pricing, but read the usage limits before switching anyone.
My take: Bundles are how AI companies are fighting for your monthly budget now, and that is good for buyers who shop around. Just remember that a bundle ties several tools to one account and one company's policies. For a business, I would rather pay separately for the coding tool my team relies on than save a few dollars and lose flexibility.
Source: TechCrunch: SpaceXSI bundles X Premium, Grok and Cursor into one subscription
Google starts rolling out reusable "skills" in the Gemini app, but delays them in Workspace
Google said on October 13 that skills in the Gemini app, which let you save a reusable set of instructions for tasks you do often, began a gradual rollout that should finish by mid-November. They are available to all Google Workspace customers and personal Google accounts. The separate Workspace skills feature, which was due to finish rolling out to Rapid Release domains by October 12, has been "delayed until further notice."
Google says sharing Gemini app skills and a Google Drive integration are coming in the next few weeks. One detail for admins: there are no admin controls for Gemini app skills, while Workspace skills will be manageable by admins and limited to users over 18.
In short: Google began rolling out Gemini app skills to everyone, while pausing the admin-managed Workspace version indefinitely.
What it means for your business: Your staff may soon be able to create and, later, share saved AI routines in Gemini without any admin switch to control them.
My take: Reusable skills are one of the most practical AI features for small teams: write the instructions for "draft a customer follow-up the way we like it" once, and everyone gets consistent results. The missing admin controls are the catch. If you run Google Workspace, give your team a short note on what is and is not okay to put into a saved skill, especially once sharing arrives.
Source: Google Workspace Updates: An update on the launch of skills in the Gemini app and Workspace
🔁 Catch up
Missed yesterday? The Tuesday AI and IT news recap for October 13, 2026 covers the cyberattack that took Food Lion and Stop & Shop online ordering offline, the hackers who turned French supermarket freezers into ovens, and Meta's first frontier AI model.