Windows update enforces blocking of NTLMv1-derived sign-on credentials

Independent

The October 13 security update changes the default from Audit to Enforce on affected Windows versions when Credential Guard is disabled and BlockNtlmv1SSO is unset. Requests for NTLMv1-derived single sign-on credentials are then blocked; the update does not write the registry value.

Why it matters: Enterprises with dependent MS-CHAPv2 configurations can lose automatic Wi-Fi, Ethernet or VPN authentication after patching. The consequence is conditional authentication disruption, rather than a general networking defect.

Decision: Where audit events identify a critical dependency that cannot immediately migrate, weigh a scoped, temporary Audit-mode exception against the reduced credential protection.

What remains uncertain: Microsoft's supplied support page names BlockNtlmv1SSO, unlike the article's BlockNtlmSSO. It includes October 19 revisions, so not all wording can be treated as available on October 17. The article's named expiry of the override is speculative; the later supplied introduction says there are no current removal plans.

Read: Reported article: Networking problems after the October 2026 Windows update? NTLM might be to blame; Primary source: Manage NTLMv1 changes and prevent network authentication issues in Windows | Microsoft Support; Primary source: The evolution of Windows authentication | Windows IT Pro Blog

Spyware-linked advertising reaches sensitive Australian networks

Independent

Citizen Lab's investigation, as reported by iTnews, identified Discover-Tech advertising impressions on Australian government, research, power and media networks, including ANSTO. Researchers linked its advertising infrastructure to device profiling and selective spyware delivery.

Why it matters: The reported mechanism exposes device and network information through advertising auctions, then lets loaded ads contact operator servers for additional code without a click. For security leaders, browser-only protection leaves a relevant exposure: approximately 76.7 percent of Discover-Tech's bids concerned mobile-app advertising, which browser ad blockers do not protect.

Decision: For organisations relying on browser ad blocking, extend the scope of advertising-protection assessment to mobile apps.

What remains uncertain: An impression does not establish targeting or infection. ANSTO reported no identified impact. Confiant did not include Australia among nine countries where it observed handoffs to Candiru systems. The underlying research reports were not supplied; Citizen Lab's dataset covered only part of the activity over a limited period.

Read: Reported article: Australian gov, media networks reached by Israeli firm's spy ads - iTnews

No linked primary source could be read; claims rely on the reporting above.

Shopify extension compromises redirect shoppers; WAGD remains closed

Independent

Logbase said unauthorised access to an internal Selleasy tool enabled malicious scripts in store settings on October 13. HulkApps disclosed a similar extension compromise. In reporting available by October 17, WAGD remained closed on Shopify's advice after a customer encountered a bogus checkout.

Why it matters: In the HulkApps case documented by Roman Zipp, remotely supplied JavaScript intercepted checkout clicks and redirected shoppers to lookalike payment pages. WAGD illustrates a separate operational consequence: its owner reported continued closure despite confirmation of code removal. Removing the script had not, at that point, secured permission to resume trading.

Decision: Affected merchants should seek explicit reopening criteria from Shopify alongside code-removal confirmation, because the reported WAGD case shows those were separate milestones.

What remains uncertain: The supplied article does not establish customer data loss or a shared root cause across vendors. Logbase did not disclose affected-store totals; WAGD's losses were uncalculated. Logbase said some browsers blocked redirection. The October 19 reopening update is excluded from this October 17 assessment.

Read: Reported article: Shopify tells Australian store to stay shut after hijacked extensions divert shoppers - iTnews

No linked primary source could be read; claims rely on the reporting above.