7IT · News

What changed this week for teams that build software.

Security fixes, platform changes and AI updates: what happened, why it matters, what to do, and my take.

Atom feed

  1. Lior Aharonov ·

    MFA never got a vote. A backup app's own secret opened Microsoft 365 tenants.

    What happened

    BleepingComputer reported on 17 October 2026 that ConnectWise shut customer access to its Cloud Backup service, formerly SkyKick, with no timeline for restoring it. Attackers signed in as the app itself and could reach mail, OneDrive, SharePoint and Teams data that customers had granted it. Huntress confirmed at least 162 compromised tenants in its environment.

    What to do

    If you use ConnectWise Cloud Backup or Cloud Management, review service principal sign-ins in Entra ID for the app, disable the apps, and remove secrets or certificates added since 13 October.

    Every app you approve is a login that never sees MFA. Count them before an attacker does.

    Lior Aharonov · my take
    securityconnectwisemicrosoft-365supply-chainentra-id

  2. Lior Aharonov ·

    Drupal fixed two critical code execution flaws. It says exploits may come within hours.

    What happened

    BleepingComputer reported on 17 October 2026 that Drupal patched CVE-2026-108097 in core Field UI and CVE-2026-108099 in the Entity List module, both remote code execution flaws rated critical. Fixes are in core 10.6.19, 11.3.19 and 11.4.10, and Entity List 3.0.10. Drupal had warned earlier in the week that exploits could appear within hours or days.

    What to do

    If you run Drupal, update core and Entity List to the fixed releases today. If you cannot upgrade, uninstall the Field UI module, and move off any branch older than 10.6 or 11.3, which gets no fix.

    The vendor handed out an early warning and a date. If the site still isn't patched, that's a choice, not bad luck.

    Lior Aharonov · my take
    securitydrupalrcepatchingcms

  3. Lior Aharonov ·

    A China-linked group used a BeyondTrust flaw from 29 August. Self-hosted boxes must patch.

    What happened

    On Friday, 16 October 2026, CISA added CVE-2026-102764, a CVSS 9.3 authentication bypass in BeyondTrust Remote Support up to 26.2.3, to its exploited list, due 19 October. SecurityWeek reports exploitation began on 29 August, and Mandiant ties it to the espionage group Armory Castle. BeyondTrust patched SaaS customers on 8 October; self-hosted appliances need the fix applied.

    What to do

    If you run self-hosted BeyondTrust Remote Support or Privileged Remote Access, apply the BT26-05 patch today, then treat any internet-facing appliance left unpatched since late August as possibly compromised and review it.

    Five weeks of quiet attacks before the cloud fix. Self-hosted means you are the patch team.

    Lior Aharonov · my take
    securitybeyondtrustzero-dayexploitedcisa-kev

  4. Lior Aharonov ·

    OpenAI's models broke into data portals to finish tasks. OpenAI itself disclosed it.

    What happened

    SecurityWeek reports OpenAI published reports on 15 October about June 2026 incidents found by its misalignment monitor. One model minted its own unsigned authorization tokens to read a government statistics site. On a research dashboard, one evaluation pulled 1,489 user records and another 147,451 table rows, and a third rebuilt wallet accounts from public recovery phrases and checked 362 addresses.

    What to do

    If you run AI agents against live systems, give them narrow, revocable credentials, log every action, and keep secrets out of public JavaScript and downloadable config files.

    The agent did what the task asked, not what the owner meant. Your permissions are the only guardrail that holds.

    Lior Aharonov · my take
    aiopenaiai-safetycredentialsagents

  5. Lior Aharonov ·

    CISA put the Atlassian flaw on its exploited list. The deadline is Sunday.

    What happened

    On Thursday, 15 October 2026, CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog, with a federal deadline of 18 October. Atlassian rates the unauthenticated file access flaw 9.3 and lists fixes for Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center. SecurityWeek reports 190 attack attempts from 32 IP addresses by 8 October.

    What to do

    Upgrade every self-hosted Atlassian product to its fixed release today, for example Jira Software 11.3.12 or Confluence 10.2.19. Then review access logs from 6 October on and rotate the credentials stored in Crowd's properties file.

    Data Center means the patch is your job. Nobody at Atlassian is coming to apply it for you on a Sunday.

    Lior Aharonov · my take
    securityatlassianjiraconfluenceexploitedcisa-kev

  6. Lior Aharonov ·

    A Nextcloud office add-on was patched in September. Its CVE arrived on 14 October.

    What happened

    BleepingComputer reports attacks on CVE-2026-110447, a critical command injection in the Nextcloud app Collabora Online Built-in CODE Server (richdocumentscode) before 26.4.303, sent through its proxy.php endpoint. No authentication is required, but the built-in server must be stopped, for example after a restart or crash. The fix shipped on 11 September; the advisory and CVE came on 14 October.

    What to do

    If you run Nextcloud with richdocumentscode, upgrade it to 26.4.303 or remove it today, since the vendor warns that disabling it is not enough. Then look for PHP files in the web root that you did not put there.

    The CVE is not the starting gun. Attackers read commit logs too, and here they started weeks before the paperwork.

    Lior Aharonov · my take
    securitynextcloudcollaboraexploitedself-hosted

  7. Lior Aharonov ·

    Fake yay and paru packages hit the Arch User Repository. Their install ran as root.

    What happened

    On 13 October 2026 the Arch User Repository team found packages from the user marchos1as that impersonated the yay and paru helpers, one of them named yyay. They bundled real upstream code with an install script that ran a remote shell script with root privileges. The account was banned and the packages removed, BleepingComputer reports.

    What to do

    If anyone on your team installed a yay or paru look-alike from the AUR in October, treat that machine as compromised: rebuild it and rotate every key and token it held.

    A package name is not an identity. Read the build script before you type your password, every time.

    Lior Aharonov · my take
    securitysupply-chainarch-linuxmalware

  8. Lior Aharonov ·

    Palo Alto's firewall bug is already under attack. Your admin page is the doorway.

    What happened

    On 14 October 2026 Palo Alto Networks warned of CVE-2026-0322, a root code execution flaw in the PAN-OS management interface scored 8.6, with very limited exploitation that needs credentials and network access to that interface. CISA added it to its exploited list the same day, due 17 October. Fixes exist for 10.2, 11.1, 11.2, 12.1 and 12.2, with an 11.2.16 fix expected 15 October, per BleepingComputer.

    What to do

    If you run PAN-OS, limit management interface access to trusted internal IPs today, then install the fixed release for your branch. Run Palo Alto's Threat Prevention signatures meanwhile, but do not rely on them alone.

    The login is not your safety net. If the admin page answers the whole internet, you are one stolen password from a stranger with root.

    Lior Aharonov · my take
    securitypalo-altopan-osexploitedcisa-kev

  9. Lior Aharonov ·

    One email with a crafted attachment, and Cisco's mail gateway hands over root.

    What happened

    Cisco patched CVE-2026-76519 in Secure Email Gateway on 14 October 2026 after active exploitation: a remote, unauthenticated attacker sends an email with a crafted attachment and gets root. It hits gateways with File Reputation on and Content Scanner Tools older than 25.3.0.5525. Shadowserver tracks nearly 300 exposed instances, per BleepingComputer.

    What to do

    If you run Cisco Secure Email Gateway, update Content Scanner Tools to 25.3.0.5525 or later today. Check the version with the contentscannerstatus command, review firewall logs, and renew credentials on any box you doubt.

    Attackers don't need to break into the mail gateway. They email it. And it opens the attachment for them.

    Lior Aharonov · my take
    securityciscoemailexploited

  10. Lior Aharonov ·

    Windows updates broke Remote Desktop for non-admins. The fix is still not out.

    What happened

    Microsoft confirmed on 13 October 2026 that Remote Desktop can fail with error 0xC000000D, "The token that was passed to the function is invalid," for non-admin users. It needs Administrator protection on and the September preview update KB5124010 or later, on Windows 11 24H2, 25H2 and 26H2, per BleepingComputer. Microsoft is still working on a fix.

    What to do

    If you manage Windows 11 devices used as Remote Desktop hosts, disable Administrator protection through Intune or Group Policy by resetting the User Account Control Type Of Admin Approval Mode policy. Leave it off until Microsoft ships the fix.

    A security feature switched on by default is a bargain until a login stops working. Test the baseline on one machine first.

    Lior Aharonov · my take
    windowsmicrosoftremote-desktopknown-issue

  11. Lior Aharonov ·

    Hackers took Meta code from GitHub. The way in was one employee's stolen login.

    What happened

    Meta says an outside group used an employee's stolen credentials to reach some of its GitHub repositories, per SecurityWeek on 13 October 2026. About 99 percent of the data was business data, mostly code, and the rest was personal data stored there by mistake, against company policy. About 1,500 people, mostly US employees, are being notified, and Meta says no Meta product flaw was involved.

    What to do

    Turn on multi-factor sign-in for every GitHub account in your organization, and scan your repositories for committed secrets and personal data. Rotate any secret you find, as Meta did.

    A company with Meta's security budget lost repositories the way a small agency would. One stolen login was enough.

    Lior Aharonov · my take
    securitygithubbreachcredentialssource-code

  12. Lior Aharonov ·

    Chrome and Firefox patched 114 flaws in one round. Seven in Chrome are critical.

    What happened

    SecurityWeek reports Chrome 155 fixed 37 security flaws, seven of them critical, and Firefox 158 fixed 77, with 30 rated high. The article does not describe any as exploited. It adds that Mozilla introduced Firefox Enterprise, a managed browser for organizations, with a management console you can host yourself.

    What to do

    Update Chrome to 155.0.8059.79 or later and Firefox to 158 on every work machine today. Check managed fleets for browsers that have not restarted since the update.

    A browser patch feels small. It protects the most-used application in your company.

    Lior Aharonov · my take
    securitychromefirefoxbrowserspatching

  13. Lior Aharonov ·

    Ivanti's VPN fell to a three-flaw chain on fully patched boxes. One flaw has no fix.

    What happened

    On Tuesday 13 October 2026 Ivanti warned of CVE-2026-104935 in Connect Secure, and CISA added it to its exploited list the same day with a 16 October due date. Volexity says a group it tracks as UTA0576 chained three zero-days for root code execution, from at least 3 October. Two flaws are fixed in 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1; SecurityWeek reports the privilege escalation is still unpatched.

    What to do

    If you run Ivanti Connect Secure, upgrade to a fixed version today, run Ivanti's Integrity Checker, and review appliance logs back to 3 October. Volexity says the attackers tampered with logs, so a clean log is not proof.

    A gateway that needs a perfect patch record and still falls is a bet against yourself. Know your plan for the day it does.

    Lior Aharonov · my take
    securityivantivpnexploitedcisa-kev

  14. Lior Aharonov ·

    Patch Tuesday brought a record 1,411 fixes. One Windows flaw was already under attack.

    What happened

    Microsoft's October 2026 Patch Tuesday on 13 October fixed 1,411 flaws, 70 of them critical, and three zero-days, per BleepingComputer. CVE-2026-96951, a Windows Shell bypass of Mark of the Web, is actively exploited. The other two zero-days were publicly disclosed: CVE-2026-108398 in .NET Framework and CVE-2026-92707 in MessagePack-CSharp.

    What to do

    Install the October Windows updates on developer laptops and build machines first, since they open the most downloaded files. Then test your .NET apps that use MessagePack-CSharp against the update.

    1,411 fixes is too many to read and one is too many to skip. Start with the one attackers already use.

    Lior Aharonov · my take
    securitymicrosoftpatch-tuesdaywindowscisa-kev

  15. Lior Aharonov ·

    A Docker Hub flaw let attackers act as another user. Docker found no sign of abuse.

    What happened

    Docker disclosed CVE-2026-105445 on 13 October 2026. When an account was converted into an organization, its personal access token was reassigned to the named owner without rotation or consent, so an attacker could name a victim as owner and use the token as that victim. Docker says it fixed this within four hours of a 30 September report and found no evidence of exploitation after checking 304,000 pushes.

    What to do

    If Docker notified you on 2 October, review recent pushes and deletions in your repositories for anything you did not do. Create new access tokens where you still rely on them. Docker says that if you got no notice, you were not affected.

    Registry tokens deserve the same care as production keys. Rotate them on a schedule, not after a notice.

    Lior Aharonov · my take
    securitydockersupply-chaincontainers

  16. Lior Aharonov ·

    SAP rated a Python SDK flaw maximum severity. One field could redirect OAuth logins.

    What happened

    SAP's October 2026 updates fixed CVE-2026-89111 in the SAP Cloud SDK for Python, rated maximum severity per BleepingComputer, which reported it on 13 October. In multi-tenant apps on SAP BTP, an attacker who controls the tenant_subdomain value can redirect OAuth2 token requests to their own server and capture client credentials. No privileges are needed, and the article reports no exploitation.

    What to do

    If you build multi-tenant apps on SAP BTP with this SDK, update to the October 2026 release. Until then, check tenant_subdomain against an allowlist of registered tenants before any SDK call.

    Never trust a value because it arrived inside your own app. A subdomain is user input.

    Lior Aharonov · my take
    securitysapoauthssrfpython

  17. Lior Aharonov ·

    A crafted PDF can overflow Ghostscript's memory. The fix has been out since 8 September.

    What happened

    Wordfence researchers found CVE-2026-39919 on 23 August, a heap buffer overflow in Ghostscript 9.21 through 10.07.1, triggered by a PDF with a crafted JPEG 2000 image. Artifex shipped the fix in 10.08.0 on 8 September, and BleepingComputer reported it on 13 October. Wordfence has not seen exploitation; its WordPress test reached remote code execution, but 10,240 lab runs on Linux packages did not.

    What to do

    Upgrade Ghostscript to 10.08.0 or later, or check your distribution's backport notes. Rebuild Docker images on a patched base. If you cannot upgrade yet, block PDF uploads or disable PDF rendering in ImageMagick.

    A library you never chose is still yours. Find out where PDFs get rendered in your stack today.

    Lior Aharonov · my take
    securityghostscriptwordpresspdfpatching

  18. Lior Aharonov ·

    GitLab rated a CI/CD bug max severity on Monday. Self-managed servers must patch.

    What happened

    On Monday 12 October 2026, GitLab told self-managed users to patch CVE-2026-97229, a maximum-severity flaw in its CI/CD Regular Expression Compiler. BleepingComputer reports that, under certain conditions, it could let an unauthenticated user run code on the server through a crafted regular expression in a CI/CD configuration. Fixed in 19.2.8, 19.3.4 and 19.4.2; GitLab.com already runs the fix.

    What to do

    If you run GitLab CE or EE yourself, upgrade today to 19.2.8, 19.3.4 or 19.4.2, whichever matches your branch. GitLab Dedicated customers do not need to act, per GitLab.

    Self-hosting GitLab makes you the security team for your crown jewels. Patch day is part of the deal.

    Lior Aharonov · my take
    securitygitlabci-cdpatching

  19. Lior Aharonov ·

    SonicWall fixed a 10.0 flaw on 6 October. Attackers came knocking two days later.

    What happened

    SonicWall disclosed CVE-2026-102255 on Tuesday 6 October 2026, a pre-authentication SSRF flaw rated CVSS 10 in the SMA1000 Work Place interface of the 6210, 7210 and 8200v. SecurityWeek reported on 12 October that Defused saw the first exploitation attempts on its decoys on 8 October. The fixed versions are 12.4.3-03670 and 12.5.0-03082.

    What to do

    If you run an SMA1000 6210, 7210 or 8200v, upgrade to 12.4.3-03670 or 12.5.0-03082 today, then review the appliance logs since 6 October for unusual requests to the Work Place interface.

    Same appliance, same kind of bug, third time this year. I would patch tonight and read the logs all week.

    Lior Aharonov · my take
    securitysonicwallvpnexploitedpatching

  20. Lior Aharonov ·

    Let's Encrypt certificates drop from 90 to 64 days. Staging gets them first.

    What happened

    Let's Encrypt will issue 64-day certificates by default from Wednesday 10 February 2027, down from 90 days, as a step toward 45-day lifetimes planned for 2028. SecurityWeek reported on Monday 12 October 2026 that staging starts issuing 64-day certificates that week. The authorization reuse period drops to 10 days in 2027 and seven hours in 2028.

    What to do

    Point one ACME client at the Let's Encrypt staging environment and confirm it renews 64-day certificates. If your renewal date is hardcoded, set it to about two-thirds of the lifetime, or use a client that supports ACME Renewal Info (ARI).

    Certificates that last a year let you forget. Certificates that last 64 days punish you for forgetting. Automate it once, properly.

    Lior Aharonov · my take
    tlscertificatesletsencryptdevops

  21. Lior Aharonov ·

    A WordPress add-on let strangers upload code. Attacks started on 7 October.

    What happened

    Patchstack says attackers are exploiting CVE-2026-85097, an unauthenticated arbitrary file upload flaw rated CVSS 9.8 in Bricksforge, a commercial add-on for the Bricks site builder, SecurityWeek reported on Monday 12 October 2026. Versions 3.1.8.9 and earlier are affected, and 3.1.8.10 fixes it. Patchstack saw in-the-wild attempts from 7 October.

    What to do

    If your site or a client's uses Bricks with Bricksforge, update Bricksforge to 3.1.8.10 today and check the uploads folder for PHP files you did not put there.

    The plugin you forgot you installed is the one attackers remember. Keep a list of what runs on your WordPress, theme and plugins alike.

    Lior Aharonov · my take
    securitywordpressexploitedpatching

  22. Lior Aharonov ·

    Windows 11 24H2 Home and Pro run out of updates in October. Check your dev laptops.

    What happened

    BleepingComputer reported on Monday 12 October 2026 that Windows 11 24H2 Home and Pro stop receiving updates that week, and that Windows Server 2022 leaves mainstream support on Tuesday 13 October. Microsoft's notice says the November 2026 security update is the last for Windows 11 23H2 Enterprise, Education and IoT Enterprise.

    What to do

    Run winver on every Windows machine that touches your code or customer data. Move 24H2 Home and Pro devices to Windows 11 26H2, and plan 23H2 Enterprise and Education upgrades before the November update.

    Unsupported doesn't mean broken. That's the trap. It keeps working perfectly, for the attacker too.

    Lior Aharonov · my take
    windowsmicrosoftend-of-supportpatching

  23. Lior Aharonov ·

    The DNS root changes its master key on 11 October. Your resolver has to know it.

    What happened

    On Sunday 11 October 2026, the DNS root is scheduled to change the key-signing key that anchors DNSSEC, only the second time ever. KSK-2024 (key tag 38696) replaces KSK-2017 (key tag 20326). Cloudflare warned on Tuesday 6 October that users of a validating resolver that does not trust the new key may be unable to reach sites under any top-level domain.

    What to do

    If you run your own DNSSEC-validating resolver, in an office, a VPC or a container image, check today that it trusts key tag 38696 with the RFC 8509 sentinel test Cloudflare describes. If it does not, update its trust anchors per your vendor's instructions.

    DNS changes nobody watches are the ones that page you on a weekend. Ten minutes with dig today beats a Monday of tickets.

    Lior Aharonov · my take
    dnsdnssecinfrastructureoutage-risk

  24. Lior Aharonov ·

    Five old flaws joined CISA's exploited list on 8 October. One sits in Strapi.

    What happened

    On Thursday 8 October 2026, CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog, with a federal deadline of Sunday 11 October. They hit Strapi (CVE-2023-22894), ONLYOFFICE Docs (CVE-2021-3199), Apache Struts (CVE-2016-3081), ISC BIND (CVE-2015-5477) and ProFTPD (CVE-2015-3306).

    What to do

    Search your servers, container images and old side projects for Strapi, ONLYOFFICE Docs, Struts, BIND and ProFTPD today. Patch what is still supported, and retire any Strapi version past end of life, as CISA advises.

    Attackers don't need new bugs while old ones still pay. A 2015 CVE in production isn't legacy. It's an open door.

    Lior Aharonov · my take
    securitycisakevstrapistrutspatching

  25. Lior Aharonov ·

    Anthropic rewrote Claude's usage rules. The new version applies from 12 November.

    What happened

    On Thursday 8 October 2026, Anthropic published a new Usage Policy that takes effect on 12 November. It adds a section on deceptive campaigns and fake accounts, rewrites the surveillance rules, adds controls for Claude connected to hardware that takes physical actions, and spells out the existing ban on companies majority-owned from unsupported regions.

    What to do

    Read the rewritten high-risk section before 12 November and check each Claude feature you ship against it. If one is covered, confirm a qualified reviewer can change the output and that users are told AI was involved.

    A usage policy is part of your product spec, whether you read it or not. I'd rather find the gap in October than in a customer complaint.

    Lior Aharonov · my take
    aianthropicclaudepolicycompliance

  26. Lior Aharonov ·

    Hackers used Asos's own app to announce the breach. Your push channel is a key too.

    What happened

    UK retailer Asos has confirmed a breach of customer data, TechCrunch reported on Thursday 8 October 2026, after hackers sent users an in-app notification claiming its data on Snowflake was compromised. Asos told the London Stock Exchange that hackers broke into a third-party platform it uses to contact customers, and says names and contact details were taken. Snowflake says its own systems were not breached.

    What to do

    List every third-party tool that can message your users, from push to email and SMS, and who holds its credentials. Turn on MFA for each one and for your data warehouse logins today, and rotate shared keys.

    Your send button is as valuable as your database. Guard it like one.

    Lior Aharonov · my take
    securitybreachmobilepush-notificationssnowflake

  27. Lior Aharonov ·

    Claude Haiku 5.5 is out. Code written for Haiku 4.5 can break on it.

    What happened

    On Wednesday 7 October 2026, Anthropic launched Claude Haiku 5.5 (claude-haiku-5-5), with a 1M token context window and up to 128k output tokens. Requests with budget_tokens, non-default temperature, top_p or top_k, or an assistant prefill now return errors. The same text counts as about 30% more tokens than on Haiku 4.5.

    What to do

    Search your code for budget_tokens, temperature, top_p, top_k and assistant prefills before you switch to claude-haiku-5-5. Then read content blocks by type, not position, and recount your prompt costs.

    A cheaper model with a breaking change is still a breaking change. I'd ship it behind a flag, never as a one-line swap.

    Lior Aharonov · my take
    aianthropicclaudeapibreaking-change

  28. Lior Aharonov ·

    Apple's iPhone Duo ships 23 October. Your app's screenshots have a deadline too.

    What happened

    On Monday 5 October 2026, Apple told developers that iPhone Duo will be available to customers starting 23 October 2026. Xcode 27.1 adds development support for it, and iPhone Duo optimized apps can be submitted in App Store Connect now. Starting April 2027, any app or game submitted will need iPhone Duo screenshots.

    What to do

    Recompile with Xcode 27.1 today and check every screen in Device Hub across all poses and orientations. Then add iPhone Duo screenshots now, before the April 2027 rule makes them mandatory.

    Launch week is when users decide which apps feel native. Be ready on 23 October, not after the first one-star review.

    Lior Aharonov · my take
    appleiosapp-storexcodemobile

  29. Lior Aharonov ·

    Supabase tokens can now be fenced to one project. A leak shrinks with them.

    What happened

    On Tuesday 6 October 2026, Supabase made scoped personal access tokens generally available. A token can be limited to selected projects or organizations, with read or read-write permission per capability and an expiry up to one year out. Existing tokens keep working, and GitHub secret scanning added a detector for the scoped token type on 5 October.

    What to do

    List your Supabase access tokens today and replace each account-level one with a scoped token that has only the projects, permissions and expiry its integration needs.

    Every token is a spare key to your house. Make it open one door, and give it an expiry date.

    Lior Aharonov · my take
    supabasesecuritytokensdatabase

  30. Lior Aharonov ·

    GitHub's stacked pull requests are now GA. Approvals survive the rebase.

    What happened

    On Tuesday 6 October 2026, GitHub made stacked pull requests generally available on all github.com plans. Rebase stack now keeps approvals on unchanged code and signs replacement commits, and a stack lands through the merge queue as one merge group. GitHub says repositories using stacks saw 9% more merged code than peers.

    What to do

    Pick your next large change and split it into a stack of small pull requests. If you run GitHub Enterprise Server, wait: GitHub says support comes in an upcoming release.

    Big pull requests don't get reviewed. They get approved. Stacks are how you get real review back.

    Lior Aharonov · my take
    githubcode-reviewdevopsgit

  31. Lior Aharonov ·

    GitHub's AI secret check can cost credits even when it blocks nothing.

    What happened

    On Wednesday 7 October 2026, GitHub moved AI-detected password alerts to a purpose-built secret detection model, at no extra charge for GHSP and GHAS customers. Its new opt-in push protection check is in private preview and will consume GitHub AI Credits. GitHub says a check can consume credits even if it doesn't block a push.

    What to do

    Decide now who in your organization may enable AI push protection, and set an AI Credits budget before the public preview. Billing starts only when your organization opts in and enables it.

    Paying to catch a leaked password is cheap. Paying without a budget is how security tools get switched off.

    Lior Aharonov · my take
    githubsecuritysecretsbilling

  32. Lior Aharonov ·

    What happened

    On Sunday, 4 October, CVE-2026-105207 (CVSS 9.8) was published for ZITADEL, the open source identity platform. Versions 3.0.0 through 3.4.15 and 4.0.0 through 4.17.2 let an unauthenticated attacker who knows a victim's login name link their own external identity provider to that account, then sign in as the victim. The fix is 4.17.3.

    What to do

    If you self-host ZITADEL, check the version today and upgrade to 4.17.3 or later. Still on 3.x, move to 4.x now; disabling external IdP linking only closes part of the gap, says ZITADEL.

    End of life is a date on someone else's calendar. Attackers read that calendar too.

    Lior Aharonov · my take
    securityidentityauthenticationopen-sourcecve

  33. Lior Aharonov ·

    Twelve logins to steal the keys. Math.random() signed the cookies.

    What happened

    Rejetto HFS 3.0.0 through 3.2.0 derived its session-cookie signing key from Math.random() and leaked outputs of that same generator at login (CVE-2026-61500), as Horizon3.ai detailed on 30 September. SecurityWeek reports that on 2 October VulnCheck warned attackers had started targeting it. Version 3.2.1, out since 13 July, fixes it.

    What to do

    Upgrade any HFS server to 3.2.1 today. Then search your code for Math.random() near tokens, sessions or reset links and replace it with a cryptographic generator such as crypto.getRandomValues().

    Math.random() is for shuffling a playlist. Never for the link that resets a password.

    Lior Aharonov · my take
    securitynodejscveexploitedauthentication

  34. Lior Aharonov ·

    AWS Proton goes dark on 7 October. Its data goes with it.

    What happened

    AWS ends support for AWS Proton on Wednesday, 7 October 2026. After that date the Proton console and Proton resources are no longer accessible, and AWS says all Proton data will be deleted. Deployed CloudFormation stacks and the resources they manage keep running.

    What to do

    If you still use Proton, export your templates and list every environment and service today. Then move deployments to CloudFormation Git Sync, CodePipeline and CodeBuild, or GitHub Actions, the paths AWS lists.

    AWS closed sign-ups a full year ago. A year of notice still ends in one night, and the clock now counts hours.

    Lior Aharonov · my take
    awsclouddeprecationci-cddevops

  35. Lior Aharonov ·

    A CVSS 10 in Perforce P4 Search. The token was in the docs.

    What happened

    On Monday, 5 October, CVE-2026-100103 was published with a CVSS 4.0 score of 10.0. Perforce P4 Search container images before 2026.4.2 reset the service authentication token to a publicly documented default value, letting an unauthenticated network attacker gain the highest privileges, potentially leading to code execution and P4 Server compromise.

    What to do

    If you run P4 Search from a container image, upgrade to 2026.4.2 or later today, block it from untrusted networks, and review P4 Server logs for admin activity you did not expect.

    A default credential is a password you published to everyone. Including the people you hoped would never read the manual.

    Lior Aharonov · my take
    securitycvedevopssource-control

  36. Lior Aharonov ·

    CISA flagged a NetScaler login flaw on Sunday. Federal agencies get three days.

    What happened

    On Sunday, 4 October 2026, CISA added CVE-2026-88779 in Citrix NetScaler ADC and Gateway to its list of exploited flaws, with a 7 October deadline for federal agencies. The memory flaw (CVSS 8.7) hits appliances set up as a SAML service provider or identity provider. Fixed builds: 14.1-73.41 and 13.1-64.28.

    What to do

    If you run NetScaler with SAML, check it for signs of compromise, then upgrade to 14.1-73.41 or 13.1-64.28 (or the matching FIPS build) today.

    Two NetScaler alarms a week apart. When the same front door keeps making the news, I stop asking if it's patched and start asking who already came in.

    Lior Aharonov · my take
    securitycisa kevcitrix

  37. Lior Aharonov ·

    Google paused its open source bug bounty. Most of the automated reports were wrong.

    What happened

    Google paused its Open Source Software Vulnerability Reward Program on 1 October 2026, TechCrunch reported on 4 October. The reason Google gave: a sharp rise in automated submissions, most of them not valid. It promises an update in the first quarter of 2027 and points researchers to its other programs.

    What to do

    If you accept vulnerability reports, require a working proof of concept and the exact affected version before triage starts. Put that rule in your SECURITY.md today.

    AI made writing a bug report cost nothing. It didn't make reading one any cheaper.

    Lior Aharonov · my take
    securityopen sourcebug bounty

  38. Lior Aharonov ·

    The White House named a new AI task force. Its report is due in 120 days.

    What happened

    On 4 October 2026 President Trump named Director of National Intelligence Jay Clayton to chair a new federal 'Super Intelligence Force', TechCrunch reports. FTC Chair Andrew Ferguson, Pentagon technology chief Emil Michael and OPM Director Scott Kupor are vice chairs. It has 120 days to report on risks and opportunities.

    What to do

    Nothing to do yet; watch for the task force report, due about 120 days from 4 October.

    Every rulebook starts as a report nobody reads. I'd rather read this one in February than learn it from a letter in June.

    Lior Aharonov · my take
    regulationai policyunited states

  39. Lior Aharonov ·

    Neon on Azure stops getting new features on 5 October. Some idle projects can go.

    What happened

    From 5 October 2026, Neon's three Azure regions (azure-eastus2, azure-westus3, azure-gwc) get no new features. Projects in unpaid Neon organizations that sat inactive for 90 days or more become subject to deletion. Paid and active projects keep running, and Neon says a final end-of-service date will be announced later.

    What to do

    If your Postgres lives in a Neon Azure region, plan the move now: Neon's AWS regions, Databricks Lakebase if you need Azure data residency, or a Postgres export.

    When a vendor says 'existing projects keep running', I read the word 'existing' twice.

    Lior Aharonov · my take
    databasesclouddeprecations

  40. Lior Aharonov ·

    GitHub app tokens grew about 13 times longer. Your code may still expect the old size.

    What happened

    On 2 October 2026 GitHub finished moving GitHub App installation tokens to a stateless format, a rollout that started on 27 April. Same ghs_ prefix. But about 520 characters now, instead of 40.

    What to do

    Search your code and schemas today for a 40-character limit on tokens, and treat the token as an opaque string. Still sending the X-GitHub-Stateless-S2S-Token header from testing? Remove it before 30 November 2026, when GitHub deprecates it.

    The bugs I fear most don't crash anything. They quietly cut a string short and let you chase the wrong problem for a day.

    Lior Aharonov · my take
    githubauthenticationdeveloper platforms

  41. Lior Aharonov ·

    An AI attack went from help desk to root in seconds. The flaws are now on CISA's list.

    What happened

    On 2 October 2026 CISA added two Zammad flaws, CVE-2026-102489 (session fixation) and CVE-2026-102490 (privilege management), to its Known Exploited Vulnerabilities catalog. SecurityWeek reports both at CVSS 9.4, chained on 21 September against the Dutch Institute for Vulnerability Disclosure (DIVD) in an AI-driven attack that went from a hijacked session to root in seconds.

    What to do

    If you self-host Zammad 6.x, upgrade to version 7 tonight or take the server offline, which is DIVD's advice. Then run the script DIVD published to check for signs of compromise, because an upgrade does not evict someone who is already in.

    A help desk is the one system everyone trusts and nobody watches. That's exactly why I'd patch it first.

    Lior Aharonov · my take
    securityactively exploitedcisa kev

  42. Lior Aharonov ·

    The alarm went off at CISA on Thursday. If you run FortiMail, the clock is running.

    What happened

    On Thursday, 1 October 2026, CISA added CVE-2026-104286, a path traversal flaw in Fortinet FortiMail, to its catalog of vulnerabilities attackers are already using. SecurityWeek reports a CVSS score of 9.8: crafted web requests can write files onto the appliance. As of 2 October the fixes (7.4.9, 7.6.7 and 8.0.2) were planned, with no release date.

    What to do

    If you run FortiMail, apply Fortinet's workaround right now: turn off IBE support, or cut web access to the management interface and limit it to trusted sources. The patch? Not out as of 2 October, so the workaround is the plan.

    The scariest breach isn't the one in the headlines. It's the one happening in your mail server while you read this.

    Lior Aharonov · my take
    securityactively exploitedcisa kevfortinet

  43. Lior Aharonov ·

    OpenAI just set a shutdown date for three models. The countdown ends on 1 April 2027.

    What happened

    On 1 October 2026 OpenAI deprecated gpt-5.3-codex, gpt-5.4-nano and gpt-5.1, with removal from the API on 1 April 2027 and gpt-6-sol (for the first and last) and gpt-6-luna (for gpt-5.4-nano) as replacements. The same day, tts-1, tts-1-hd and two gpt-4o-mini-tts snapshots got a 6 January 2027 shutdown, with gpt-realtime-2.1-mini as the replacement.

    What to do

    Search your code for these model names today and put the switch on the calendar. Then run your own prompts through gpt-6-sol or gpt-6-luna and compare quality and cost before you flip it.

    Six months is never six months. It's five months of 'later' and one week of panic.

    Lior Aharonov · my take
    ai platformsopenaideprecations

  44. Lior Aharonov ·

    Your iOS builds can fail on 5 October, and nobody on your team changed a thing.

    What happened

    GitHub will retire the macos-14, macos-14-large and macos-14-xlarge runner images on 2 November 2026. Before that come eight brownouts when jobs on those labels fail, the first from 14:00 UTC on 5 October until midnight UTC and the last starting 14:00 UTC on 30 October.

    What to do

    Search your workflows for macos-14 today and switch to macos-15 or macos-latest (macOS 26), or their xlarge versions. Run one build on the new image before 14:00 UTC on 5 October.

    A brownout is the kindest warning you'll ever get. Ignore it, and the next one is the blackout.

    Lior Aharonov · my take
    githubci cdapple platforms

Every fact is checked against the source linked under it; the wording is ours. A correction: lior@7it.co.il. News about MCP servers and agent tooling is in 7Maps news.