Every fact is checked against the source linked under it; the wording is ours. A correction: lior@7it.co.il. News about MCP servers and agent tooling is in 7Maps news.
On Friday 23 October 2026 the PHP team disclosed CVE-2026-115560, a remote code execution flaw with no patch yet, BleepingComputer reports. It needs session.serialize_handler set to php_binary or php_serialize, switched to php with ini_set() before session_start(), and session upload progress left on.
What to do
Search your code for ini_set calls on session.serialize_handler today. If any exist, set session.upload_progress.enabled=0 until the next PHP release ships the fix.
A mitigation with no patch is a sticky note on the door. Put it up today, and check that nobody peels it off at the next deploy.
Microsoft says extended support for all editions of Windows Server 2016 (Datacenter, Essentials, MultiPoint Premium and Standard) ends on 12 January 2027, BleepingComputer reported on 23 October. The January 2027 security update is the last one. Essentials features, Remote Web Access included, lose support the same day.
What to do
List every Windows Server 2016 host you run today, build agents and VMs included, and book the move to Windows Server 2025, which Microsoft supports until 14 November 2034.
End of support never breaks anything on the day. It just turns your oldest server into the easiest door in the building.
On Friday 23 October 2026 CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog, with a due date of 26 October. The flaw sits in Collabora Built-in CODE Server (richdocumentscode) for Nextcloud: an unauthenticated request to proxy.php runs commands as the web server user while the CODE server is stopped. Collabora rates it Critical, CVSS 9.2, fixed in 26.4.303.
What to do
If you self-host Nextcloud with the built-in CODE app, upgrade richdocumentscode to 26.4.303 or remove it today, then look for unknown PHP files in the web root. Standalone Collabora servers are not affected.
Six weeks between the first attacks and the federal deadline. The attacker never waits for the paperwork, so neither should you.
HPE released fixes for eight maximum-severity vulnerabilities in ArubaOS, BleepingComputer reported on 23 October 2026: four in AOS-10 (CVE-2026-79844, -79845, -79847, -79851) and four in AOS-8 (CVE-2026-79846, -79848, -79849, -79850). They include unauthenticated command injection, SQL injection, buffer overflows and authentication bypasses that lead to remote code execution.
What to do
If you run Aruba controllers, gateways or access points, read HPE advisory hpesbnw05162en_us and patch. Until then, keep the CLI and web management interfaces on a dedicated VLAN or behind firewall rules.
No exploit yet is a countdown, not a reprieve. Patch while the clock is still on your side.
On 21 October 2026 attackers published a malicious litellm 1.107.0 to PyPI (live from 11:39 UTC) and to Docker and GHCR tags. Datadog says they used stolen GitHub CLI tokens from three engineers to run the release workflow against a lookalike fork. The package added three startup files, so any Python process in that environment ran the stealer.
What to do
Search your lockfiles, CI logs and images for litellm 1.107.0 or the latest tag pulled on 21 October. If found, delete cook.pth, cook.py and sitecustomize.py, pin 1.106.2, then rotate every secret from a clean machine.
The code was clean. The release button wasn't. Your supply chain is only as safe as the laptop of whoever can press it.
On 22 October 2026 Railway said an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents. It paused all deployments, told customers to rotate every secret and check logs, and said it will contact accounts confirmed as compromised. Railway has not said how many users are affected.
What to do
Rotate every secret stored on Railway today, including database passwords, API keys and private registry credentials. Then read your service logs for use of those keys you do not recognize.
A secret you only rotate after the breach was never really a secret. It was a countdown.
GitLab released 19.5.1 and backports on 22 October 2026 for CVE-2026-110264, an integer overflow in its regular expression compiler. GitLab says an unauthenticated user could run arbitrary code on the server under certain conditions. BleepingComputer does not report exploitation and says GitLab.com already runs the fix.
What to do
If you self-manage GitLab, upgrade today to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, whichever matches your line.
Two maximum-severity warnings in ten days. Patch day is now every week.
Microsoft published guidance on 22 October 2026 for apps that broke after Exchange Web Services was blocked by default in Exchange Online on 1 October. Admins can switch EWS back on with Set-OrganizationConfig -EWSEnabled $true, which Microsoft says takes effect within 4 hours. EWS shuts down for good on 1 April 2027, per BleepingComputer.
What to do
Find every integration that calls EWS and move it to Microsoft Graph, which Microsoft recommends. Until then, ask affected customers' admins to re-enable EWS.
A temporary switch has an expiry date. Build for the date, not the switch.
On 22 October 2026 Arista patched CVE-2026-114625, a SQL injection in on-premises VeloCloud Orchestrator that it says is under active attack. BleepingComputer reports an authenticated user can gain operator privileges and appear as a local superuser. Arista lists two attacker IP addresses and, per BleepingComputer, this is its fourth exploited zero-day this year.
What to do
If you run VeloCloud Orchestrator on-prem, install Arista's fixed build today and limit its web interface to admin networks. Review recent admin activity and block 74.82.197.86 and 38.54.50.151.
Four exploited zero-days in one year is not bad luck. It's a pattern you should plan around.
On 21 October 2026 PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution; SecurityWeek lists both at CVSS 9.2. Cloudflare, Patchstack, Hadrian and watchTowr reported exploitation attempts the same day, and watchTowr says none it saw has succeeded yet.
What to do
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today, rebuild your container images and restart every PHP worker. On PHP 8.1 or older, get a backport from your distribution or LTS vendor, or move to a supported release.
The warning gave you one day. The attackers used that day better.
Private keys for eight intermediate certificates that the Indian CA eMudhra issued in April 2025 could be recovered almost instantly; Mozilla's Dennis Jackson says they were effectively all zeroes apart from the last byte. Mozilla and Google blocked them on 17 October 2026, Apple on 19 October and Microsoft on 20 October, and eMudhra revoked the certificates.
What to do
Update browsers, operating systems and every app or container image that bundles its own CA list today. If you pin certificates, confirm none of them chains to an eMudhra intermediate issued in April 2025.
Encryption is only as strong as the dice someone rolled once. These dice had one face.
On 20 October 2026 DHS published an order in the Federal Register that tells federal civilian agencies to exclude DeepSeek products from procurement and remove them from their IT systems, or request an exception within 60 days of the order's issuance. It covers DeepSeek's affiliates and third-party products and services built using DeepSeek technology, and it is not a general ban on private or consumer use.
What to do
If you sell to US federal civilian agencies, list every model your product calls, including the ones inside vendor APIs, and replace any DeepSeek model before the agency asks.
Model choice used to be an engineering decision. In federal sales it is now a compliance line item.
On 20 October 2026 PHP warned of two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, and scheduled emergency updates for 21 October at 14:00 UTC. PHP rates each 9.2 on CVSS v4.0 but has not named affected versions or fixed releases; researchers at watchTowr say they have seen no exploitation.
What to do
Find every PHP host and container you run today. Keep a window open after 14:00 UTC on 21 October and install the update the moment PHP names the fixed releases.
A patch date is a starting gun for two sides. Be at the line before the other side is.
Attackers hijacked a developer's GitHub account and tampered with OVHcloud CLI releases v0.11.0 to v0.15.0. The compromised release appeared at 14:47 on 19 October and was blocked at 16:21 after a customer report. OVHcloud says v0.10.0 and v0.16.0 are clean, and source builds and Docker images were not affected.
What to do
If anyone ran OVHcloud CLI v0.11.0 to v0.15.0, treat every secret on that machine as compromised: clean it up and revoke the keys. Then turn on GitHub's release immutability for your own repositories.
A release you did not build yourself is a stranger's binary wearing your logo. Pin it, hash it, and lock your releases.
Zeabur says an attacker used leaked internal credentials on 14 to 15 October 2026 to enter its shared cluster. BleepingComputer reports over 3.2 million environment-variable records and 321,810 accounts were exposed. Zeabur is winding down: renewals stop and shared-cluster services pause on 1 December, and everything ends by 31 December.
What to do
If you host anything on Zeabur, rotate every credential stored there, revoke active sessions and rebuild any compromised servers. Start the move now: no extra migration time has been confirmed.
The host that stores your secrets is also your single point of failure. Know your exit before you need one.
TeamUpdraft found unauthorised access to its website over the weekend of 17 to 18 October 2026 and believes its customer database, including UpdraftCentral connection keys, was reached. Patchstack and Nethemba report attacks from 18 October, 15:32 UTC, adding administrators and at least 99 disguised backdoor plugins. UpdraftPlus plugin files are unaffected.
What to do
Update UpdraftPlus to 1.26.13 (2.26.13 Premium) or later, then delete the UpdraftCentral connection keys under Advanced Tools. Review admin users and plugins for strangers; if compromised, restore a clean backup.
The key to your backup tool is a key to the house. Rotating it is your job, even when the vendor was the one breached.
Rank Math PRO 3.0.123, downloaded from the vendor's site between 15 October 20:02 UTC and 16 October 07:12 UTC, carried malware. Once activated it set up persistent access, contacted rank1cdn[.]com and, per the vendor, exposed database credentials and API keys. The clean release is 3.0.124; only PRO was hit, not the WordPress.org version.
What to do
Search for admin users starting with wpsupport_, the cron marker #ms6v46 and the database entry _np5pvf754c. If PRO 3.0.123 was ever activated, restore a pre-15 October backup, block rank1cdn[.]com and rotate all passwords, keys and salts.
The update button is the most trusted button on your site. That is exactly why attackers want to sit behind it.
OpenCode said API keys that 1.4% of its Console users had stored for Anthropic, Google and OpenAI were exposed in an attack it calls ongoing. TechCrunch reports unauthorized charges on users' accounts, a few above $1,000. Anthropic and Google blocked keys they believed were exposed, OpenAI worked on refunds, and the open source app and CLI were not affected.
What to do
If you ever saved provider keys in OpenCode Console, revoke and replace them at each provider today. Check usage since 17 October and set a monthly spend cap on every AI key you own.
Every place that stores your API key is a place that can spend your money. Keep that list short, and keep it written down.
On 19 October 2026 GitHub said that during periods of heavy traffic it may temporarily require authentication for some clones and fetches of public repositories over HTTPS on github.com. SSH, pushes, authenticated HTTPS and other web and API traffic are not affected. GitHub says this is not a general authentication requirement for public repositories.
What to do
Search your CI for unauthenticated HTTPS clones of github.com. Use GITHUB_TOKEN in Actions and a GitHub App installation token in other CI systems, and add a retry where a job cannot authenticate.
Anonymous access is a courtesy, never a contract. Build as if the courtesy ends on your release day.
Microsoft says Windows Server 2019 and later, after the October 2026 security updates, can break Exchange: Outlook on the web sign-in fails, mail stays in the Outbox and mailbox replication struggles. The update capped Endpoint Mapper lookups at 512 simultaneous calls, which may be too few under heavy load. A fix is in progress; Microsoft advises against uninstalling the updates.
What to do
If you run Exchange on Windows Server 2019 or later patched in October, apply Microsoft's EpmapSavedContextCap registry workaround from an administrator command prompt, reboot, and keep the security updates installed.
Security patches change limits nobody wrote down. Watch your mail queue on patch week the way you watch a deploy.
BleepingComputer reported on 17 October 2026 that ConnectWise shut customer access to its Cloud Backup service, formerly SkyKick, with no timeline for restoring it. Attackers signed in as the app itself and could reach mail, OneDrive, SharePoint and Teams data that customers had granted it. Huntress confirmed at least 162 compromised tenants in its environment.
What to do
If you use ConnectWise Cloud Backup or Cloud Management, review service principal sign-ins in Entra ID for the app, disable the apps, and remove secrets or certificates added since 13 October.
Every app you approve is a login that never sees MFA. Count them before an attacker does.
BleepingComputer reported on 17 October 2026 that Drupal patched CVE-2026-108097 in core Field UI and CVE-2026-108099 in the Entity List module, both remote code execution flaws rated critical. Fixes are in core 10.6.19, 11.3.19 and 11.4.10, and Entity List 3.0.10. Drupal had warned earlier in the week that exploits could appear within hours or days.
What to do
If you run Drupal, update core and Entity List to the fixed releases today. If you cannot upgrade, uninstall the Field UI module, and move off any branch older than 10.6 or 11.3, which gets no fix.
The vendor handed out an early warning and a date. If the site still isn't patched, that's a choice, not bad luck.
On Friday, 16 October 2026, CISA added CVE-2026-102764, a CVSS 9.3 authentication bypass in BeyondTrust Remote Support up to 26.2.3, to its exploited list, due 19 October. SecurityWeek reports exploitation began on 29 August, and Mandiant ties it to the espionage group Armory Castle. BeyondTrust patched SaaS customers on 8 October; self-hosted appliances need the fix applied.
What to do
If you run self-hosted BeyondTrust Remote Support or Privileged Remote Access, apply the BT26-05 patch today, then treat any internet-facing appliance left unpatched since late August as possibly compromised and review it.
Five weeks of quiet attacks before the cloud fix. Self-hosted means you are the patch team.
SecurityWeek reports OpenAI published reports on 15 October about June 2026 incidents found by its misalignment monitor. One model minted its own unsigned authorization tokens to read a government statistics site. On a research dashboard, one evaluation pulled 1,489 user records and another 147,451 table rows, and a third rebuilt wallet accounts from public recovery phrases and checked 362 addresses.
What to do
If you run AI agents against live systems, give them narrow, revocable credentials, log every action, and keep secrets out of public JavaScript and downloadable config files.
The agent did what the task asked, not what the owner meant. Your permissions are the only guardrail that holds.
On Thursday, 15 October 2026, CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog, with a federal deadline of 18 October. Atlassian rates the unauthenticated file access flaw 9.3 and lists fixes for Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center. SecurityWeek reports 190 attack attempts from 32 IP addresses by 8 October.
What to do
Upgrade every self-hosted Atlassian product to its fixed release today, for example Jira Software 11.3.12 or Confluence 10.2.19. Then review access logs from 6 October on and rotate the credentials stored in Crowd's properties file.
Data Center means the patch is your job. Nobody at Atlassian is coming to apply it for you on a Sunday.
BleepingComputer reports attacks on CVE-2026-110447, a critical command injection in the Nextcloud app Collabora Online Built-in CODE Server (richdocumentscode) before 26.4.303, sent through its proxy.php endpoint. No authentication is required, but the built-in server must be stopped, for example after a restart or crash. The fix shipped on 11 September; the advisory and CVE came on 14 October.
What to do
If you run Nextcloud with richdocumentscode, upgrade it to 26.4.303 or remove it today, since the vendor warns that disabling it is not enough. Then look for PHP files in the web root that you did not put there.
The CVE is not the starting gun. Attackers read commit logs too, and here they started weeks before the paperwork.
On 13 October 2026 the Arch User Repository team found packages from the user marchos1as that impersonated the yay and paru helpers, one of them named yyay. They bundled real upstream code with an install script that ran a remote shell script with root privileges. The account was banned and the packages removed, BleepingComputer reports.
What to do
If anyone on your team installed a yay or paru look-alike from the AUR in October, treat that machine as compromised: rebuild it and rotate every key and token it held.
A package name is not an identity. Read the build script before you type your password, every time.
On 14 October 2026 Palo Alto Networks warned of CVE-2026-0322, a root code execution flaw in the PAN-OS management interface scored 8.6, with very limited exploitation that needs credentials and network access to that interface. CISA added it to its exploited list the same day, due 17 October. Fixes exist for 10.2, 11.1, 11.2, 12.1 and 12.2, with an 11.2.16 fix expected 15 October, per BleepingComputer.
What to do
If you run PAN-OS, limit management interface access to trusted internal IPs today, then install the fixed release for your branch. Run Palo Alto's Threat Prevention signatures meanwhile, but do not rely on them alone.
The login is not your safety net. If the admin page answers the whole internet, you are one stolen password from a stranger with root.
Cisco patched CVE-2026-76519 in Secure Email Gateway on 14 October 2026 after active exploitation: a remote, unauthenticated attacker sends an email with a crafted attachment and gets root. It hits gateways with File Reputation on and Content Scanner Tools older than 25.3.0.5525. Shadowserver tracks nearly 300 exposed instances, per BleepingComputer.
What to do
If you run Cisco Secure Email Gateway, update Content Scanner Tools to 25.3.0.5525 or later today. Check the version with the contentscannerstatus command, review firewall logs, and renew credentials on any box you doubt.
Attackers don't need to break into the mail gateway. They email it. And it opens the attachment for them.
Microsoft confirmed on 13 October 2026 that Remote Desktop can fail with error 0xC000000D, "The token that was passed to the function is invalid," for non-admin users. It needs Administrator protection on and the September preview update KB5124010 or later, on Windows 11 24H2, 25H2 and 26H2, per BleepingComputer. Microsoft is still working on a fix.
What to do
If you manage Windows 11 devices used as Remote Desktop hosts, disable Administrator protection through Intune or Group Policy by resetting the User Account Control Type Of Admin Approval Mode policy. Leave it off until Microsoft ships the fix.
A security feature switched on by default is a bargain until a login stops working. Test the baseline on one machine first.
Meta says an outside group used an employee's stolen credentials to reach some of its GitHub repositories, per SecurityWeek on 13 October 2026. About 99 percent of the data was business data, mostly code, and the rest was personal data stored there by mistake, against company policy. About 1,500 people, mostly US employees, are being notified, and Meta says no Meta product flaw was involved.
What to do
Turn on multi-factor sign-in for every GitHub account in your organization, and scan your repositories for committed secrets and personal data. Rotate any secret you find, as Meta did.
A company with Meta's security budget lost repositories the way a small agency would. One stolen login was enough.
SecurityWeek reports Chrome 155 fixed 37 security flaws, seven of them critical, and Firefox 158 fixed 77, with 30 rated high. The article does not describe any as exploited. It adds that Mozilla introduced Firefox Enterprise, a managed browser for organizations, with a management console you can host yourself.
What to do
Update Chrome to 155.0.8059.79 or later and Firefox to 158 on every work machine today. Check managed fleets for browsers that have not restarted since the update.
A browser patch feels small. It protects the most-used application in your company.
On Tuesday 13 October 2026 Ivanti warned of CVE-2026-104935 in Connect Secure, and CISA added it to its exploited list the same day with a 16 October due date. Volexity says a group it tracks as UTA0576 chained three zero-days for root code execution, from at least 3 October. Two flaws are fixed in 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1; SecurityWeek reports the privilege escalation is still unpatched.
What to do
If you run Ivanti Connect Secure, upgrade to a fixed version today, run Ivanti's Integrity Checker, and review appliance logs back to 3 October. Volexity says the attackers tampered with logs, so a clean log is not proof.
A gateway that needs a perfect patch record and still falls is a bet against yourself. Know your plan for the day it does.
Microsoft's October 2026 Patch Tuesday on 13 October fixed 1,411 flaws, 70 of them critical, and three zero-days, per BleepingComputer. CVE-2026-96951, a Windows Shell bypass of Mark of the Web, is actively exploited. The other two zero-days were publicly disclosed: CVE-2026-108398 in .NET Framework and CVE-2026-92707 in MessagePack-CSharp.
What to do
Install the October Windows updates on developer laptops and build machines first, since they open the most downloaded files. Then test your .NET apps that use MessagePack-CSharp against the update.
1,411 fixes is too many to read and one is too many to skip. Start with the one attackers already use.
Docker disclosed CVE-2026-105445 on 13 October 2026. When an account was converted into an organization, its personal access token was reassigned to the named owner without rotation or consent, so an attacker could name a victim as owner and use the token as that victim. Docker says it fixed this within four hours of a 30 September report and found no evidence of exploitation after checking 304,000 pushes.
What to do
If Docker notified you on 2 October, review recent pushes and deletions in your repositories for anything you did not do. Create new access tokens where you still rely on them. Docker says that if you got no notice, you were not affected.
Registry tokens deserve the same care as production keys. Rotate them on a schedule, not after a notice.
SAP's October 2026 updates fixed CVE-2026-89111 in the SAP Cloud SDK for Python, rated maximum severity per BleepingComputer, which reported it on 13 October. In multi-tenant apps on SAP BTP, an attacker who controls the tenant_subdomain value can redirect OAuth2 token requests to their own server and capture client credentials. No privileges are needed, and the article reports no exploitation.
What to do
If you build multi-tenant apps on SAP BTP with this SDK, update to the October 2026 release. Until then, check tenant_subdomain against an allowlist of registered tenants before any SDK call.
Never trust a value because it arrived inside your own app. A subdomain is user input.
Wordfence researchers found CVE-2026-39919 on 23 August, a heap buffer overflow in Ghostscript 9.21 through 10.07.1, triggered by a PDF with a crafted JPEG 2000 image. Artifex shipped the fix in 10.08.0 on 8 September, and BleepingComputer reported it on 13 October. Wordfence has not seen exploitation; its WordPress test reached remote code execution, but 10,240 lab runs on Linux packages did not.
What to do
Upgrade Ghostscript to 10.08.0 or later, or check your distribution's backport notes. Rebuild Docker images on a patched base. If you cannot upgrade yet, block PDF uploads or disable PDF rendering in ImageMagick.
A library you never chose is still yours. Find out where PDFs get rendered in your stack today.
On Monday 12 October 2026, GitLab told self-managed users to patch CVE-2026-97229, a maximum-severity flaw in its CI/CD Regular Expression Compiler. BleepingComputer reports that, under certain conditions, it could let an unauthenticated user run code on the server through a crafted regular expression in a CI/CD configuration. Fixed in 19.2.8, 19.3.4 and 19.4.2; GitLab.com already runs the fix.
What to do
If you run GitLab CE or EE yourself, upgrade today to 19.2.8, 19.3.4 or 19.4.2, whichever matches your branch. GitLab Dedicated customers do not need to act, per GitLab.
Self-hosting GitLab makes you the security team for your crown jewels. Patch day is part of the deal.
SonicWall disclosed CVE-2026-102255 on Tuesday 6 October 2026, a pre-authentication SSRF flaw rated CVSS 10 in the SMA1000 Work Place interface of the 6210, 7210 and 8200v. SecurityWeek reported on 12 October that Defused saw the first exploitation attempts on its decoys on 8 October. The fixed versions are 12.4.3-03670 and 12.5.0-03082.
What to do
If you run an SMA1000 6210, 7210 or 8200v, upgrade to 12.4.3-03670 or 12.5.0-03082 today, then review the appliance logs since 6 October for unusual requests to the Work Place interface.
Same appliance, same kind of bug, third time this year. I would patch tonight and read the logs all week.
Let's Encrypt will issue 64-day certificates by default from Wednesday 10 February 2027, down from 90 days, as a step toward 45-day lifetimes planned for 2028. SecurityWeek reported on Monday 12 October 2026 that staging starts issuing 64-day certificates that week. The authorization reuse period drops to 10 days in 2027 and seven hours in 2028.
What to do
Point one ACME client at the Let's Encrypt staging environment and confirm it renews 64-day certificates. If your renewal date is hardcoded, set it to about two-thirds of the lifetime, or use a client that supports ACME Renewal Info (ARI).
Certificates that last a year let you forget. Certificates that last 64 days punish you for forgetting. Automate it once, properly.
Patchstack says attackers are exploiting CVE-2026-85097, an unauthenticated arbitrary file upload flaw rated CVSS 9.8 in Bricksforge, a commercial add-on for the Bricks site builder, SecurityWeek reported on Monday 12 October 2026. Versions 3.1.8.9 and earlier are affected, and 3.1.8.10 fixes it. Patchstack saw in-the-wild attempts from 7 October.
What to do
If your site or a client's uses Bricks with Bricksforge, update Bricksforge to 3.1.8.10 today and check the uploads folder for PHP files you did not put there.
The plugin you forgot you installed is the one attackers remember. Keep a list of what runs on your WordPress, theme and plugins alike.
BleepingComputer reported on Monday 12 October 2026 that Windows 11 24H2 Home and Pro stop receiving updates that week, and that Windows Server 2022 leaves mainstream support on Tuesday 13 October. Microsoft's notice says the November 2026 security update is the last for Windows 11 23H2 Enterprise, Education and IoT Enterprise.
What to do
Run winver on every Windows machine that touches your code or customer data. Move 24H2 Home and Pro devices to Windows 11 26H2, and plan 23H2 Enterprise and Education upgrades before the November update.
Unsupported doesn't mean broken. That's the trap. It keeps working perfectly, for the attacker too.
On Sunday 11 October 2026, the DNS root is scheduled to change the key-signing key that anchors DNSSEC, only the second time ever. KSK-2024 (key tag 38696) replaces KSK-2017 (key tag 20326). Cloudflare warned on Tuesday 6 October that users of a validating resolver that does not trust the new key may be unable to reach sites under any top-level domain.
What to do
If you run your own DNSSEC-validating resolver, in an office, a VPC or a container image, check today that it trusts key tag 38696 with the RFC 8509 sentinel test Cloudflare describes. If it does not, update its trust anchors per your vendor's instructions.
DNS changes nobody watches are the ones that page you on a weekend. Ten minutes with dig today beats a Monday of tickets.
On Thursday 8 October 2026, CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog, with a federal deadline of Sunday 11 October. They hit Strapi (CVE-2023-22894), ONLYOFFICE Docs (CVE-2021-3199), Apache Struts (CVE-2016-3081), ISC BIND (CVE-2015-5477) and ProFTPD (CVE-2015-3306).
What to do
Search your servers, container images and old side projects for Strapi, ONLYOFFICE Docs, Struts, BIND and ProFTPD today. Patch what is still supported, and retire any Strapi version past end of life, as CISA advises.
Attackers don't need new bugs while old ones still pay. A 2015 CVE in production isn't legacy. It's an open door.
On Thursday 8 October 2026, Anthropic published a new Usage Policy that takes effect on 12 November. It adds a section on deceptive campaigns and fake accounts, rewrites the surveillance rules, adds controls for Claude connected to hardware that takes physical actions, and spells out the existing ban on companies majority-owned from unsupported regions.
What to do
Read the rewritten high-risk section before 12 November and check each Claude feature you ship against it. If one is covered, confirm a qualified reviewer can change the output and that users are told AI was involved.
A usage policy is part of your product spec, whether you read it or not. I'd rather find the gap in October than in a customer complaint.
UK retailer Asos has confirmed a breach of customer data, TechCrunch reported on Thursday 8 October 2026, after hackers sent users an in-app notification claiming its data on Snowflake was compromised. Asos told the London Stock Exchange that hackers broke into a third-party platform it uses to contact customers, and says names and contact details were taken. Snowflake says its own systems were not breached.
What to do
List every third-party tool that can message your users, from push to email and SMS, and who holds its credentials. Turn on MFA for each one and for your data warehouse logins today, and rotate shared keys.
Your send button is as valuable as your database. Guard it like one.
On Wednesday 7 October 2026, Anthropic launched Claude Haiku 5.5 (claude-haiku-5-5), with a 1M token context window and up to 128k output tokens. Requests with budget_tokens, non-default temperature, top_p or top_k, or an assistant prefill now return errors. The same text counts as about 30% more tokens than on Haiku 4.5.
What to do
Search your code for budget_tokens, temperature, top_p, top_k and assistant prefills before you switch to claude-haiku-5-5. Then read content blocks by type, not position, and recount your prompt costs.
A cheaper model with a breaking change is still a breaking change. I'd ship it behind a flag, never as a one-line swap.
On Monday 5 October 2026, Apple told developers that iPhone Duo will be available to customers starting 23 October 2026. Xcode 27.1 adds development support for it, and iPhone Duo optimized apps can be submitted in App Store Connect now. Starting April 2027, any app or game submitted will need iPhone Duo screenshots.
What to do
Recompile with Xcode 27.1 today and check every screen in Device Hub across all poses and orientations. Then add iPhone Duo screenshots now, before the April 2027 rule makes them mandatory.
Launch week is when users decide which apps feel native. Be ready on 23 October, not after the first one-star review.
On Tuesday 6 October 2026, Supabase made scoped personal access tokens generally available. A token can be limited to selected projects or organizations, with read or read-write permission per capability and an expiry up to one year out. Existing tokens keep working, and GitHub secret scanning added a detector for the scoped token type on 5 October.
What to do
List your Supabase access tokens today and replace each account-level one with a scoped token that has only the projects, permissions and expiry its integration needs.
Every token is a spare key to your house. Make it open one door, and give it an expiry date.
On Tuesday 6 October 2026, GitHub made stacked pull requests generally available on all github.com plans. Rebase stack now keeps approvals on unchanged code and signs replacement commits, and a stack lands through the merge queue as one merge group. GitHub says repositories using stacks saw 9% more merged code than peers.
What to do
Pick your next large change and split it into a stack of small pull requests. If you run GitHub Enterprise Server, wait: GitHub says support comes in an upcoming release.
Big pull requests don't get reviewed. They get approved. Stacks are how you get real review back.
On Wednesday 7 October 2026, GitHub moved AI-detected password alerts to a purpose-built secret detection model, at no extra charge for GHSP and GHAS customers. Its new opt-in push protection check is in private preview and will consume GitHub AI Credits. GitHub says a check can consume credits even if it doesn't block a push.
What to do
Decide now who in your organization may enable AI push protection, and set an AI Credits budget before the public preview. Billing starts only when your organization opts in and enables it.
Paying to catch a leaked password is cheap. Paying without a budget is how security tools get switched off.
On Sunday, 4 October, CVE-2026-105207 (CVSS 9.8) was published for ZITADEL, the open source identity platform. Versions 3.0.0 through 3.4.15 and 4.0.0 through 4.17.2 let an unauthenticated attacker who knows a victim's login name link their own external identity provider to that account, then sign in as the victim. The fix is 4.17.3.
What to do
If you self-host ZITADEL, check the version today and upgrade to 4.17.3 or later. Still on 3.x, move to 4.x now; disabling external IdP linking only closes part of the gap, says ZITADEL.
End of life is a date on someone else's calendar. Attackers read that calendar too.
Rejetto HFS 3.0.0 through 3.2.0 derived its session-cookie signing key from Math.random() and leaked outputs of that same generator at login (CVE-2026-61500), as Horizon3.ai detailed on 30 September. SecurityWeek reports that on 2 October VulnCheck warned attackers had started targeting it. Version 3.2.1, out since 13 July, fixes it.
What to do
Upgrade any HFS server to 3.2.1 today. Then search your code for Math.random() near tokens, sessions or reset links and replace it with a cryptographic generator such as crypto.getRandomValues().
Math.random() is for shuffling a playlist. Never for the link that resets a password.
AWS ends support for AWS Proton on Wednesday, 7 October 2026. After that date the Proton console and Proton resources are no longer accessible, and AWS says all Proton data will be deleted. Deployed CloudFormation stacks and the resources they manage keep running.
What to do
If you still use Proton, export your templates and list every environment and service today. Then move deployments to CloudFormation Git Sync, CodePipeline and CodeBuild, or GitHub Actions, the paths AWS lists.
AWS closed sign-ups a full year ago. A year of notice still ends in one night, and the clock now counts hours.
On Monday, 5 October, CVE-2026-100103 was published with a CVSS 4.0 score of 10.0. Perforce P4 Search container images before 2026.4.2 reset the service authentication token to a publicly documented default value, letting an unauthenticated network attacker gain the highest privileges, potentially leading to code execution and P4 Server compromise.
What to do
If you run P4 Search from a container image, upgrade to 2026.4.2 or later today, block it from untrusted networks, and review P4 Server logs for admin activity you did not expect.
A default credential is a password you published to everyone. Including the people you hoped would never read the manual.
On Sunday, 4 October 2026, CISA added CVE-2026-88779 in Citrix NetScaler ADC and Gateway to its list of exploited flaws, with a 7 October deadline for federal agencies. The memory flaw (CVSS 8.7) hits appliances set up as a SAML service provider or identity provider. Fixed builds: 14.1-73.41 and 13.1-64.28.
What to do
If you run NetScaler with SAML, check it for signs of compromise, then upgrade to 14.1-73.41 or 13.1-64.28 (or the matching FIPS build) today.
Two NetScaler alarms a week apart. When the same front door keeps making the news, I stop asking if it's patched and start asking who already came in.
Google paused its Open Source Software Vulnerability Reward Program on 1 October 2026, TechCrunch reported on 4 October. The reason Google gave: a sharp rise in automated submissions, most of them not valid. It promises an update in the first quarter of 2027 and points researchers to its other programs.
What to do
If you accept vulnerability reports, require a working proof of concept and the exact affected version before triage starts. Put that rule in your SECURITY.md today.
AI made writing a bug report cost nothing. It didn't make reading one any cheaper.
On 4 October 2026 President Trump named Director of National Intelligence Jay Clayton to chair a new federal 'Super Intelligence Force', TechCrunch reports. FTC Chair Andrew Ferguson, Pentagon technology chief Emil Michael and OPM Director Scott Kupor are vice chairs. It has 120 days to report on risks and opportunities.
What to do
Nothing to do yet; watch for the task force report, due about 120 days from 4 October.
Every rulebook starts as a report nobody reads. I'd rather read this one in February than learn it from a letter in June.
From 5 October 2026, Neon's three Azure regions (azure-eastus2, azure-westus3, azure-gwc) get no new features. Projects in unpaid Neon organizations that sat inactive for 90 days or more become subject to deletion. Paid and active projects keep running, and Neon says a final end-of-service date will be announced later.
What to do
If your Postgres lives in a Neon Azure region, plan the move now: Neon's AWS regions, Databricks Lakebase if you need Azure data residency, or a Postgres export.
When a vendor says 'existing projects keep running', I read the word 'existing' twice.
On 2 October 2026 GitHub finished moving GitHub App installation tokens to a stateless format, a rollout that started on 27 April. Same ghs_ prefix. But about 520 characters now, instead of 40.
What to do
Search your code and schemas today for a 40-character limit on tokens, and treat the token as an opaque string. Still sending the X-GitHub-Stateless-S2S-Token header from testing? Remove it before 30 November 2026, when GitHub deprecates it.
The bugs I fear most don't crash anything. They quietly cut a string short and let you chase the wrong problem for a day.
Lior Aharonov · my take