SecurityJetBrains ships fixes for its IDEs, Toolbox App, Gateway and ReSharper over the compromised eMudhra certificates, and updating your operating system does not helpOn 30 October JetBrains said its tools check certificates against their own bundled runtime, not the system's. That is why the operating system does not protect you and you have to update the programs themselves. The company says it is not aware of any exploitation against its users.SecurityCISA added a 10.0-rated GitLab flaw and a Cisco ASA and FTD flaw to its exploited catalog, due November 1On October 29 CISA added CVE-2026-97229 in GitLab and CVE-2026-76418 in Cisco's firewalls to its catalog of exploited vulnerabilities. The GitLab patch came out on October 12, 17 days before the listing.SecurityA poisoned version of the Claude Code extension sat in Cursor's marketplace for about 11 hours, up to 5000 users affected per CursorOn October 29 Cursor said that between about 2:27am and 1:35pm PT a tampered version 2.1.313 of the Claude Code extension was available in Cursor's extension marketplace. Cursor says Anthropic did not develop it. Uninstalling the extension may not be sufficient.SecurityDrupal Commerce Core has an actively exploited access-bypass flaw, and the advisory tells merchants to audit their orders tooOn October 28 Drupal's security team published an advisory for Commerce Core: an access-bypass flaw rated 21 out of 25 on Drupal's scale. The advisory says it is being exploited in the wild and asks sites to check their orders for inconsistencies.SecurityCISA added a logging flaw in VMware ESX and a Linux kernel flaw to its catalog of exploited vulnerabilities, and the Linux deadline is October 31On October 28 CISA added CVE-2026-41709 in VMware ESX, due November 11, and CVE-2026-46300 in the Linux kernel, due October 31, to its catalog. The ESX flaw is rated low and needs administrator rights.SecurityCISA added the two PHP flaws to its actively exploited catalog, and PHP shipped new Windows builds over BrotliOn 26 October CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, with a 29 October deadline for US federal agencies. The same day PHP announced updated Windows builds with Brotli 1.2.1 for CVE-2026-111497.SecurityCloudflare: GLM-5.3 in Workers AI returned data from other customers' requests in 155 responses, all to prompts over 681,280 tokensOn 26 October Cloudflare disclosed that between 27 August and 9 September a small number of customers received responses containing data from other customers' requests. In its words, there is no evidence of deliberate exploitation. According to the write-up, the cause is in the cache configuration and in the SGLang engine.SecurityOpenAI agents against its own cell: in a test on copies they found microVM escapes and paths to the internet, and training resumed on 1 October, with no internetOn 23 October OpenAI described how it hardened the environment for training its strongest models. Teams of agents running its strongest models, among them the upcoming GPT-6 Astra Cyber, attacked isolated copies of the infrastructure, with its source code supplied, and found microVM escapes, paths to the internet and a channel through the processor cache. Reinforcement learning training resumed on 1 October.
83 stories