mercredi 14 octobre 2026

Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave

Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of

Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug

Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code

OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room

A Saudi National and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to covertly record sensitive conversations. Abdulrahman Alfozan, 35, has been charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications. He was arrested by

Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off."

Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that converts a personal account into an organization, Docker said in a security advisory on October 12.

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,

OpenAI engineer arrested for allegedly planting spy device in office

A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. [...]

Ghostscript flaw lets hackers hijack servers via PDF uploads

A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. [...]

Anthropic warns self-replicating AI could spread to your smart devices

Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. [...]

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]

Microsoft releases Windows 10 KB5126657 extended security update

Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]

Microsoft: Windows 11 24H2 Home and Pro reached end of support

Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. [...]

CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure

CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935 , affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026.  CISA urges organizations with affected Ivanti Connect Secure appliances and deploymen

Inductive Automation Ignition Software

View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level. The following versions of Inductive Automation Ignition Software are affected: Ignition >=8.1.0|<=8.1.54 (CVE-2026-92817) Ignition >=8.3.0|<=8.3.8 (CVE-2026-92817) CVSS Vendor Equipment v3 8.8 Inductive Automation Ignition 1 Vulnerability Incorrect Authorization Background Critical Infrastructure Sectors: Critical Manufacturing, Energy, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: United States V

Swann Communications SWIFI-SE2KIC

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. The following versions of Swann Communications SWIFI-SE2KIC are affected: SWIFI-SE2KIC firmware <=2.0.22 (CVE-2026-107605, CVE-2026-107606, CVE-2026-107607) CVSS Vendor Equipment v3 6.2 Swann Communications SWIFI-SE2KIC firmware 1 Vulnerability Missing Authentication for Critical Function Background Critical Infrastructure Sectors: Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Australia Vulnerabilities Expand All

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96951 Microsoft Windows Command Injection Vulnerability CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.  Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Bra

Introducing Privateer: AI-Assisted Security & Compliance Evaluation Framework Joins the OpenSSF Sandbox

Discover Privateer, a new plugin-based, AI-assisted security and compliance evaluation framework that has officially joined the OpenSSF Sandbox under the ORBIT Working Group.

GitHub’s model for secret detection: Finding more secrets with less noise

GitHub’s context-aware secret classifier improves detection quality, raises weighted acceptance by 11.5%, and reduces median scan execution time by 86%. The post GitHub’s model for secret detection: Finding more secrets with less noise appeared first on The GitHub Blog .

Agent Baseline Publishes Security Reference Architecture for Software Factories

Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.

Symfony 8.1.9 released

Symfony 8.1.9 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project. Tip…

Symfony 7.4.21 released

Symfony 7.4.21 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project. Tip…

Symfony 6.4.48 released

Symfony 6.4.48 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project. Tip…

v8.1.9

Changelog ( v8.1.8...v8.1.9 ) minor #66917 Release v8.1.9 bug #66905 [DoctrineBridge] Reset a non-lazy manager instead of emptying it ( @HypeMC ) minor #66903 [Form][Validator] Fix Tagalog (tl) translations and typos ( @jcparucha ) bug #66899 [HttpClient] Fix RetryableHttpClient::withOptions() changing the base URIs of the original client ( @nicolas-grekas ) bug #66885 [Messenger] Fix PhpSerializer::getMessageType() when a stamp holds the message ( @lyrixx ) bug #66894 [DependencyInjection] Fix ignoring env var processors after resolving env vars before compilation ( @nicolas-grekas ) bug #668

v7.4.21

Changelog ( v7.4.20...v7.4.21 ) minor #66916 Release v7.4.21 bug #66905 [DoctrineBridge] Reset a non-lazy manager instead of emptying it ( @HypeMC ) minor #66903 [Form][Validator] Fix Tagalog (tl) translations and typos ( @jcparucha ) bug #66899 [HttpClient] Fix RetryableHttpClient::withOptions() changing the base URIs of the original client ( @nicolas-grekas ) bug #66885 [Messenger] Fix PhpSerializer::getMessageType() when a stamp holds the message ( @lyrixx ) bug #66894 [DependencyInjection] Fix ignoring env var processors after resolving env vars before compilation ( @nicolas-grekas ) bug #

v6.4.48

Changelog ( v6.4.47...v6.4.48 ) minor #66915 Release v6.4.48 minor #66903 [Form][Validator] Fix Tagalog (tl) translations and typos ( @jcparucha ) bug #66899 [HttpClient] Fix RetryableHttpClient::withOptions() changing the base URIs of the original client ( @nicolas-grekas ) bug #66894 [DependencyInjection] Fix ignoring env var processors after resolving env vars before compilation ( @nicolas-grekas ) bug #66892 [DependencyInjection] Fix dumping strings like "50 of 100" ( @nicolas-grekas ) bug #66883 [HttpKernel] Release the services of the container when the kernel shuts down ( @nicolas-greka

SymfonyCon Warsaw 2026: Mercure 1.0: Real-Time Symfony, Eight Years On

Want to level up your PHP and Symfony game? SymfonyCon Warsaw 2026 is heading to Poland this November 26-27. Join devs from all over the world for two solid days packed with 3 parallel tracks and community events. Grab your spot and get ready!…

Redesigning source control at Anthropic

Redesigning source control at Anthropic Interesting piece from Anthropic describing why and how they built their own custom alternative to Git, based on the dramatic increase in rate of changes to their code after the past six months. In May 2026, Anthropic averaged around 2,500 code changes merged per day; as of September, we merged over 30,000 per day. They included a chart showing those changes. I had Claude modify their chart ( code here ) to add markers for the public releases of each of their models in 2026: This shows public release dates, not the date when models became available for A

llm-gemini 0.35

Release: llm-gemini 0.35 I added support to llm-gemini for the new Gemini 4 Argon model, made available today via the Gemini API and for customers of their $100/month subscription plan. Here are the low, medium and high pelicans . As expected, they are all excellent: Gemini has a track record of producing great SVGs, and are the only lab where I know their staff have invested in SVG specifically (and who have boasted about their pelicans before.) Here's the "high" illustration, which cost me 17.166 cents: The pricing is interesting. At launch, Argon is $2/million input and $10/million output -

Run fast, private agents on-device with LFM2.5-24B-A2B

Gemini 4 Argon: Built to solve your hardest problems

We’re giving developers, enterprises, scientists, and consumers access to Gemini 4 Argon, our latest frontier model.

Quoting Geoffrey Huntley

If the agent isn't using my diagnostics library, I could introspect and update AGENTS.md, but there's still a delta, and it'll drift. Instead, I write a pre-commit hook that checks the git diff for direct calls to observability modules that bypass my diagnostics module. Boom: fail the commit, inject a prompt telling the agent to use the diagnostics library. All of a sudden it's ten out of ten. — Geoffrey Huntley , nobody should type code by hand anymore. here's what's left. Tags: coding-agents , generative-ai , git , agentic-engineering , ai , geoffrey-huntley , llms

Higgsfield takes AI video from 1 minute to over 10

Higgsfield brings creators longer videos with GPT-6 Astra, precise visuals with GPT-Image-2.5, and a path to voice filmmaking with GPT-Live.

Under the hood, off the hot path: How D1 scales to millions of databases

A deep dive into how D1 architected its control plane to scale and manage millions of databases, while keeping data plane query operations at the edge. We share guiding principles on how to build on the Developer Platform effectively.

Rewinding the exponential: How we keep hardware usage down

Our strategies to optimize our data pipeline throughput without compromising data quality.