Windows, macOS, browsers, Android, iOS and remote-access clients: exploited flaws and updates.
An unpatched rlottie bug can run code in Telegram, and an Android voice-call flaw hit 8.6.2 to 12.10.3. Update Android to 12.10.4 and limit who can call.
Fake Claude Code 2.1.312 and 2.1.313 on Cursor’s marketplace added an attacker SSH key and reverse tunnel. Check authorized_keys for svc-telemetry.
Chrome 156 updates on 27 and 29 October fixed 73 security bugs, five Critical, most found by Anthropic with Claude. Update to 156.0.8078.79 or later.
One crafted WAP push SMS crashes com.android.phone on Android 12 to 16, dropping calls. Install the October 2026 patch; Android 12 and 13 get no fix.
Warp says an attack on an unnamed vendor exposed agent traces and telemetry for about 1% of users. Rotate any secret that passed through a Warp agent session.
Flaws in TeamViewer’s screen decoder let a malicious host attack the viewer, plus a macOS root bug. Update clients to 15.83 or the fixed legacy builds.
Firefox 159 fixes 167 CVEs, with three sandbox escapes and a same-origin bypass. Update Firefox, ESR 153.6 or 115.44, and Thunderbird 159 or 153.6.
Eight critical flaws in Campaign Classic 7.4.4 build 9402 and earlier allow code execution and SQL injection. Upgrade to build 9403 and update Connect clients.
Docker Desktop 4.39.0 to 4.96.x could log third-party API keys and OAuth tokens in cleartext. Update to 4.97.0 and delete old diagnostics bundles.
Apple’s 26 October updates fix 163 CVEs in iOS 27.2, including WebKit code execution and a sandbox escape. Update iOS, macOS, Safari and older-device builds.
Four chained Plex Media Server bugs give unauthenticated code execution and are widely exploited. Update to 1.43.3.10861 or later and check the Codecs folder.
OVHcloud CLI binaries for v0.11.0 to v0.15.0 fetched on 19 Oct 2026, 12:47 to 14:21 UTC, were an infostealer. Check MD5s, rotate secrets, install v0.16.0.
Eight eMudhra intermediate CA keys were guessable. Browsers block them; update CA bundles and runtimes, and replace TLS certs under emSign ECC Root CA - G3.
A record 1,411-fix release includes an exploited Windows Shell Mark of the Web bypass. Install the October cumulative update and Edge 154.0.4258.62.
Exploited bugs in AhsayCBS, SiteGuard Server Edition and Siemens Software Center joined KEV in October 2026. Fixed builds, workarounds and IOCs for each.
A use-after-free in the Windows WinSock driver gave Lazarus SYSTEM rights to install a rootkit on defense targets. Install the August 2026 Windows update.
An incomplete fix let attackers bypass login and take over N-central admin accounts; exploited. Self-hosted servers need 2026.3.1.14 (HF4) or later.
Dormant RubyGems accounts pushed a fake git_credential_manager that installs a backdoor daemon on developer laptops. Check Gemfile.lock and ~/.local/share/gcm.
Two exploited Defender bugs let a local user gain SYSTEM or disrupt Defender. Check for engine 1.1.26040.8 and platform 4.18.26040.7 or later on every machine.
A trending Hugging Face repo posing as OpenAI’s Privacy Filter ran a loader that installs a Windows infostealer. Check your HF cache; rotate browser sessions.
On shared Windows PCs, AI coding tools loaded system-wide config from a user-writable ProgramData folder. Update Claude Code to 2.1.75 and lock the folders.
Seven 2026 Cursor CVEs let prompt injection or a cloned repo run code outside the sandbox. Update to 3.1.2 or later; the Windows git.exe bug has no stated fix.
Google patched seven Chrome bugs exploited in the wild from February to September 2026. Update Chrome and any bundled Chromium to 153.0.8010.36 or later.
Apple patched two zero-days used in targeted attacks in 2026. Update to iOS 26.7.1, macOS 26.7.1 or 15.8.1, or iOS 18.7.11 on older iPhones.
Attackers hijacked Notepad++ update traffic for months and served a backdoor to chosen targets. Update to 8.9.2 or later and hunt for the listed indicators.
A malicious Office file can bypass OLE protections; APT28 used it in RTF phishing. Install the 26 Jan Office 2016/2019 updates and restart Microsoft 365 apps.
