The Patch

Several security vulnerabilities have been discovered in the Linux kernel. The disclosure is drawing attention from developers and system administrators, who are closely watching for patched kernel releases and guidance on which versions are affected. Admins are expected to apply updates promptly, as kernel flaws can expose servers and embedded systems to privilege escalation or other attacks.

Google is ending support for ChromeOS two years earlier than originally planned, cutting short the lifespan of the operating system that powers Chromebook laptops. The change is drawing attention from developers and Chromebook owners concerned about what it means for device updates, security patches and long-term usability of hardware already in circulation.

Southern Ontario is waking up to fog patches on October 3, with temperatures climbing to a high near 20 C through the day, according to INsauga's weather report. Toronto and surrounding areas are watching conditions as the mild, misty start sets the tone for early October across the region.

Kernel maintainer Greg Kroah-Hartman discusses software security in an era when large language models are increasingly used to write code. The talk, shared as a video, examines how AI-generated contributions affect the Linux kernel's review process and the challenges of maintaining security standards as LLM-assisted development spreads. Readers are weighing how maintainers can vet code at scale when machine-written patches grow in volume.

Sony has updated the PlayStation 5 Slim with improvements to its cooling system and easier repairability, changes similar to those introduced with the PS5 Pro. The revision is drawing attention in Germany, where coverage highlights what it means for buyers. Meanwhile, PS5 users are also discussing update 1.002.000 for Marvel's Wolverine, which marks the debut of QSSR support.

Attackers are actively exploiting a vulnerability in Cisco's SD-WAN software, according to a breach roundup from BankInfoSecurity. The report groups the Cisco flaw with other recent security incidents and breach news. The flaw affects organizations using Cisco's software-defined wide area networking product, and defenders are being urged to apply available patches and review their systems for signs of compromise.

A critical vulnerability, tracked as CVE-2026-9862, has been disclosed in Fortra's BoKS Core Privileged Access Manager. The flaw is an OS command injection issue, meaning an attacker could potentially execute arbitrary system commands on affected servers. Because BoKS is used to manage privileged access at enterprises, security teams are being urged to review their exposure and patch promptly.

Apple has determined that iPhone 18 Pro Max units affected by lost AT&T cellular service cannot be repaired with a software or hardware fix and must instead be replaced. The issue leaves affected users without service on the carrier, and owners are being directed to swap their devices rather than wait for a patch.

Milwaukee Brewers manager has named Dustin May the starter for Game 3 of the National League Division Series against the Padres, despite May struggling through a rough patch at the end of the regular season. The decision signals the club's confidence in the right-hander as the playoff series shifts to Milwaukee.

Apple has released a fix for a security vulnerability in the iPhone that the company says may have been actively exploited in targeted attacks. Users who have delayed recent iOS updates are being urged to install the patch now. Security experts recommend checking that your device is running the latest software to stay protected.

A headline circulating among security professionals suggests a recent kernel update itself caused denial-of-service and privilege escalation attacks. Security engineers are pushing back, clarifying that the update actually patches vulnerabilities that could enable such attacks. Since 2024 the Linux kernel project acts as its own CVE Numbering Authority, assigning identifiers for flaws directly, which has changed how fixes and disclosures are labeled and reported.

Zammad has issued a security alert for CVE-2026-102489, a session hijacking vulnerability that can lead to remote code execution as the Zammad service account on affected older installations. DIVD reports that the flaw has already been exploited in a real-world incident, prompting urgent calls for administrators to update their systems.

A missing-authorization vulnerability, CVE-2026-104991, has been disclosed in Alanaktion Phproject. Authenticated users with API keys can bypass restricted-issue controls to read issue contents, comments and email addresses, and post unauthorized comments. Versions 1.1.6 through 1.8.6 are affected. Security communities are sharing the advisory as administrators assess whether their deployments need patching.

Gardening experts say autumn is the ideal time to reseed fescue lawns, as cooler temperatures and moist soil help new grass establish strong roots before winter. Homeowners are being advised to overseed thin or bare patches now to ensure a fuller, healthier lawn come spring, making lawn care a timely seasonal topic.

Workarounds for hardware bugs in Fujitsu's MONAKA ARM-based server processor have begun landing in the Linux kernel. The patches address errata so the new CPU, Fujitsu's flagship data centre chip, can run reliably on mainline Linux. Coverage has come via Phoronix, which tracks kernel development closely.

GitLab has fixed a critical vulnerability, tracked as CVE-2026-90970, affecting its AI Gateway component. Security outlets are urging users to update their deployments promptly, as flaws in AI gateway infrastructure could expose sensitive data or allow unauthorized access. Administrators are advised to review the advisory and apply the patch as soon as possible.

GitLab has disclosed CVE-2026-90970, a critical remote code execution vulnerability in its AI Gateway service. The flaw allows authenticated users with Duo Agent Platform access to escape the prompt sandbox and execute arbitrary commands. Self-hosted instances are affected, and security teams are being urged to patch promptly.

AI agents are increasingly finding and exploiting vulnerabilities in open source software, prompting maintainers and companies to speed up their patching cycles. The trend raises concerns that automated tools could scale up exploitation of known flaws before fixes reach users, putting new pressure on open source security practices and update processes across the software industry.

A gardener has reached the end of the growing season, digging up the last crops standing — green bell peppers and eggplants — to run through a shredder and compost into mulch for next year's beds. With the plants cleared away, the patch is being put to rest for winter, marking a quiet close to the gardening year.

A new vulnerability tracked as CVE-2026-88779 has been disclosed affecting Citrix NetScaler ADC and NetScaler Gateway, with a high severity rating of 8.7 on the CVSS scale. The finding is circulating among cybersecurity professionals, who are monitoring the flaw for details on exploitation and the availability of patches from Citrix.

Security teams in the DACH region are being warned about newly disclosed zero-day vulnerabilities in Citrix NetScaler remote access products and Cisco SD-WAN Manager. Both flaws are reported to be actively exploited in the wild, putting operational technology environments at particular risk through exposed remote access points. Practitioners are urged to patch immediately, hunt for signs of compromise and review edge device exposure this week.

The U.S. Cybersecurity and Infrastructure Security Agency has added flaws affecting Zammad GmbH's open-source helpdesk software to its Known Exploited Vulnerabilities catalog, indicating the bugs are being actively abused in attacks. Inclusion in the catalog typically requires federal agencies to patch promptly and signals heightened risk for organisations running the software.

Security practitioners are pressing organisations to immediately verify their Citrix NetScaler versions, warning that a known vulnerability demands patching even on a weekend. The message urges admins not to wait until Monday, reflecting ongoing concern in the infosec community about unpatched edge devices being exploited. Administrators are advised to confirm their deployed versions and apply fixes without delay.