The Patch

Google has published a piece examining the true costs of using open source software, looking beyond the free licence to factors like maintenance, security patching and long-term support. The article prompts discussion about whether 'free' software genuinely saves organisations money, or whether hidden operational expenses offset the savings, a recurring debate among developers and enterprise buyers.

curl maintainer Daniel Stenberg has announced that twenty-two security vulnerabilities in the widely used curl data transfer library are pending disclosure. The announcement, made on his personal blog, signals a coordinated release of fixes ahead. Developers and security teams are discussing the scale of the batch and the impact on projects that depend on curl, which ships in billions of devices.

Researchers have uncovered a new variant of the DarkSword spyware that affects iPhones which have not installed the latest security updates. The finding highlights the ongoing risk to users who delay patching their devices, as the malicious software can exploit known vulnerabilities left open on unpatched handsets. Security experts are urging iPhone owners to update their devices promptly.

IBM and Red Hat have patched more than 400 previously undisclosed vulnerabilities in open source software. The disclosure highlights ongoing efforts by major enterprise vendors to identify and fix security flaws that were not publicly known, reducing the risk of exploitation for organizations relying on open source components in their systems.

A synthesizer enthusiast has customised two EMS VCS3 units to get them working again, documenting the process in a project write-up. The VCS3, a British analog synthesizer from the late 1960s famous for its distinctive pin-matrix patch system, remains popular among electronic musicians and collectors. Restoring vintage units typically involves recapping, fixing faulty contacts and recreating obsolete parts.

2K has released the second patch for NBA 2K27 today on PlayStation 5 and Xbox Series X|S, applying a range of gameplay and balance changes to the basketball title. The update is scheduled to reach PC and Nintendo Switch 2 players on October 16th. Players are now discussing what the changes mean for the game's meta and performance across platforms.

A vulnerability tracked as CVE-2026-107782 has been published affecting winsiderss' System Informer, an open-source system monitoring and troubleshooting tool. Security feeds are flagging the advisory as part of routine threat intelligence sharing, though details on severity, affected versions and available patches have not yet been widely circulated. Administrators using the tool are expected to review the advisory.

A new vulnerability, CVE-2026-17189, has been published affecting IBM Security Verify Access, the company's access management and authentication platform. The advisory has been circulated by security researchers monitoring CVE feeds. Details on severity and exploitation potential remain limited pending vendor guidance. Organizations running Security Verify Access are advised to track IBM's patch releases.

A new vulnerability identifier, CVE-2026-107781, has been published affecting dromara's skyeye software. Security feeds picked up the advisory and are circulating it under threat intelligence and OSINT tags. Details on severity, affected versions and available patches remain limited, so administrators using the software are expected to watch for follow-up guidance from maintainers.

A newly catalogued vulnerability, EUVD-2026-95256, affects MIT Kerberos 5 (krb5) through version 1.22.2. The flaw is a NULL pointer dereference in the make_cred_list() function in rd_cred.c, which could allow authenticated Kerberos clients to crash services by sending crafted credential data. The issue carries a CVSS v3.1 score of 7.1 out of 10 and was updated on 8 October 2026. Administrators running Kerberos authentication infrastructure are expected to monitor for patches from MIT.