The Patch

Multiple security vulnerabilities have been discovered in the Linux kernel, the core component of Linux operating systems used across servers, desktops and embedded devices worldwide. The finding, covered by LWN, is drawing attention from developers and system administrators who are watching for patched kernels and assessing whether their systems need urgent updates.

The Morphe Patches project can turn Google Maps into an 'Ungoogled Maps' build that runs without Google Play Services. According to its description, it bypasses Play Services checks and uses Android's own location provider, making the app less dependent on Google's infrastructure. It is being discussed among users interested in de-Googled Android setups.

Deadlock, Valve's unannounced hero shooter and MOBA hybrid, has received a substantial new update. The patch brings gameplay changes, balance adjustments and other revisions as development continues behind closed doors. Players in the ongoing invite-only playtest are discussing the changes and sharing impressions across social media and gaming forums.

Destiny 2, Bungie's online sci-fi shooter, has received a new official update. Details on what the patch changes are limited so far, but the release is drawing attention from the game's community, with players checking what has been adjusted and discussing the changes online.

Blizzard has released a new set of hotfixes for World of Warcraft dated October 6, 2026. The update adjusts gameplay issues through server-side fixes without requiring a client download. Players typically follow these patch notes closely to see which classes, dungeons or bugs were affected.

Google rolled out its October 2026 update for the Pixel 11 series, but the phones are still not running Android 17 QPR1. Owners are noting the gap between the latest security patch and the newer Android release, which some expected to arrive around the same time. It remains unclear when the Pixel 11 line will pick up Android 17 QPR1.

curl maintainer Daniel Stenberg has disclosed that twenty-two security vulnerabilities in the widely used curl data transfer library are pending release, with fixes and details expected on October 7, 2026. The unusually large batch has drawn attention across the developer and security communities, given curl's presence in countless operating systems, applications and embedded devices worldwide.

Apple is telling iPhone 18 Pro Max owners on AT&T who run into cellular connectivity problems that the fix is a full device replacement rather than a software patch. The guidance is circulating among Apple users and tech forums, with many discussing what appears to be a hardware-level fault affecting service on AT&T's network and how Apple is handling warranty swaps for affected customers.

The MISP threat intelligence platform has released version 2.5.48, bringing numerous security fixes, a new XLSX export feature, removal of misp-modules tags, and a range of bug fixes. The open-source update is aimed at organisations that use the tool for cyber threat intelligence sharing and incident response.

IBM and Red Hat say their Lightwell Clearinghouse initiative has delivered hundreds of fixes for open source software. The companies frame the programme as a coordinated effort to identify and patch vulnerabilities across widely used open source projects. The announcement highlights growing corporate investment in the security and maintenance of the open source ecosystem, though details on which projects were fixed remain limited.

Microsoft developer blog author Raymond Chen has published a new Old New Thing post examining what happens when someone attempts to hot-patch a function that has already been hot-patched. The piece walks through the mechanics of runtime code patching on Windows and the complications that arise from layering patches on top of each other, drawing comment and discussion from developers.

NBA 2K27 is rolling out Version 2.0, patch 1.008, on October 8, bringing what publisher 2K describes as major improvements to the basketball game. Players can expect a sizable download on all platforms as the update lands worldwide.

Progress Software has released a patch for a critical command injection vulnerability, tracked as CVE-2026-91140, affecting its DataDirect ARC GenAI Agents. The flaw allowed attackers to execute arbitrary code through malicious OpenAPI input. Security teams are being urged to apply the update promptly, as the vulnerability could expose AI agent deployments to remote code execution attacks.

New releases of XOrg Server 21.1.25 and Xwayland 24.1.14 patch multiple security vulnerabilities, and users are being urged to update their systems as soon as possible. The announcement is drawing attention in the Linux and open-source community, where these components are widely used to handle graphics display duties on Linux desktop systems.

Google has released its October software update for Pixel smartphones. The update includes relevant security patches alongside a number of bug fixes for the devices. It is part of Google's regular monthly maintenance cycle for its in-house Android handsets, and Pixel owners are advised to install it to stay protected.

CD Projekt Red has rolled out a substantial patch for the new Witcher 3 Remastered edition on PC and consoles, adding expanded lighting-related options among other improvements. A separate patch for the Switch 2 version is planned to address blurry visuals on that platform. Gamers are discussing the update's scope and the delay for Nintendo's handheld.

A new entry in Microsoft's Old New Thing blog by longtime developer Raymond Chen walks through what happens when someone attempts to hot-patch a Windows function that has already been hot-patched. The post dives into the low-level mechanics of binary patching on Windows, and programmers on Hacker News are sharing and discussing the technical details.

Researchers are documenting the rapidly melting ice patches on Montana's Beartooth Plateau, where Beartooth Highway (US-212) is set to close Tuesday. Ice patches thousands of years old were found thinner than last year, with surveys rushed ahead of forecast snow expected late Sunday or Monday. Melting should pause as the weather system moves through next week, but the findings underscore accelerating ice loss in the region.

IBM and Red Hat have released fixes for more than 400 open source vulnerabilities, according to eeNews Europe. The patch batch covers security flaws across Red Hat's enterprise Linux offerings and associated open source components. System administrators are being urged to review the advisories and apply updates promptly, as the sheer volume of fixes suggests a significant number of packages were affected in this cycle.

IBM and Red Hat have fixed 400 previously unknown vulnerabilities in open-source software. The companies disclosed the security fixes jointly, addressing flaws across widely used open-source components. The scale of the patch effort is notable, as zero-day-class issues in common open-source libraries can affect a broad range of systems that rely on them, prompting developers to update their deployments.

IBM and Red Hat have released fixes for around 400 security vulnerabilities in open source software, according to a report from Technology Decisions. The patch batch covers flaws across the companies' enterprise Linux and open source offerings. Updates of this scale matter to organizations running critical systems on Red Hat platforms, as unpatched bugs can leave servers and cloud deployments exposed to exploitation.

A free coding bench can draft a patch in minutes, but that speed does not sign the merge decision: a named maintainer still owns every diff that lands. Observers warn that contribution metrics reward visible pull requests over careful ownership, so shared repositories risk filling with polished diffs that arrive with thin context and little accountability behind them.

Android users are being reminded how to verify whether their phone is still receiving monthly security updates from Google and their device maker. Knowing how to check the patch level in settings helps people understand if their handset remains protected against known vulnerabilities, a growing concern as support periods for older phones expire.

A daily threat briefing reports that Atlassian issued a patch on Monday, and that exploitation attempts against the flaw began just two hours after technical details became public. The brief, part of a series read out with an AI voice, highlights how quickly attackers now weaponise disclosed vulnerabilities, leaving organisations almost no window to apply patches before being targeted.

SonicWall has released patches for four vulnerabilities in its SMA 1000 series secure access appliances, including a critical pre-authentication SSRF flaw tracked as CVE-2026-102255 with a maximum CVSS score of 10.0. The flaws could let unauthenticated attackers target the appliances remotely, making rapid patching urgent for administrators.

Security researchers have disclosed a new variant of the Spectre v2 side-channel attack, dubbed Branch Target Reuse (BTR), which can extract secrets from memory through just-in-time (JIT) compilation engines. The flaw affects processors from Intel, AMD, and Arm. Researchers have demonstrated two working exploits, raising concerns about patching challenges across affected chip platforms.

Aon has published an analysis of a ransomware attack attributed to the Termite group, which exploited CVE-2024-50623, a vulnerability in Cleo file-transfer software. The flaw allowed attackers to gain unauthorised access to systems before deploying ransomware. Security teams are being urged to patch Cleo installations and review exposure to the vulnerability.

Google has released its October Android security update, fixing more than 25 vulnerabilities, seven of which are rated critical. Most of the patched flaws are privilege escalation issues that could let apps gain unauthorized access to a device. Users are advised to install the update promptly once it reaches their devices.