The Patch

Security experts are warning organisations not to overhaul network security in live environments, using the metaphor of repairing an engine while the plane is flying. The argument, raised in manufacturing and business technology circles, is that rushed patching or restructuring of compromised systems can cause more damage than the breach itself, and that careful staged remediation is safer.

Google has published a piece examining how much it costs to use open source software, addressing a common misconception that free-to-use means free overall. The discussion reflects ongoing debates about hidden expenses such as maintenance, security patching and long-term support, which often make open source deployments costlier than expected despite the absence of licensing fees.

Open source cybersecurity is struggling with artificial intelligence: attackers can use AI tools to find vulnerabilities faster and generate malicious code, while defenders are turning to the same technology to detect threats and patch weaknesses. Analysts argue the same capabilities cutting both ways make AI an unavoidable part of securing open source software.

NVIDIA has introduced Boro, an open-source project aimed at supporting AI-assisted development of the Linux kernel. The effort, reported by Phoronix, signals NVIDIA's push to bring AI tooling into core systems programming and could streamline how kernel patches and code review are handled. The Linux kernel community has been actively debating the role of AI in kernel development, making the announcement timely.

Security researchers are discussing a newly reported vulnerability, CVE-2026-80093, in Microsoft's Windows Cloud Files driver component cldflt.sys. The flaw reportedly affects kernel privileges, meaning a successful exploit could give attackers the highest level of access on a Windows machine. Windows users and administrators are advised to watch for guidance from Microsoft on patches or mitigations.

IBM and Red Hat have patched more than 400 previously unknown vulnerabilities in open source software. The newly discovered flaws were addressed as part of the companies' ongoing security work, and the disclosure highlights the scale of hidden weaknesses that can exist in widely used open source components. Details on which projects were affected have not been widely reported beyond the headline.

Reports say Jennifer Lawrence and Kourtney Kardashian have reconciled following a public falling-out between the two stars. Entertainment coverage is focusing on how the pair patched things up, though details of the original dispute and the reconciliation remain largely anecdotal, with little confirmed information about what was said or when.

Nvidia has released a fix for a high-severity vulnerability, tracked as CVE-2026-47483, that could crash GPU monitoring software on servers exposed to the network. Security outlets are covering the flaw and urging administrators running GPU workloads on public-facing servers to apply the patch promptly to avoid monitoring outages.

Security teams are being urged to patch two high-severity flaws. A pre-authentication file read in Atlassian Data Center products, tracked as CVE-2026-21589 with a CVSS score of 9.3, has reportedly been probed in the wild since October 6, with fixed Confluence builds including 9.2.26 and 10.2.19; admins are told to check logs for URL-encoded path traversal. Citrix NetScaler CVE-2026-107406, scoring 9.5, affects SAML SP and IdP configurations and is fixed in 14.1-73.46 and 13.1-64.29.

Citrix has released security patches for a critical vulnerability in NetScaler that could allow remote code execution in deployments using SAML authentication. The flaw could let attackers run arbitrary code on affected appliances, posing a serious risk to enterprises relying on NetScaler for application delivery. Administrators are being urged to apply the updates promptly and review their SAML configurations for potential exposure.

A flaw in NVIDIA's DCGM Exporter, the tool many operators use to monitor GPU health and utilization, can be triggered to crash GPU monitoring, according to a newly published security writeup. The vulnerability raises concerns for data centers and AI clusters that rely on the exporter for visibility into GPU workloads, since a crash could leave teams blind to hardware issues. Administrators are advised to review the disclosure and apply patches or mitigations where available.

A path traversal vulnerability has been catalogued as EUVD-2026-95578 with a CVSS v3.1 score of 9.3. The flaw sits in gvproxy, the network forwarder shipped with the gvisor-tap-vsock package. Its unauthenticated /services/forwarder/expose endpoint reportedly fails to validate input, potentially letting attackers reach files outside intended paths until patched.

Citrix is urging customers to immediately patch a critical vulnerability affecting its NetScaler products. The company's advisory, reported by SecurityWeek, signals that the flaw could pose serious security risks if left unaddressed. Administrators running NetScaler appliances are being told to apply the fix as soon as possible to avoid potential exploitation.

A medium-severity vulnerability, EUVD-2026-95707, has been disclosed in the Shipping for Nova Poshta WordPress plugin, affecting versions through 1.19.8. The flaw, rated 5.3 out of 10 under CVSS v3.1, stems from a missing authorisation check: an AJAX action performs no nonce, authorisation or ownership verification, potentially letting unauthorised users trigger the action. Site owners using the Ukrainian delivery service's plugin are advised to watch for a patched release.

Cisco has released patches for nine critical vulnerabilities affecting NX-OS software and its License On-Prem licensing tool. The flaws allow unauthenticated remote code execution and could give attackers full root-level control of Nexus switches. Administrators are being urged to apply the updates quickly, as unpatched data centre switches could be taken over remotely without credentials.

A critical SQL injection vulnerability, tracked as CVE-2026-93947, has been disclosed affecting the Shinetheme Traveler WordPress theme in versions 0 through 3.2.9. Security researchers warn the flaw is a blind SQL injection that could let attackers extract sensitive database data. Users are being urged to apply patches as they become available and monitor their systems for suspicious activity.