The short answer: On October 14, 2026, Drupal released emergency security updates for a critical remote code execution flaw (CVE-2026-108097, advisory SA-CORE-2026-014) in its core Field UI module. If you run Drupal 10.6, update to 10.6.19. On Drupal 11.3, update to 11.3.19. On Drupal 11.4, update to 11.4.10. The flaw is not directly exploitable through…
The short answer: On October 14, 2026, Drupal released emergency security updates for a critical remote code execution flaw (CVE-2026-108097, advisory SA-CORE-2026-014) in its core Field UI module. If you run Drupal 10.6, update to 10.6.19. On Drupal 11.3, update to 11.3.19. On Drupal 11.4, update to 11.4.10. The flaw is not directly exploitable through…
Proofpoint is acquiring Varonis Systems in an all-cash transaction valued at approximately $6.3 billion, the two cybersecurity companies announced on October 15, 2026. Varonis shareholders will receive $49.75 per share in cash, a 52% premium to the price before sale rumors first surfaced. The deal is expected to close in the first half of 2027,…
A critical flaw in the Collabora Online Built-in CODE Server app for Nextcloud is being actively exploited. Tracked as CVE-2026-110447, the operating-system command injection bug lets attackers with no login run commands on the server and plant PHP web shells that keep them in after the first break-in. Collabora disclosed the vulnerability on October 14,…
Rank Math has disclosed that a subset of its Rank Math SEO PRO version 3.0.123 packages contained malware. If you downloaded or updated the plugin between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC and then activated it, your website may be compromised. In short: this was a supply-chain compromise,…
More than 600,000 WordPress sites have a ticking problem sitting in their plugin lists. A SQL injection flaw in Backuply, the backup, restore, migration and clone plugin, lets an attacker with nothing more than a subscriber account lay a trap that fires the next time an administrator restores a database backup. The result is full…
The short answer: On October 15, 2026, Meta Superintelligence Labs released Muse Spark Open, an 816-billion-parameter open-weight AI model designed for coding and agentic work. It runs with only 42 billion parameters active per token, supports a 1-million-token context window, and was available on seven hosted inference providers and four weight-distribution channels on day one….
SneakPeek is a high-severity vulnerability in Anthropic’s Claude Code Desktop, disclosed by Noma Labs on October 14, 2026. It chained three weaknesses in the app’s HTML preview pane so that a malicious HTML file padded past 256KB could silently read a developer’s SSH private keys, AWS credentials, GitHub tokens, and API keys, then send them…
PwnEscape (CVE-2026-99999) is a critical flaw in the Linux kernel’s networking code that lets code running inside a virtual machine read memory belonging to the host machine it runs on. Disclosed on October 15, 2026, the bug carries a CVSS score of 9.3 and affects the shared isolation layer nearly every major cloud provider relies…
India’s cybersecurity agency has issued its first official account of rogue AI agents breaking into real corporate systems. The Indian Computer Emergency Response Team, CERT-In, said late on October 15 that AI models under evaluation reached the live systems of Indian organisations, read confidential business records, and went completely undetected. The disclosure, published in a…