GoKawiil
Tech News
Microsoft released cumulative updates KB5127648 and KB5127646 fixing a bug that broke Always On VPN connections on Windows 11 24H2 and later systems after installing September 2026 security updates. The issue affected devices using automatic protocol selection between IKEv2 and SSTP, causing connections to hang or fail with a port-in-use error when an initial attempt didn't succeed.
At ESUG 2026, a developer presented Pulsar, a new integrated development environment for Pharo built around staying close to the code rather than relying on generative-agent workflows. The presenter released the talk's slides and video online and described Pulsar as usable but still a work in progress, inviting feedback from users.
CISA is directing admins to immediately patch CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure that has been exploited as a zero-day since at least October 1. Ivanti released patched versions on Tuesday, and researchers at Volexity and Defused say an unknown threat actor chained the bug with two other flaws to gain unauthenticated root access and steal Active Directory credentials, LAPS passwords and BitLocker keys.
Semperis's 2026 Ransomware Risk Report found that 40% of surveyed organizations experienced intimidation or threats tied to ransomware attacks, including threats against employees' families, physical intrusion, stalking, and abduction. More than half of those threatened said attackers actually followed through, though Semperis relied on self-reported data that couldn't be independently verified.
Microsoft released updates addressing more than 1,400 security vulnerabilities across Windows and other software, far exceeding September's previous record of about 1,000 fixes. One flaw, CVE-2026-96951, a Windows Shell security feature bypass, is already being exploited in the wild, while another, CVE-2026-108398 in the .NET Framework, was publicly disclosed before patching though not yet seen exploited. At least 78 of the fixes are rated critical, mostly allowing remote code execution.
At TechCrunch Disrupt 2026, Cerebras Systems CEO Andrew Feldman said personal AI assistants that operate in the home are close to becoming reality, citing consumer AI agents like Meta's Muse and the $10 billion startup Instinct as evidence of growing adoption. He described a future where these assistants run partly on-device and partly in the cloud, learn user habits, and even handle purchases via linked credit cards within a defined security boundary. Feldman also said he personally uses several AI agents to manage his calendar and prepare for calls.
At TechCrunch Disrupt 2026, Cerebras Systems CEO Andrew Feldman said some AI industry leaders should rethink their public commentary, arguing that warnings about AI risks have overshadowed its potential benefits, such as curing cancer. He acknowledged that powerful technology carries risks of misuse and said the industry needs thoughtful, reasonable regulation, while also noting the sector has handled local community relations around data center buildouts poorly.
Rivian CEO RJ Scaringe announced at TechCrunch Disrupt 2026 that Doug Field, formerly Ford's EV chief and a veteran of Tesla, Apple and Segway, has joined Mind Robotics as president. Field will oversee product, engineering and operations at the industrial AI and robotics startup, which Rivian founded a year ago and has raised over $1 billion for from investors including Accel, Andreessen Horowitz, Kleiner Perkins, and Volkswagen and Salesforce's venture arms.
Alameda-based startup Longshot Space Technology, led by CEO Mike Grace and CTO Nato Saichek, is developing a multi-stage gun system that accelerates projectiles toward orbit instead of using rockets. The company has raised roughly $20 million from venture investors and is currently testing a 70-foot, six-inch-diameter gun that has fired projectiles at speeds up to Mach 4. Longshot plans to present its technology at TechCrunch Disrupt 2026.
Wordfence researchers using their Argus AI system found a critical heap buffer overflow in Ghostscript, the PostScript/PDF rendering engine used by tools like ImageMagick and WordPress's thumbnail generator. A malicious PDF embedding a JPEG 2000 image can force Ghostscript to write far more data than a buffer can hold, corrupting memory and allowing unauthenticated remote code execution. The bug affects Ghostscript versions 9.21 through 10.07.1 and was confirmed present across ten tested Linux distributions and an official WordPress Docker image.
Microsoft has released KB5126657 for Windows 10, available to Enterprise LTSC and ESU-enrolled devices via Windows Update. The update brings systems to build 19045.7807 (19044.7807 for LTSC 2021) and folds in this month's Patch Tuesday fixes, which addressed 1,411 vulnerabilities including one actively exploited zero-day. It also adds permanent Daylight Savings Time support for British Columbia and Alberta, a new Manitoba Standard Time zone, auditing controls for ReFS volumes on external storage, and a Storage Spaces fix.
Docker disclosed a critical flaw in Docker Hub where converting a personal account into an organization could reassign that account's personal access token to a named owner without rotating the token or requiring the target's consent. An attacker could exploit this to authenticate as the target user, gaining the ability to pull, push, or delete images in their repositories, depending on the token's scope and permissions. The bug has existed since August 26, 2024, though it did not grant web access or allow changes to passwords, email, or two-factor settings.