GoKawiil
Tech News
A root-user broadcast posted early Saturday morning recounts a brutal week of patching: a routine Monday fix, Patch Tuesday, an 'Exploit Wednesday' after someone reverse-engineered the patch diff, and an out-of-band fix on Thursday. The message, styled as a mock CVE advisory, asks the security community to pause filing vulnerabilities, reserving CVE numbers, or publishing proof-of-concept exploits for just 24 hours.
Motorola has pushed a new software update to the Razr Fold (2026) that brings the October 2026 security patch, after the device had been stuck on August's patch. The update, confirmed via builds spotted on Reddit for both unlocked and Verizon models, does not include Android 17, leaving the foldable on Android 16 even as cheaper Motorola phones like the Edge 60 Fusion and Edge 60 Pro run the newer OS.
Researchers including University of Bergen Ph.D. student Shea Cheatham report that the Great Pacific Garbage Patch appears to be changing the color of the surrounding ocean water. The team says microplastic accumulation is the likely cause but has not yet confirmed this directly, and plans a field expedition to the patch to verify the link.
The pgrust team released v0.4-beta featuring Gravity, a new query engine built with a custom compiler that generates machine code for SQL queries. According to the developers, Gravity runs up to three times faster than ClickHouse on the ClickBench benchmark while still supporting the full Postgres SQL dialect and type system. The engine builds on earlier work using batching, operator fusion, SIMD, and a copy-and-patch JIT compiler.
Researchers report that GLM 5.3, an open-weight AI model released by Z.ai in August, was able to identify and exploit Firefox vulnerabilities during the gap between a security fix being published and reaching users. They found that Firefox versions released between September 17 and October 26 could be compromised this way, with the model building a malicious webpage that silently stole a file from a visitor's computer, at a cost of roughly $1,000 per version. The researchers disclosed the issue to Mozilla, which shipped Firefox 159.0 on October 27, 2026 patching a previously undisclosed vulnerability the model had also used.
IEEE Computer Society argues that the traditional vulnerability-management timeline, built around 30/60/90-day patching windows based on severity, no longer matches reality. Attackers are now exploiting disclosed flaws within hours rather than weeks, outpacing the quarterly or monthly patch cadence many organizations still rely on. The piece points to identity governance as an emerging focus for closing this gap.
A tipster account called PlayStation Game Size reports that Grand Theft Auto VI's download size on PS5 will be approximately 210 gigabytes, based on data pulled from the PlayStation Store backend. Rockstar's game launches November 19 and will ship without a physical disc, meaning even boxed retail copies will only include a download code.
Security researchers at Calif (working with OpenAI's Patch the Planet program) and Wiz (owned by Google Cloud) independently found two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both teams used frontier AI models, including GPT-5.6 Sol and Gemini 4 Argon, to identify the flaws and build working exploits. One of the bugs had actually been flagged in a 2024 PHP Foundation audit funded by the Sovereign Tech Agency, but was left unpatched because no one could devise a practical exploit at the time.
Microsoft told IT admins it wrongly marked an Always On VPN connection bug as resolved in October 2026 Windows 11 cumulative updates, reverting the status to 'Mitigated.' The bug, first acknowledged in September, can leave VPN connections stuck or failing with a 'port already in use' error on Windows 11 24H2 systems using automatic protocol selection.
OpenAI says researchers using its GPT-5.6 Sol model under the 'Patch the Planet' program discovered critical vulnerabilities in PHP, the language that powers roughly 70% of websites. The PHP Foundation has issued patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, though older PHP 8.1 and earlier releases won't be fixed. The coordinated disclosure was moved up a day to Oct. 21 after some details leaked publicly on Oct. 20.
GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for its Community and Enterprise Editions on October 21, 2026, fixing an integer overflow vulnerability in its regular expression compiler tracked as CVE-2026-110264. GitLab.com is already running the fix, and GitLab Dedicated tenants on certain internal builds already include it, but self-managed installations must upgrade manually.
The NSA issued an alert on two severe vulnerabilities in PHP, the server-side language that underpins roughly 70% of websites, including those running WordPress. The flaws, present since PHP version 5 in 2004, let attackers access a server's file system or database, and the PHP Foundation has already released patches, recommending an update to PHP 8.5.12. The bugs were uncovered through AI-driven security research: one by Calif using OpenAI's GPT-5.6 Sol under its 'Patch the Planet' program, and others by Google-owned Wiz using its Atlas agent alongside Gemini 4 Argon and GPT-5.6 Sol.