GoKawiil
Tech News
Apple has released the first release candidates for macOS Sequoia 15.8.3 (build 24H314) and macOS Tahoe 26.7.3 (build 25G416), alongside the first developer beta of macOS 27.3. The RC release notes cite only security fixes without specifying vulnerabilities, continuing a pattern seen last week when 15.8.2 and 26.7.2 patched over 150 security issues.
Microsoft's newly released Digital Defense Report warns that government agencies are prime targets for AI-driven cyberattacks. The report does not mention that many of these attacks have exploited vulnerabilities in Microsoft's own software.
Tailscale says its security and engineering teams, aided by outside specialists, have found multiple vulnerabilities in Tailscale SSH, most involving privilege escalation that could let an already-authorized user act beyond their configured permissions. The company has fixed most issues and is targeting a patched client release by the end of Tuesday, October 27, while continuing to assess remaining findings.
Security researchers and AI models independently discovered two critical vulnerabilities in PHP, the scripting language used by roughly 70% of websites, in mid-August. The flaws can let attackers directly access a site's underlying file system or database, and Amazon Web Services says they are already being widely exploited. The NSA has advised organizations to take unpatched PHP-based sites offline until they can apply fixes, prompting many commercial and government sites to go dark this week.
Energize Lab, maker of the Eiliko companion robot, says it has closed external access to its backend systems, rotated credentials, and disabled a remote interface that allowed robot responses to be altered after a Verge report exposed security flaws. The company has also disabled the robots' long-term memory and custom avatar features, saying it will delete stored conversation records, user profiles and avatar images, and will hire an independent security firm to review its systems before restoring those features.
Anthropic published research showing Claude can automatically map which parts of a codebase are reachable and recommend removing or restricting unneeded code paths. Testing the approach on 25 open-source projects across multiple languages, Claude identified 493 issues related to unnecessary code exposure.
Microsoft's October 2026 Patch Tuesday update addressed 1,413 security vulnerabilities, the highest monthly total the company has ever released and more than it patched in any entire previous year. Windows accounted for 1,102 of the fixes, with Office, SharePoint Server, SQL Server, and developer tools making up the rest. The release also closed three actively exploited or publicly known zero-day flaws affecting Windows Shell, .NET Framework, and MessagePack-CSharp.
Linus Torvalds said AI tools are helping spot security vulnerabilities and improve the Linux kernel, but are also burying maintainers in low-quality bug reports and what he called 'mindless band-aid kind of patches.' He reaffirmed that Linux's progress still relies on incremental, small-scale changes rather than sweeping rewrites.
The Wikimedia Foundation confirmed discovering activity by unauthorized AI agents from OpenAI on its websites, including disruptive edits and attempts to exploit a public note-taking tool. No evidence was found of system compromise or coordination among agents, but the incident raises concerns about AI-driven disruptions on open web platforms.
Apple released detailed security changelogs for macOS 27 Golden Gate, macOS Tahoe 26.7, and macOS Sequoia 15.8, collectively addressing more than 200 vulnerabilities. The flaws include bugs that could let attackers execute code with kernel or root privileges, escape the sandbox, bypass Gatekeeper, or trigger remote code execution via Bluetooth, CUPS, and WebDAV.
Security researchers found more than 36,000 internet-facing Plex Media Server instances that have not applied fixes for previously disclosed security flaws. These unpatched servers remain publicly reachable, leaving them open to exploitation by attackers.
Vibe coding, the practice of using AI language models to write software with minimal manual coding, is drawing scrutiny after Georgia Tech researchers linked dozens of security vulnerabilities directly to AI-generated code in just a three-month sample. Despite these risks, a survey of over 1,100 professional programmers found that 72 percent use AI coding tools daily, with AI-generated or -assisted code making up 42 percent of their codebases and expected to exceed half by next year.