Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated remote-code-execution flaws and a high-severity denial-of-service bug. Version 15 users should verify that `sharp` is updated too: the Next.js patch may leave an affected version installed.

Source

NGINX 1.30.6 and 1.31.7 fix five vulnerabilities, including memory bugs that could crash worker processes or possibly enable code execution. A separate TLS flaw could allow forged sessions to bypass client-certificate checks under a specific configuration. Upgrade promptly, especially if your server uses the affected directives.

Source

Microsoft is detailing Windows changes for RTX Spark laptops following the October 7 showcase of the platform. The updates target local AI setup, shared CPU-GPU memory, and x64 app emulation on the Arm-based systems. Some Copilot+ features, including Recall, won’t be available at launch.

Source

Python 3.15 now defaults to a native Arm64 interpreter on Windows on Arm, while CPython’s Tier 2 support brings the platform into the project’s release testing. Microsoft says 94% of the 1,000 most-downloaded PyPI projects already offer native Arm packages or platform-independent versions, though some dependencies still need work.

Source

CISA has added four actively exploited vulnerabilities in Palo Alto Networks PAN-OS, Cisco Secure Email Gateway and AhsayCBS to its Known Exploited Vulnerabilities catalog. U.S. federal civilian agencies have until October 17 to fix them. Ahsay customers should take particular care: earlier patches did not fully close two flaws now being used to deploy webshells and cryptominers.

Source

Hands-on tests show Nvidia’s RTX Spark-powered Surface Laptop Ultra finishing local AI tasks faster than an M5 Max MacBook Pro. The results add real-world performance data to the laptop’s 128GB local-AI hardware pitch: strong inference performance comes with trade-offs in software readiness.

Source

Llama Windows is a free, open-source Windows 11 tray app that provides a graphical interface for llama.cpp, allowing users to download and run AI models locally without using the command line. Despite the name, it is not Meta’s Llama model or the separate Ollama application.

Source

Windows Server 2012 and 2012 R2 have lost their final security-update lifeline: Microsoft’s three-year Extended Security Updates (ESU) program ended on October 13, 2026. Production servers still running either version will no longer receive Microsoft security fixes, increasing security and compliance risks.

Source

VS Code 1.142, released October 14, adds Canvases (Preview), where developers and AI agents can update the same Kanban board beside the chat. The release also lets supported chats move between folders or Git worktrees without losing history, and adds policy changes that administrators should review.

Source

Bank of America brought in 1,000 external contractors to patch software vulnerabilities identified by Anthropic’s Mythos and other AI security models, expanding its team in this area to about 4,000 people. The contractors joined in the second quarter and are still working with the bank. CEO Brian Moynihan said third-quarter spending of hundreds of millions of dollars covered software remediation and anti-money-laundering compliance work combined.

Source

Two LiteLLM vulnerabilities let even low-privilege users take over the AI gateway or redirect provider requests to steal API keys. The fixes are in version 1.83.9 and later, so teams running older releases should upgrade.

Source

GhostAction targeted more than 30,000 GitHub repositories in a burst on October 8–9, after the campaign had already spread malicious GitHub Actions across tens of thousands of repositories. The latest wave used about 1,900 compromised accounts and attempted to extract 3,174 secrets. GitHub began blocking the malicious workflows on October 9.

Source

Nvidia’s Jensen Huang claims AI can be sovereign, profitable and safe—but each claim has a catch: reliance on Nvidia chips leaves nations exposed to U.S. export controls, profitable AI services don’t erase the huge costs of training models or labs’ cash burn, and the commercial race for more capable systems may crowd out safety work. Whether Huang believes his own sunny outlook is an open question; Nvidia’s interest in accelerating AI is not.

Source

Google has released another Chrome 155 security update, fixing 37 vulnerabilities, seven of them critical. It follows a Chrome 155 release that patched 247 flaws. The new desktop builds are rolling out gradually, and Google has not confirmed active exploitation of the newly fixed bugs.

Source

Microsoft 365 G7 began its GCC rollout on October 1 with Copilot, Agent 365, and the Entra Suite, but the government suite is available only to the lowest GCC tier so far. The planned launch left key capabilities and government-cloud availability to follow; GCC High and DoD customers now face a wait until closer to the end of 2026, with many AI features still missing.

Source

Dell says its upcoming 18th-generation PowerEdge servers can replace as many as 13 14th-generation systems with one AMD-based server, as agentic AI increases demand for CPU compute. The company claims up to 70% better performance between generations. Higher rack density and cooling efficiency are also intended to help data centers add capacity without adding servers.

Source

Linux kernel maintainers have agreed to end the requirement that contributors disclose AI assistance with an “Assisted-by” tag. The change removes a rule introduced in January 2026 for patches created with advanced coding tools. Linus Torvalds says reviewers should judge whether contributors understand their code, not which tools they used.

Source

Microsoft Defender for Endpoint is now available in public preview for Linux desktops, extending the protection already used on Linux servers to developer workstations. Organizations can deploy it with their existing Linux methods and manage desktops and servers through the same security experience.

Source

Microsoft has ended the paid extended-security window for Exchange Server 2016 and 2019, and Skype for Business Server 2015 and 2019. The October 13 patches were distributed privately to customers enrolled in the final ESU period; Microsoft will no longer provide updates or track new vulnerabilities for these versions.

Source