The October 13, 2026 security update changes how Hyper-V Virtual Machine Connection (VMConnect) handles device redirection in enhanced session mode. By default, printers, smart cards, and WebAuthn credentials—including Windows Hello and FIDO2 security keys—are no longer passed through to a virtual machine (VM) unless you turn those options on. Clipboard sharing and audio playback still default to enabled. Sensitive redirections now appear on the first page of the connection dialog, and you get one prompt per VM to confirm your choices. Below we cover the new defaults, how saved settings behave, and what you should still set up manually.

Source

LibreOffice Draw gives users a free way to open and edit Publisher (.pub) files as Microsoft withdraws Publisher from Microsoft 365 and ends support with Office LTSC 2021. The change adds an option beyond the Publisher phaseout and.pub conversion options: import the files directly into LibreOffice.

Source

OpenAI could release one or two models before year-end, but its next flagship may miss that window as the company works on alignment and testing. The model’s looped-transformer design can boost math and coding performance while making its reasoning harder to monitor. Even after internal safety reviews, U.S. government evaluation could delay access for outside partners by up to 30 days.

Source

Cisco has patched CVE-2026-76519, a zero-day in Secure Email Gateway (SEG) that attackers are exploiting to gain root-level command execution. The flaw can be triggered remotely without authentication by sending a specially crafted email attachment through a vulnerable appliance.

Source

Ultra Ethernet Consortium’s 1.1 specification adds support for connecting accelerators inside a server, along with congestion controls that can be updated in software. It also lets switches perform collective operations for AI and high-performance computing workloads, potentially halving the bandwidth required for large reductions.

Source

Researchers exchanged messages with a Chinese AI-agent fleet after it made more than 2,600 attempts to scrape Alibaba’s Amap between September 28 and October 8. The contact follows the fleet’s earlier activity, which included roughly 1,810 reports about entrances at 213 public places, as covered in the discovery of the Chinese AI-agent fleet.

Source

Geoffrey Hinton warns that AI-powered worms could adapt as they spread, exploiting different vulnerabilities across connected devices—and may have no central off switch. He also mocks the term "superintelligence" as applied to today's AI. He suggests that tech leaders embrace the term to please Trump. He tells Jensen Huang of Nvidia that his estimate of a 10 percent chance of AI taking over is a warning that the risk is significant rather than a calculated probability.

Source

Cisco and Nvidia are developing an ultra-dense optical module that could carry up to 12.8 Tbps over a single pluggable connection inside an AI datacenter, linking GPUs, network interface cards, and switches. The open USFP design could simplify cabling, but its 100-watt power target and larger failure impact pose tradeoffs.

Source

Microsoft’s October 13, 2026, updates fix the Always On VPN failures that September’s Windows updates introduced. KB5127648 covers Windows 11 versions 24H2, 25H2, and 26H2; KB5127646 addresses version 26H1.

Source

Tiny11 Builder’s WinUI 3 redesign, which fixed Windows 11 26H2 image compatibility, now includes a desktop-app preview powered by a new C# image builder. The app offers three ways to create smaller Windows installation ISOs, including Tiny11 Core, which removes key security and recovery features. Microsoft does not support the resulting images.

Source

AI pioneer Andrej Karpathy is an Anthropic AI researcher and educator who co-founded OpenAI and later served as Tesla’s director of AI. His rough estimate puts just 0.24% of people among those who understand AI’s potential and know how to use it: billions have little or no experience with language models, while about 20 million professionals use frontier systems and roughly 5,000 have access inside AI labs. Most users still treat AI as a chatbot or a better search engine rather than a means of orchestrating agent swarms for complex tasks, a skill that is much harder to acquire than expected.

Source

New exploit demos published October 12 show how Vghost (CVE-2026-74580) can turn access to Linux’s vhost devices into root—and, in a specific virtualized setup, let a guest tamper with its host’s QEMU process. The flaw affects kernels from 4.11 through 7.2-rc4; there is no public evidence of exploitation.

Source

GitHub says its ModernBERT secret classifier cuts median post-push scan time by 86% and serving costs by more than 98% versus its previous LLM pipeline. The figures add measured results to the classifier GitHub introduced for catching password-like values before they reach repository history; its initial preview targeted secrets without recognizable token formats.

Source

The FBI seized 187 devices from more than 40 Texas residences used in a North Korean fake-worker scheme, disrupting a network that prosecutors say generated over $3 million from more than 70 U.S. companies. The operation exposes how stolen identities and U.S.-hosted laptops helped overseas workers pose as legitimate remote employees.

Source

XBOW used OpenAI’s public GPT-5.6 Sol model with human researchers to build a Chrome full-chain exploit for Windows in six days, earning Google’s $250,000 bounty. The chain combined three previously unknown bugs to run code outside Chrome’s sandboxes when a user loaded a web page. All three flaws have been fixed, and XBOW says the exploit was not used against Chrome users.

Source

Windows 11 update KB5127648 is preventing some PCs from completing WPA2-Enterprise Wi-Fi authentication over 802.1X and PEAP, across systems with different wireless chipsets. A Registry change may restore access without uninstalling the update, but it re-enables legacy authentication behavior that Microsoft is phasing out.

Source

Chrome 155 fixes 37 security flaws, including seven critical bugs, but Microsoft Edge users are still waiting for Microsoft to ship its corresponding update. The most severe issue is a buffer overflow in Chrome’s ANGLE graphics component; Microsoft says it is preparing an Edge security release but has not given a date.

Source

CISA is urging organizations to patch Ivanti Connect Secure after attackers used CVE-2026-104935 to break in without credentials and run commands. The fix addresses two flaws in an attack chain, but a third vulnerability that can escalate privileges to root remains unpatched, Volexity reports.

Source

curl has released version 8.23.0 to fix a flaw that a public proof of concept shows can enable code execution on a client uploading a file to a malicious HTTP/2 server. Anthropic’s OSS Scanner had flagged a serious curl flaw; the newly disclosed CVE-2026-92392 affects curl and libcurl 8.12.0 through 8.22.0. Successful exploitation requires precise knowledge of the target’s build and memory layout, and a crash is considered more likely.

Source