AI & software security
-
Firefox 158 closes browser sandbox escapes and privilege escalation flaws
Mozilla has published high-impact security fixes in Firefox 158, including sandbox escape and privilege escalation vulnerabilities across networking, update and security components.
-
npm Trusted Publishing flaw exposed more than 1,500 packages to possible takeover
Bloom Security researchers identified a trust-binding weakness that could let attackers publish updates to npm packages through reclaimed GitHub repository names. GitHub says it has shipped a fix.
-
SAP issues critical fixes for Cloud SDK, NetWeaver and S/4HANA
SAP has published 16 security notes and four GitHub advisories in its October update, including a maximum-severity Cloud SDK flaw and critical access-control weaknesses in enterprise applications.
-
Anthropic says new defences cut data extracted in AI model distillation attacks
Anthropic reports that its new anti-distillation methods reduced harvested model data by around 90–99% in early testing. The performance estimate is company-reported and subject to changing attacker behaviour.
-
UK and Canada renew AI security cooperation on model testing and standards
The UK and Canada have renewed their AI security partnership, with commitments on risk intelligence, evaluations, technical standards and closer institutional cooperation.
-
Docker reveals token ownership flaw in Hub account conversions
Docker says a flaw in account-to-organisation conversions reassigned some personal access tokens without rotating their secrets. The issue was fixed in September and disclosed publicly on 12 October.
-
NHS corrects affected NetScaler versions in critical vulnerability warning
NHS England has corrected its NetScaler advisory after several software versions were mistakenly classed as unaffected. The 12 October update concerns a critical SAML-related flaw disclosed three days earlier.
-
UK expands AI-assisted cyber defence as minister warns of future failures
Government pilots have reportedly helped identify and address more than 1,000 cyber vulnerabilities. Ministers now plan to extend the work while considering how serious incidents involving autonomous AI should be handled.
-
GitLab fixes critical unauthenticated code execution flaw in CI/CD compiler
GitLab has issued emergency patches for CVE-2026-97229, a maximum-severity vulnerability in its regular expression compiler that could allow unauthenticated code execution on self-managed servers.
-
ENISA updates EU Cyber Resilience Act reporting platform to version 1.1
ENISA has upgraded the Cyber Resilience Act Single Reporting Platform and revised its documentation, as manufacturers prepare processes for reporting exploited vulnerabilities and significant security incidents.