Microsoft has fixed a known issue that caused games and Windows 11 apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 preview update (KB5124010). While KB5124010 is an optional update that requires clicking a "Download and install" link (reducing the number of potentially affected Windows users), it installs automatically on devices where the "Get the latest updates as soon as they're available" option is toggled on. "In some cases the application can fail to launch, or close without warning. In other cases the application will work normally until certain features are used, such as playing music," Microsoft said when it acknowledged this issue two weeks ago. "Affected applications may vary and can include games, media players, and certain productivity applications."
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. The three critical vulnerabilities were found in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479). Remote attackers without privileges can exploit them to launch denial-of-service (DoS) attacks or gain code execution on NGINX systems with non-default configurations. Successful exploitation causes a heap-based buffer overflow or use-after-free in the NGINX worker process, leading to crashes or a restart. However, attackers may also be able to "execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR."
Meta wants the right to scrape your website for AI training. If you have a business account, that includes you. At the end of the month, Meta plans to change its commercial terms in a way that matters to every company advertising or selling through its platforms. The new language takes effect on October 30, 2026. It lets Meta collect content from websites associated with business customers and use it to train AI models or otherwise improve its products, according to The Register. Meta defines “business customer” broadly. It includes anyone who uses ads or marketing messages, sells or lists products, develops apps, uses a product catalog, manages a Page, runs a Group for business purposes, or uses tools such as Ads Manager or Meta Business Suite. At least one million businesses already use Meta’s AI agents in WhatsApp and Messenger. Nieman Lab also points out that almost every news publisher has at least one Meta business account. The contract clearly explains which tools Meta can use. By accepting the terms, you allow Meta, or anyone working on its behalf, to use automated tools such as web scrapers, bots, spiders and crawlers to access and index your websites, pages and URLs. These tools can also revisit your sites regularly to collect updates. “You authorise us (or any entity acting on our behalf) to use automated software (such as web scrapers, bots, robots, spiders, crawlers and user agents) and create test credentials to access, index, cache, analyse, collect, retrieve or crawl the domains, web pages or URLs (and any content available through them) that are associated with your products or services, or that are made available through your or users’ use of Meta Company Products and services, and to periodically pull updates from such domains, web pages or URLs.” states Meta’s commercial terms. “Meta may use any content from such domains, web pages or URLs to provide, develop, improve, research, train and maintain the integrity of, the Meta Company Products, services and features provided under these Commercial Terms and any other applicable supplemental terms.” Then comes the use clause. The company may use any content from those domains to provide, develop, improve, research, train and maintain the integrity of its products, services and features. The contract lists scrapers, bots, robots, spiders, crawlers and user agents, which is a lot of ways to say visitor you didn’t invite. The News/Media Alliance says there’s no way out. Business accounts have no option to opt out of the terms, and the only alternative is to stop using Meta’s products. ““Meta’s new commercial terms of use are outrageous and probably illegal. The company’s decision to withhold access to its audience unless businesses allow Meta to scrape content from their websites is an appalling, bad-faith policy, and a clear abuse of the company’s market power. It cannot be allowed to be implemented on October 30.” states Media Alliance. “The text is so far reaching that any business with intellectual property online and a Meta business account could have their copyrighted material taken from them.” Danielle Coffey, President and CEO of the News/Media Alliance also pushed the point beyond news sites. Her questions were whether Taylor Swift’s Meta business account would give Meta access to copyrighted media on her website, and whether Shutterstock’s would let Meta scrape its images. The Alliance’s argument is that any business with intellectual property online and a Meta account could be affected, not just publishers. There is also a problem with robots.txt. News reports say the social network giant plans to let businesses control how its crawlers access their websites through robots.txt files, but the contract makes no such promise. The law does not always require companies to follow these instructions, so businesses must rely on Meta to respect their preferences. The company didn’t respond to The Register’s request for comment. If you run a Meta business account, someone should read the terms before October 30 and check what your own robots.txt actually says. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)
Microsoft has fixed a known issue that removed the Copilot Chat and Copilot buttons in the classic Outlook desktop mail client for some Windows users. As explained in an updated support document, affected users with the Copilot Chat (Basic) license or a Microsoft 365 Copilot (Premium) account no longer saw Copilot buttons in the side navigation and above the ribbon. Those impacted by this experienced one or more of the following issues: Microsoft first announced in June that it had fixed the bug with a service change, but last month it said it had started investigating again after recent updates caused it to resurface. Now, Microsoft says it has finally resolved this classic Outlook issue, blaming it on a bug that prevented Outlook from retrieving some account information from the user's Outlook profile.
The UK Electoral Commission is building an AI system to alert candidates to damaging deepfakes within three hours. The UK’s Electoral Commission is building an AI-powered system to tell candidates about significant deepfakes within three hours of posting. Its chief executive, Vijay Rangarajan, said so at a panel at the Conservative Party’s annual conference last week, as Tech Policy Press points out that it’s a rare public intervention from a man who has run the regulator since 2024 and who mostly speaks to Parliament in evidence sessions. He began with an example from another country. During Ireland’s 2025 presidential election, a deepfake video falsely showed candidate Catherine Connolly saying the election had been cancelled and that she was withdrawing from the race. The video also urged her supporters not to vote. None of this was true, and Connolly went on to win the election. Rangarajan said a similar video during a UK election could influence a significant number of votes. However, he stressed that the Electoral Commission has clear limits to its role. It does not settle disputes over political claims made during a campaign. Its focus is on false statements that could disrupt the election process itself. ““If that happens to the British election, that will move a significant amount of votes,” he said, adding that it was not the Electoral Commission’s role to arbitrate rival claims made by candidates during the cut and thrust of a campaign, but rather to focus on statements such as this one that could undermine the administration of the election itself. “To address that risk, the commission conducted a pilot program during the UK’s local elections in May 2026, Rangarajan said. “We ran a full pilot, analyzed about three million posts through an AI,” he explained. “So, this is a good example of how AI can work: 147 bits of content were flagged. Humans then looked at those — not a terribly pleasant job in some cases — ten were really quite misleading, and we referred to the social media companies or to the police.”” Tech Policy Press reports. The Commission has tested the idea. During the local elections in May 2026 it ran a full pilot, and an AI analyzed about three million posts. It flagged 147 pieces of content, humans reviewed them (he called that unpleasant in some cases), and ten were really quite misleading, so they went to the social media companies or the police. Rangarajan said the posts had little impact. However, the trial showed that the Electoral Commission now has a system to help voters, journalists and political parties deal with deepfakes. He expects attempts to use them to disrupt UK elections. The pilot began earlier in 2026 and monitored fake audio and videos designed to mislead voters about the election process or falsely show candidates doing or saying things. The Commission said it would publish the results. The system has a clear focus. Identifying and prosecuting the people behind deepfakes can take weeks or months, often long after an election. Instead, the Commission aims to act without first identifying who created the content. AI scans social media posts in real time and flags suspicious material for human review. If a post meets the required criteria, the Commission alerts the relevant candidates or parties, ideally within three hours of its first appearance. Rangarajan said this is roughly the time it takes for content to go viral. That narrow scope has edges. Full Fact, whose AI tools were monitoring more than a thousand candidates in the May elections, found a Glasgow candidate’s campaign videos built with AI. The Commission told Full Fact the clips fell outside its pilot because each was labeled an illustrative AI scene, even though the label sat at the end of the caption. The legal backdrop is the real problem. Rangarajan said the Commission was set up for money and people, and now it’s all about information, so it has to work out how laws from 1983 or 2000 apply in 2026. Earlier this year the Guardian reported, according to a summary on the Resilient Media for Democracy Observatory, that the Commission was seeking legally enforceable takedown powers from the government. Then there’s the part with no legal answer at all. Rangarajan said he believes at least one social network showed signs of algorithmic bias at election time, though he didn’t name it. His scenario is a platform that changes its recommendations during an election without warning, suggesting neighbors with one political view and suppressing others, so users think their neighbors have changed their minds. The Commission believes it has already detected some algorithmic bias in social media campaigns, but Rangarajan said UK law offers no clear solution. Experts and campaigners have also raised concerns about X’s role in UK politics and TikTok’s Chinese ownership. The Commission faces 30,000 to 40,000 cyberattacks a month, sometimes reaching 10,000 a day, including botnet attacks and phishing. Rangarajan wants stronger, more independent security capabilities and believes major social media monitoring could be handled by another body. Tech Policy Press sees his comments as a call to update election laws and possibly create new offenses. The next general election must take place by August 2029, but it could be called earlier, and it remains unclear whether lawmakers will act in time. For now, what the Commission has is a three-hour promise and a pilot that worked at small scale. Rangarajan describes the threat it’s meant for as “an absolutely certain attempt to use some of these deepfakes against the UK.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Deepfakes)
OpenBSD flaws, including a 37-year-old BSD bug, enable local attackers to bypass security protections and gain root access. Patches are available. Cybersecurity firm Calif published a full exploit and write-up this week for a local privilege escalation on OpenBSD 7.9 that chains two separate kernel flaws, one of them a 37-year-old integer overflow inherited from the original BSD sources. The exploit bypasses OpenBSD’s KARL address randomization and the SMAP and SMEP hardware protections without needing any information disclosure vulnerability at all. OpenBSD already shipped patches for both issues in September: the integer overflow fix in errata 018 on September 14, and the related use-after-free fix in errata 026 on September 30. Both are available through syspatch and cover all architectures. The shared memory attachment counter, shm_nattch, was defined as a signed 16-bit integer in BSD source code in 1988. It could hold a maximum value of 32,767. OpenBSD inherited this definition and never changed it. By mapping 127 shared memory segments and creating 259 processes through forking, an attacker can push the counter beyond its limit, causing it to wrap around to a negative value. This triggers a use-after-free vulnerability through a race condition. The corrupted counter makes the kernel free memory that other processes are still using. The second flaw builds on the first. An out-of-bounds write overwrites multicast membership counters in the kernel. When the affected socket closes, the resulting counter updates modify page table entries, allowing user memory to be accessed with supervisor-level privileges. This bypasses SMAP and SMEP protections by exploiting errors in the kernel’s internal memory accounting, rather than directly attacking the hardware. “One traced back roughly 37 years to the original BSD sources, where a shared memory attachment counter was defined as a signed 16-bit short. Repeatedly forking a process with shared memory attachment records could push that counter past its maximum value of 32,767, causing it to wrap to a negative value.” reads the Califs’ analysis. “This integer overflow could lead to a use-after-free via a race condition; combined with a separate out-of-bounds write in the kernel, it allowed local privilege escalation to root.” OpenBSD’s KARL protection relinks the kernel at boot to randomize function and data addresses, which is real and meaningful hardening. “While OpenBSD’s KARL relinks the kernel binary to randomize both function and data addresses, the kernel’s memory allocators remain deterministic. Both the boot-time allocator and the best-fit allocator lack base address randomization.” continues the analysis. “Consequently, early boot allocations consistently land at predictable locations across boots on the same hardware.” Early boot allocations, including function pointers in network interface handlers, land at the same addresses across every reboot on the same hardware. That predictability is what the exploit actually uses. It targets the lo0 and enc0 interface ioctl handlers, two structures the kernel always places at known addresses, overwriting one to gain code execution and using the other to cleanly restore the overwritten pointer afterward. No information disclosure needed, no guessing required. The researchers used kernel memory allocation metrics available through sysctl to track live allocations and detect when new pages were being created, essentially doing heap layout analysis from userland. They aligned IP socket allocations and set a multicast TTL option to a non-default value to get a persistent 16-byte structure placed where they needed it. The race condition was won by using IPC_RMID in one process while a helper process running in parallel attached a size-confused shared memory segment. Calif researchers note there’s no evidence of either flaw being exploited in the wild, and no CVE has been assigned to either issue as of publication. The report does more than explain the exploit. Calif suggests four security improvements that could make this attack much harder or prevent it entirely. First, safe-unlinking for kernel linked lists checks that data structures are valid before writing to memory. If something is wrong, the kernel stops. FreeBSD and NetBSD already use this protection, but OpenBSD does not. Second, randomizing the page table’s self-referential mapping at boot would prevent attackers from predicting which memory location to target with the decrement operation. Third, randomizing the kernel allocator’s base address at boot would make it harder to predict function pointer locations. The researchers say this protection would have almost no performance cost. Finally, enabling array bounds checks in release builds would detect this type of out-of-bounds write. Calif also reported 21 issues to FreeBSD that the same protection could have caught, including flaws that could allow local privilege escalation. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, OpenBSD)
Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. In a new Windows release health dashboard update over the weekend, Microsoft said users may have trouble accessing email or signing in to Outlook after installing the latest updates on systems running Windows Server 2019 and later. In some cases, affected customers are also reportedly seeing Exchange Server OWA failing with a "MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142)" error and Event ID 1006 in the application log. "After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," it said.
Attackers are exploiting vulnerability CVE-2026-106931 in SiteGuard Server Edition to run commands as root or SYSTEM. EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition. Threat actors are already exploiting it in the wild. A successful exploit lets them run commands with root or SYSTEM privileges on the server where the product runs. SiteGuard is a Japanese web application firewall (WAF) that runs directly on the web server it protects. The vulnerability affects its statistics feature, which is enabled by default. The vendor and JVN rated the vulnerability with a CVSS 4.0 score of 8.5 and a CVSS 3.0 score of 7.8. An attacker needs local access and low-level privileges to exploit this vulnerability. This suggests the flaw may be used after an attacker has already gained access to a system. The vulnerability impacts version 2.20 or later. On Apache, Nginx and IIS that means anything before 8.00 Update 5, except FreeBSD, and on FreeBSD with Apache or Nginx it means anything before 7.00 Update 6. IIS editions from 3.10 through 4.00 Update 4 aren’t affected, and only installs with the statistics function enabled are exposed. For people who can’t upgrade their version, the vendor offers a patch that replaces the files used in statistics processing, and it covers end-of-life versions too. Be aware that updating or patching can erase the traces of an attack, so the vendor tells administrators to download the diagnostic information first. “Before updating, please be sure to download and save your “Diagnostic Information” (as this may erase traces of the attack).” reads the vendor’s advisory. In the web management screen that’s the diagnostic information page, then the download option. Do it before you touch anything, because a clean server after the update doesn’t prove it was clean before. The timeline is short, but not everyone was warned at the same time. The vendor says it notified customers with direct support contracts on September 29. The public alert and the JVN advisory were published on October 14. The vendor reported the vulnerability to Japan’s IPA, while JPCERT/CC coordinated the disclosure and published its own alert. Customers without direct support contracts received the warning about two weeks later. Many details remain unknown. Neither advisory identifies the attackers or victims, explains how the attacks were carried out, or says how many systems were affected. The vendor has confirmed that the vulnerability has been exploited. If you use this product, check your systems for signs of compromise and investigate any suspicious activity. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, SiteGuard WAF)
A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication. Researcher Quentin Kaiser presented a talk at Hexacon in Paris documenting a vulnerability in Broadcom’s proprietary 802.11 implementation that has been present in their SDK since at least 2010. The bug allows an attacker to get unauthenticated remote code execution on affected routers without knowing the WiFi password or going through the normal WPS setup process. As of October 15, 2026, none of the affected devices in Belgium had received a patch. “A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has been present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom’s recommendation to move to hostapd instead, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.” states Kaiser. “The vulnerability can be triggered remotely over WiFi without knowledge of the network key or completion of a normal WPS enrollment. Exploitation provides controlled information disclosure and arbitrary code execution.” The vulnerability affects the WPS EAP reassembly code, which handles part of the wireless setup process used by many consumer routers. An attacker within Wi-Fi range can exploit the flaw without knowing the Wi-Fi password, completing the setup process, or requiring any action from the user. The attack can expose information and allow the attacker to run code on the router. In his demonstration, Kaiser extracted the Wi-Fi password from the router’s memory and sent it over the wireless connection. He then used the password to connect to the network. These attacks are not just theoretical. Kaiser demonstrated working exploits against two devices: the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. Both allowed an attacker to run code without authentication. In one demonstration, the attacker opened a reverse shell using only Wi-Fi frames, without needing a command server accessible over the internet. The attack can work from a distance. The close antenna placement shown in the video was only for the laboratory setup and is not a requirement for the attack. In the video below, Kaiser exploited an Orange Belgium router (ASKEY TCG3000). The attack allowed him to run code on the device without authentication. The code retrieves the Wi-Fi password (PSK) from the router’s NVRAM and sends it back to the attacker over Wi-Fi. He then used the stolen password to connect to the network, confirming that the exploit works and that the password is correct. Do not be misled by how close the antenna is in the video. The attack can work over much longer distances. In the next video, the researcher exploited a Proximus router (BBOX3V+, also known as Sagemcom F@st). This attack also allows code execution without authentication. He used it to open a reverse shell over Wi-Fi frames, without needing a command-and-control (C2) server hosted in the cloud. Broadcom quietly released an incomplete fix in 2018, then told customers to migrate to a different software stack entirely rather than shipping a complete patch for their own code. On eCos-based platforms, covering chipsets like BCM3380, BCM3383, and BCM33834, that makes this a permanent unfixable bug by design. On Linux-based platforms (BCM3390, BCM65xx, BCM68xx) the situation depends entirely on whether individual manufacturers decide to act. Kaiser reported the bugs to Broadcom in July 2026. Broadcom said a patch was available and told him to ask the affected device manufacturers to contact Broadcom directly. The company refused to assign a CVE or share the notification it had sent through its customer portal. CERT/CC opened a case but closed it the same day after confirming that Broadcom could assign CVEs itself and had no intention of doing so. This was not a proper disclosure process. It was a dead end, with a paper trail. Kaiser’s rough calculation, done with Belgian telecom market data, puts the affected device count at around 850,000 for Proximus, 500,000 for VOO’s legacy fleet, and 210,000 for Orange Belgium, totalling somewhere north of 1.5 million potentially exposed gateways in one small country. Telenet may also be affected through Sagemcom devices but Kaiser couldn’t confirm because he couldn’t get hold of one. The affected manufacturers sell into markets well beyond Belgium. The chipsets in question appear in devices across dozens of vendors and hundreds of products worldwide. Kaiser is publishing a fingerprinting script and a YARA rule specifically to help map the full scope of affected deployments, because right now nobody has a complete picture. A vulnerability introduced in 2010 and only partly fixed in 2018 still affects routers in use today. Kaiser says AI-assisted analysis helped him find the bugs in less than a week, instead of months. This can help defenders find vulnerabilities faster, but attackers can do the same. The risk is greatest in targeted attacks where an attacker is within Wi-Fi range, such as hotel network attacks or surveillance of nearby targets. Compromised routers are difficult to monitor, and attackers can quietly intercept or collect network traffic. Most users and security teams rarely check the firmware on ISP-provided routers. “Although I could have done this research by myself, it would have taken me months to get there. With AI frontier models it took me less than a week.” Kaiser concludes. “Which is a good thing because we can start looking into deeper and deeper layers of our technical infrastructure for a fraction of the cost.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Broadcom Wi-Fi)
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were
Confirm this action.
Leaving now will discard your changes.