A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. The U.S. Department of Justice announced Tuesday that Abdulrahman Alfozan, 35, who had worked at OpenAI since July 2025, was arrested on October 9 and charged with illegally intercepting oral communications. The DOJ says OpenAI security personnel discovered the recording device on September 30, plugged into a USB port behind a television in an executive conference room. According to the DOJ, OpenAI determined that the device had been concealed in toilet paper, was installed around September 28, and contained encrypted data. "On or about Sept. 30, OpenAI personnel discovered a surreptitious audio recording device (Recording Device 1) inserted into a USB port on the back of a television in an executive conference room inside one of their buildings in San Francisco," says the DOJ press release.
A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. The flaw was discovered on August 23 by researchers at Defiant's platform Wordfence using their Argus AI-powered system. Ghostscript is a PostScript and PDF interpreter that can render PDFs as images, generate thumbnails for previews, and optimize PDF files by compressing embedded images and removing unnecessary font data. When generating a PDF thumbnail, WordPress can use the PHP Imagick extension to call ImageMagick, which launches Ghostscript. A specially crafted PDF file containing a JPEG 2000 image can trigger incorrect handling of low-bit-depth samples and mismatched component resolutions. Using Argus, the researchers developed two exploits for CVE-2026-39919 that force Ghostscript to write 1,024 bytes into a 256-byte buffer, corrupting nearby memory and leading to unauthenticated remote code execution in a WordPress deployment.
Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. This Patch Tuesday addresses 70 "Critical" vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing. The approximate number of bugs in each vulnerability category is listed below: When BleepingComputer reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself. Therefore, today's total excludes 348 flaws fixed earlier this month, including vulnerabilities in Azure API Center, Azure App Service, Azure Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Microsoft Dataverse, Microsoft Exchange Server, and Microsoft Partner Center.
Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. If you are running Windows 10 Enterprise LTSC or are enrolled in the ESU program, you can install this update like normal by going into Settings, clicking on Windows Update, and manually performing a 'Check for Updates.' After installing this update, Windows 10 will be updated to build 19045.7807, and Windows 10 Enterprise LTSC 2021 will be updated to build 19044.7807. Microsoft no longer releases new features for Windows 10, and the KB5126657 update mainly includes security updates and bug fixes. The update also includes fixes released as part of today's record-breaking October 2026 Patch Tuesday, which fixed a massive 1,411 vulnerabilities across Microsoft's products, including one actively exploited zero-day flaw.
Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. However, according to Microsoft's lifecycle policy, Windows 11 24H2 Enterprise and Education editions remain under mainstream support until October 12, 2027. "Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 2026 monthly security update is the last update available for these editions," Microsoft said in a message center update. "Devices running these editions will no longer receive monthly security and non-security preview updates containing protections from the latest security threats." Microsoft advises users to upgrade to Windows 11 26H2, the latest Windows 11 version, also known as the Windows 11 2026 Update, which is now rolling out in phases to eligible Windows 11 devices where the "Get the latest updates as soon as they're available" option has been enabled.
Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off."
The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. Established under the Housing Act 1996, the Housing Ombudsman is an executive non-departmental public body sponsored by the Ministry of Housing, Communities, and Local Government. The watchdog settles disputes between social housing residents and social landlords in England, including housing associations, landlords, managers, and letting agents. On Tuesday, the service added an alert to its official website, warning that it's working with the affected service provider to assess the incident's impact and said social housing residents cannot file new complaints until systems are back online. Those who must raise new complaints are advised to call the Housing Ombudsman's phone line or email the watchdog at info@housing-ombudsman.org.uk.
Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. Today's updates are mandatory as they contain the October 2026 Patch Tuesday security patches for hundreds of vulnerabilities discovered in previous months. You can install today's update by going to Start > Settings > Windows Update and clicking on 'Check for Updates.' You can also manually download and install the update from the Microsoft Update Catalog. This is the tenth 'Patch Tuesday' release in 2026, and it's based on 24H2, which means 25H2 or 26H2 get the same update. There are no exclusive or special changes. You'll get the same fixes across the two versions of Windows 11. With today's update, Microsoft is adding new emojis to Windows 11 and fixing minor issues with File Explorer.
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary
Confirm this action.
Leaving now will discard your changes.