CVEs worth acting on, Patch Tuesday, and update rings that hold.
22 articles
WordPress 7.1.3 (October 6, 2026) is a maintenance and security release with 7 security fixes and 4 bug fixes. How home and personal-site owners update via Dashboard → Updates and verify the version.
Samsung published SMR Oct-2026 Release 1 on October 6, 2026 with Google Android patches plus 27 Samsung fixes, and Samsung Internet 30.0.5.24 for CVE-2026-21132. How Galaxy owners update and verify at home.
Google published the October 2026 Android Security Bulletin on October 5. Home users should update phones and tablets to security patch level 2026-10-01 or later and verify in Settings.
Apple's September 28, 2026 point releases patch CVE-2026-86950, a CoreGraphics out-of-bounds write that may have been exploited in a highly targeted attack. Install iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, or Sequoia 15.8.1.
WordPress 7.1.2 patches critical CVE-2026-87902. Attackers started probing within hours. How personal and small-site owners should update today and confirm the version.
Microsoft's Sept 14, 2026 out-of-band updates fix multichannel USB audio, Remote Desktop instability, and Hyper-V Plan9 sharing after the September security patch. Check Windows Update.
Staying on macOS Tahoe 26 or Sequoia 15? Install Apple's September 14, 2026 point releases (26.7 and 15.8) from Software Update, then confirm About. Separate from macOS 27 Golden Gate.
How to keep a Synology, QNAP, TrueNAS, or similar home NAS updated: admin UI habits, vendor update paths, no SMB on the internet, and backups that still restore.
Google promoted Chrome 153 to desktop Stable on September 8, 2026 with 230 security fixes. Update on Windows, Mac, or Linux, fully quit and relaunch, then confirm chrome://version shows 153.0.8010.x.
Microsoft's September 8, 2026 updates include two exploited local privilege bugs plus Office Preview Pane risks. Check for updates, reboot, and confirm you are current.
MikroTik and CERT Polska warn that the MikroTrick RouterOS chain is being exploited when SSH is reachable from the internet. Update to a fixed build, then check Flagged status, logs, and unknown users.
Google patched an actively exploited V8 bug in Chrome 152.0.7977.82/.83. Update on your computer, relaunch, and confirm chrome://version before you assume you are done.
Public exploit code is circulating for CVE-2026-62911, Shadowserver still sees about 22k internet-facing unpatched servers, and Exchange 2016/2019 ESU ends in October 2026.
Ubiquiti's August 2026 advisory covers 22 UniFi vulnerabilities. Here are the affected products, fixed versions, real risks, and a practical update checklist.
CVE-2026-64531 is a local privilege escalation in the Linux Open vSwitch datapath with a public PoC. Who is exposed, which stables are fixed, and what to do today.
Critical unauthenticated RCE (wp2shell) hits WordPress 7.0.0–7.0.1 and 6.9.0–6.9.4. What the CVEs mean, which versions are fixed, and what SMBs should do today.
Microsoft's 663-CVE July 2026 release reflects AI-assisted vulnerability discovery. What MSPs and SMBs should change in triage without freezing from volume anxiety.
A practical way to rank vulnerability work using exposure, exploitation evidence, business impact, and change risk instead of CVSS alone.
Anthropic's April 2026 Project Glasswing put Claude Mythos Preview to work finding critical flaws with major vendors. What that means for downstream patching at ordinary SMBs.
How to split a small fleet into pilot and production rings so Patch Tuesday does not become a company-wide outage.
Emergency browser updates do not wait for Patch Tuesday. How SMBs should force Chrome updates, control extensions, and close the relaunch gap before attackers do.
CVE-2024-3094 hit rolling Linux distros hard. Here is what happened, who was exposed, and the checks SMB teams should run.
