October 2026

New Claude SDK majors default to API version 2026-10-21, which Bedrock accepts only from Claude 4.7 — anthropic.com

On 21 October Anthropic released API version 2026-10-21 and new major versions of its SDKs and CLI that send it by default: Python SDK 2.0.0, TypeScript SDK 1.0.0, C# SDK 13.0.0, Go SDK 2.0.0, Java SDK 3.0.0, PHP SDK 1.0.0, Ruby SDK 2.0.0 and ant CLI 2.0.0. The default carries through to their Amazon Bedrock clients, and on Bedrock the new version is available only for Claude 4.7 and later models, so an unpinned upgrade breaks calls to older models. Under the new version a request that sends temperature, top_p or top_k returns a 400 error, even at the default value. The new SDKs also send the API key as a bearer token rather than in the X-Api-Key header, and move from the MIT licence to Apache 2.0.

Pin the Anthropic SDKs below the new majors until every Bedrock call targets Claude 4.7 or later and sends no sampling parameters, check that any proxy in the path passes a bearer Authorization header, and record the licence change in your third-party notices.

MCP TypeScript server SDK 2.x can deliver one client's responses to another — github.com

GHSA-jm63-cq47-j5jp (CVE-2026-111770), published on 15 October and rated High (CVSS 7.7), affects @modelcontextprotocol/server 2.0.0 through 2.2.0. An MCP server reached over HTTP could send one client's responses and notifications to another when clients shared one stateless transport or one McpServer or Server instance, because messages were matched to a connection by JSON-RPC id alone and SDK clients number their requests from 0. Until this release the README examples for the Hono, Express, Fastify and Node adapters showed that shared pattern. Version 2.3.0 fixes it by refusing to be shared, so an affected server fails requests after the upgrade until its code changes too.

Upgrade @modelcontextprotocol/server to 2.3.0 and, in the same change, build a new server and transport per request, per session (with sessionIdGenerator) or through a createMcpHandler() factory; that code change alone also protects 2.0 to 2.2 if you cannot upgrade yet.

Claude Haiku 5.5 reaches Bedrock with Australia-only routing, and breaks code written for Haiku 4.5 — docs.aws.amazon.com

Claude Haiku 5.5 launched on Amazon Bedrock on 7 October. In Sydney and Melbourne it is available through the au. geographic cross-Region inference profile, which routes only between those two Regions, and through global inference, but not in-Region on the standard runtime endpoint: the same pattern as September's Opus 5.5 and Sonnet 5.5 launches. Anthropic's release notes warn that code written for Haiku 4.5 can break, because manual extended thinking, the temperature, top_p and top_k sampling parameters and assistant message prefill can each return a 400 error, and computer use on Bedrock needs computer_20251124. The model card promises no end of life before 7 October 2027.

Use au.anthropic.claude-haiku-5-5 where data has to stay in Australia, and before swapping from Haiku 4.5 remove sampling parameters, budget_tokens and prefill from your requests.

Browsers block eight eMudhra intermediates after their private keys turn out to be recoverable — blog.google

On 17 October the Chrome Root Program received a report that the private keys for eight eMudhra subordinate CA certificates had been compromised; Chrome pushed a CRLSet block that evening and Mozilla blocked them through OneCRL the same day. eMudhra's own statement says a flaw in its key generation ceremony produced a second set of weak keys alongside the strong ones, and the weak keys were the ones published to the root stores. Chrome removes the emSign ECC Root CA - G3 from its root store on 27 October, and Mozilla's NSS 3.131.1 removed trust in it on 20 October. Non-browser clients only stop trusting the intermediates when their own stores change: Go 1.27.3 and 1.26.10 (19 October) added a denylist for them (CVE-2026-111943), and Node.js 26.12.1, 24.22.1 and 22.23.4 (21 October) updated their bundled CA certificates, and Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 (26 October) made the ssl module block them (CVE-2026-115557). On 22 October eMudhra said it will withdraw from the global TLS certificate business.

Check that no certificate you serve chains to emSign ECC Root CA - G3 and replace any that does before 27 October, then rebuild Go binaries and update Node.js, Python, container base images and other bundled CA stores so that non-browser clients refuse the compromised intermediates too.

Two more NetScaler SAML flaws in October supersede September's fixed builds — support.citrix.com

Citrix published two more NetScaler ADC and Gateway bulletins in October, both for appliances configured as a SAML service provider or identity provider. CTX697174 (3 October) fixes CVE-2026-88779, a High-rated pre-authentication memory overflow leading to denial of service, which Citrix said had been used in targeted attacks and CISA added to its known exploited vulnerabilities catalogue on 4 October. CTX697191 (8 October) fixes CVE-2026-107406, rated Critical (CVSS v4 9.5), a memory overflow that can lead to remote code execution; it affects SAML identity provider configurations on the very builds September's bulletins said to install, 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28, and both SAML roles on earlier builds. The fixed builds are now 14.1-73.46 and 13.1-64.29.

Upgrade NetScaler ADC and Gateway to 14.1-73.46 or 13.1-64.29 (or the matching FIPS and NDcPP builds) now, even if you patched in late September or early October.

Ivanti Connect Secure zero-day grows into an exploited three-flaw chain that October's first fixes do not close — hub.ivanti.com

On 13 October Ivanti disclosed CVE-2026-104935, an authentication bypass by spoofing in Connect Secure that lets a remote unauthenticated attacker execute arbitrary commands, rated High (CVSS 8.6). Ivanti said it was aware of exploitation in the wild affecting a limited number of customers at the time of disclosure, and CISA added the flaw to its known exploited vulnerabilities catalogue the same day. On 30 October CISA added two more Connect Secure flaws to the catalogue, CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (predictable filenames), and now lists 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier as affected, which includes builds first described as resolved. CISA also warns that Ivanti's Integrity Checker Tool may not detect exploitation, because the attacker's commands run in memory. Both the 22.7 and 22.8 lines reach end of life on 31 January 2027.

Update Connect Secure beyond 25.1.1.2, 25.1.2.2 and 22.8R2.5 to the fixed builds in Ivanti's current advisory, even if you patched in mid-October; treat any appliance exposed this month as possibly compromised and use network and memory forensics rather than the Integrity Checker Tool alone; and plan the move to the 25.1 line before 31 January 2027.

Fortinet ships critical fixes for FortiOS and other products, with details held until 10 November — cyber.gov.au

On 21 October Fortinet announced a coordinated set of security updates for FortiOS, FortiManager and FortiAnalyzer for release on 22 October, following releases for FortiMail and FortiAuthenticator, and urged every customer to upgrade promptly, prioritising internet-facing devices. Fortinet says the releases include critical and high-severity fixes for vulnerabilities found through its frontier AI-assisted security testing, and that public advisories will follow on 10 November. ASD's ACSC issued an alert on 23 October calling them critical vulnerabilities and repeating Fortinet's interim advice: restrict administrative interfaces to trusted addresses or disable them on external interfaces, keep FortiManager administration off the internet, and enforce MFA.

Upgrade internet-facing FortiGate, FortiManager and FortiAnalyzer devices now rather than waiting for the 10 November advisories, and close administrative interfaces to the internet in the meantime.

ASD launches the Essentials as the next evolution of the Essential Eight — cyber.gov.au

On 15 October ASD launched the ASD Essentials, which it describes as an evolution of the Essential Eight: threat-informed, prioritised measures for Commonwealth entities, critical infrastructure operators and large organisations, arranged as a series of chapters. The first three are Essentials for enterprise IT (the evolution of the Essential Eight), Essentials for operational technology, and Essentials for cloud, for organisations whose technology is delivered entirely through software-as-a-service and platform-as-a-service; AI-focused guidance sits alongside them. ASD says organisations should keep meeting their current regulatory obligations until regulators communicate changes, and it will maintain both the Essential Eight and the Essentials on cyber.gov.au during the transition.

Map your current Essential Eight evidence against the enterprise IT and cloud chapters now, so you can answer a client or assessor who asks how you align with the Essentials, but keep reporting Essential Eight maturity until regulators set a transition date.

Joint advisory lists the decade-old web flaws state-linked actors still exploit — cyber.gov.au

On 9 October ASD's ACSC published a joint advisory, drawn from FBI investigations into Integrity Technology Group and co-sealed with CISA, NSA, NCSC-UK, the Canadian Centre for Cyber Security, Japan's NPA and NCO, New Zealand's NCSC and others, on how Chinese government-linked actors combine automated scanning with hands-on intrusion to steal data. It lists eight CVEs the actors exploit, most of them years old: GNU Bash through 4.3 (CVE-2014-6278), ProFTPD 1.3.5 (CVE-2015-3306), ISC BIND 9 (CVE-2015-5477), Apache Struts 2.3 (CVE-2016-3081), Pulse Connect Secure (CVE-2019-11510), GitLab from 11.9 (CVE-2021-22205), ONLYOFFICE Document Server (CVE-2021-3199) and Strapi up to 4.5.5 (CVE-2023-22894).

Search your estate for the eight CVEs, particularly old Strapi, GitLab, Struts and BIND installs, and patch or retire anything still exposed; use the advisory's indicators to sweep logs on internet-facing hosts.

Attackers use stolen UpdraftCentral keys to plant admin accounts and plugins on WordPress sites — teamupdraft.com

TeamUpdraft, which makes the UpdraftPlus backup plugin, says it identified unauthorised access to teamupdraft.com over the weekend of 17–18 October and believes its customer database was accessed, including connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. UpdraftCentral keys can send commands to connected sites, and the attacker used those connections to create admin accounts and install malicious plugins; TeamUpdraft says the full extent is unknown. UpdraftPlus 1.26.13 and 2.26.13, pushed on 19 October, revoke the old UpdraftCentral connections, and a 21 October update asks UpdraftPlus Premium users to check their sites even if they never used UpdraftCentral. The plugin itself, its downloads and self-hosted UpdraftCentral were not affected.

Update every UpdraftPlus site to 1.26.13 or 2.26.13 from the site's own dashboard, check each for unexpected admin or editor accounts and unrecognised plugins, and restore from a backup taken before 17 October if anything is wrong.

Drupal Commerce access bypass is exploited as core fixes a Critical Field UI code execution flaw — drupal.org

On 28 October Drupal rated an access bypass in Commerce Core (SA-CONTRIB-2026-254, CVE-2026-118539) Highly critical 21/25 and said it is being actively exploited in the wild; it is fixed in 3.3.13 and 8.x-2.41, and the advisory tells sites to audit their orders for inconsistencies. Earlier, on 14 October, Drupal released 11.4.10, 11.3.19 and 10.6.19 for SA-CORE-2026-014 (CVE-2026-108097), a remote code execution flaw in the core Field UI module rated Critical 19/25. Core alone has no direct exploit path, but the advisory says multiple serious paths exist with contributed modules and at least one needs no authentication; uninstalling Field UI mitigates it until sites update, and Drupal 12.0.0-beta2 carries the fix. Two Moderately critical core cross-site scripting fixes shipped the same day. The other contrib advisories of the month included two more Highly critical code execution flaws, in Block AJAX (SA-CONTRIB-2026-192, fixed in 3.0.2) and Ffmpeg Image Toolkit (SA-CONTRIB-2026-220, fixed in 1.0.3), and eight for the AI module on 28 October, the highest a Critical cross-site scripting flaw fixed in 1.5.2 and 1.4.11, with the 1.3.x branch now unsupported.

Update Commerce Core to 3.3.13 or 8.x-2.41 now and audit this month's orders for inconsistencies; update core to 11.4.10, 11.3.19 or 10.6.19 (sites on 11.2, 10.5 or older must change branch); then run the 7, 14, 21 and 28 October contrib lists against your sites, starting with Block AJAX on Layout Builder sites, Ffmpeg Image Toolkit and the AI module.

WordPress 7.1.4 fixes 22 vulnerabilities, including a race condition during core updates that can lead to code execution — wordpress.org

On 28 October WordPress released 7.1.4, a security release fixing 22 vulnerabilities, with fixes backported to every branch from 4.7 (4.7.39 to 7.0.8). The most serious is a race condition during core updates that could lead to remote code execution while an update is in progress. Most of the rest are stored cross-site scripting flaws that need a Contributor, Author or Editor account, many of them in Interactivity API bindings and core blocks, alongside an information disclosure exposing unpublished Customizer changes to unauthenticated visitors. The release also updates the bundled root certificates after the eMudhra revocation.

Confirm every site is on 7.1.4 or its branch's backport, starting with sites where automatic background updates are turned off, and review which accounts hold Contributor or higher roles on sites that accept guest authors.

LiteLLM's release pipeline is hijacked to ship a credential stealer to PyPI and Docker — docs.litellm.ai

In the early morning of 21 October LiteLLM's release pipeline was compromised and pushed v1.107.0 to PyPI and its Docker registry; LiteLLM says that version contained compiled malware which steals credentials and loads remote code execution tools. The releases were pulled the same day, LiteLLM says all earlier versions are safe, and its private enterprise builds were not affected. BleepingComputer reports that all seven PyPI wheels and the v1.107.0, latest, main-latest and main-stable tags on Docker Hub and GHCR carried it. On 23 October LiteLLM replaced its cosign image-signing key, saying it believes the private half of the old key was exposed, and that the compromised v1.107.0 images carry a valid signature from that old key.

Search lock files, requirements and image digests for litellm 1.107.0 and the four Docker tags pulled on 21 October; rebuild any host that installed or ran it, rotate every credential it could reach, and pin 1.106.2 by digest. Verify LiteLLM images only against the new cosign key, because a valid signature from the old key no longer proves an image is clean.

GhostAction plants secret-stealing workflows in thousands of repositories as GitHub ships workflow lockfiles — thehackernews.com

From 7 October, attackers using stolen tokens pushed workflows named security-audit.yml or github_actions_security.yml into victims' repositories to pull secrets out of CI. GitGuardian's count, reported on 15 October, is about 1,900 compromised accounts and more than 30,000 targeted repositories, and GitHub began stopping the malicious workflow from running on 9 October. In the same month GitHub shipped Actions workflow lockfiles, which pin actions and their dependencies to commits: public preview on 14 October, then generally available on 28 October with a "Require lockfile" policy for administrators. npm also made unvalidated trusted-publishing configurations expire 48 hours after creation and stopped accepting publishes triggered by issue_comment (2 October).

Search every repository for security-audit.yml or github_actions_security.yml added since 7 October and rotate any token that could push to them, generate lockfiles with gh actions-lock and turn on the Require lockfile policy for release workflows, and move npm publishing jobs off issue_comment triggers.

Terraform 1.17 makes Terraform Policy generally available as go-getter and OpenTofu patch download flaws — github.com

Terraform 1.17.0, released on 21 October, makes Terraform Policy generally available, so the -policies flag no longer needs an experimental build, and adds variables and locals in provider requirements and a -minimal-refresh planning option. It and 1.16.7 are built with Go 1.26.10, which no longer trusts the compromised eMudhra intermediates. HashiCorp's HCSEC-2026-44 (8 October) fixes a path traversal in go-getter's S3 and GCS directory downloads (CVE-2026-19585), and OpenTofu 1.12.8 (14 October) and 1.13.2 (21 October) fix excessive CPU use when tofu init connects to an attacker-controlled HTTP/2 server, with 1.13.2 and 1.12.9 also filtering the compromised intermediates. For provider authors, terraform-plugin-sdk 2.41.0 (6 October) moves to Go 1.26.

Move CI to Terraform 1.16.7 or 1.17.0, or OpenTofu 1.13.2 or 1.12.9; update anything that embeds go-getter to 1.8.10 or 2.2.5; and build providers on Go 1.26 before taking terraform-plugin-sdk 2.41.0.

PHP fixes two critical remote code execution flaws that trigger before application code runs — php.net

On 21 October PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixed two Critical vulnerabilities, both rated CVSS v4 9.2, that can allow unauthenticated remote code execution: CVE-2026-109618, through memory corruption when PHP runs out of memory, and CVE-2026-109619, through stale global state left over between requests. The PHP project says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the highest risk because of a demonstrated exploit that an unauthenticated request triggers before any application code runs. ASD says all PHP versions from PHP 5 onwards may be affected. PHP 8.1 and older get no releases, though the security team published minimal source backports for 7.4, 8.0 and 8.1. On 26 October CISA added both flaws to its known exploited vulnerabilities catalogue.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package, then rebuild images and restart every worker. Until then, block multipart/form-data requests at the web server or CDN for sites that take no uploads, as PHP's advisory for the out-of-memory flaw suggests; the ini settings PHP lists, such as memory_limit=-1 and session.upload_progress.enabled=0, each cover only part of the problem. Plan off anything older than 8.2.

Related reading: When the patch diff writes the exploit

Node.js security releases fix a Brotli decoder flaw that can lead to remote code execution — nodejs.org

Node.js 26.12.1, 24.22.1 and 22.23.4, released on 21 October, fix ten vulnerabilities (four rated high, three medium and three low) and update bundled dependencies, including the CA certificates to drop the compromised eMudhra intermediates. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder: an attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, leading to a crash, memory disclosure or remote code execution. Two other high-rated fixes close TLS certificate hostname bypasses (CVE-2026-105483 and CVE-2026-106069), and the fourth stops dns.resolve truncating names that contain a NUL byte (CVE-2026-105482).

Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 and rebuild container images from a freshly pulled base, starting with services that decompress Brotli data from sources they do not control.

Go fixes 15 standard library and toolchain flaws, then blocks the eMudhra intermediates — go.dev

Go 1.27.2 and 1.26.9, released on 8 October, include security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto and os packages. Go's vulnerability database lists 15 CVEs published that day: eight in net/http, two in html/template, two in the go command, and one each in crypto/tls, net/textproto and os. On 19 October Go 1.27.3 and 1.26.10 added a crypto/x509 fix (CVE-2026-111943) that makes certificate verification reject the compromised eMudhra intermediates, covering cases where system trust stores do not.

Rebuild Go services and CLIs with Go 1.27.3 or 1.26.10, since Go binaries only pick up these fixes when rebuilt, starting with anything that serves HTTP or renders html/template output.

Next.js and React fix two Critical remote code execution flaws out of band — nextjs.org

On 14 October Next.js shipped 16.4.1 and 15.5.28 out of band, fixing two Critical vulnerabilities and one High. GHSA-673q-mjm6-r5xr allows remote code execution in App Router apps using Cache Components when a use cache function returns multiple typed arrays; it affects 16.0.0 to 16.4.0 and has no workaround. CVE-2026-96889 allows remote code execution through the Image Optimization API when Next.js runs on glibc-based Linux, with sharp 0.35.5 or later as the workaround. GHSA-p3m5-59mp-jv5r is a High-rated denial of service in Server Actions. React fixed related Server Components flaws, one Critical and one High, the same day in react-server-dom-* 19.0.9, 19.1.10, 19.2.9 and 19.3.1.

Upgrade Next.js to 16.4.1 or 15.5.28 now and confirm the deployed sharp is 0.35.5 or later; apps that use React Server Components outside Next.js should move react-server-dom-* to a fixed release.

Astro 7.4 raises the Node.js floor to 22.22.0 as two rendering-injection advisories land — astro.build

Astro 7.4, released on 15 October, raises the minimum supported Node.js version for Astro and its official integrations to 22.22.0, and official integrations need to move with it because their new versions require Astro 7.4. Two advisories landed around it: a Low-rated CSS injection in View Transitions (GHSA-mpr7-6m5w-76rw, 12 October, affecting 7.1.0 to 7.3.2 and fixed in 7.3.3), and a cross-site scripting flaw through unescaped <script> and <style> content in JSX and MDX rendering (CVE-2026-114128, fixed in 7.3.2).

Raise build images to Node.js 22.22.0 or later, then upgrade to Astro 7.4 (or at least 7.3.3 for both advisory fixes) together with its official integrations.

Hugo v0.168.0 fixes inline JavaScript escaping and stops themes overriding module replacements — github.com

Hugo v0.168.0, released on 13 October and built with Go 1.27.2, picks up Go's two html/template fixes for incorrect escaping of inline JavaScript (CVE-2026-94448 and CVE-2026-97030), which also apply to Hugo's fork of the template package, and a minifier upgrade that fixes improperly escaped </script> and <!-- in inline JavaScript (GHSA-3ppm-p7r9-c5w3). It also carries Go's fix for Windows junctions escaping a root directory (CVE-2026-56857). One breaking change: Hugo now ignores module.replacements defined in themes, so only the project can define replacements.

Upgrade to v0.168.0 and rebuild every Hugo site, since corrected escaping only reaches pages when they are rebuilt, and move any module.replacements set in a theme into the project's own configuration.