Critical Patches, AI Safety, And Major AWS Platform Updates

Today’s security update spans actively exploited vulnerabilities, broad monthly patching, and software supply chain safeguards, alongside major AI safety disclosures and substantial AWS operations updates. Google detailed new guardrails for a frontier model, the UK outlined an AI security program, and Microsoft marked a Windows lifecycle milestone. AWS introduced capabilities to improve fleet visibility, governance, and data movement, while researchers and vendors addressed critical flaws affecting CI/CD, registries, PDF rendering, and SDKs.

Exploited Zero-Days and Patch Priorities

BleepingComputer reports Ivanti has warned of CVE-2026-104935, a high-severity authentication bypass in Connect Secure gateways that allows remote, unauthenticated command execution. Ivanti notes limited exploitation, urges immediate upgrades to fixed releases, and recommends running the Integrity Checker Tool as part of response and monitoring.

Talos highlights Microsoft’s October Patch Tuesday: 1,415 vulnerabilities fixed, including 85 rated critical and one actively exploited issue (CVE-2026-96951, Windows Shell security feature bypass, CVSS 8.8). High-priority components include Message Queuing, Microsoft QUIC, media decoders, Office clients, Exchange, and Active Directory; organizations should prioritize updates for internet-exposed and high-impact services.

The Hacker News covers GitLab’s emergency fixes for CVE-2026-97229 (CVSS 10.0), an integer overflow in the CI/CD regex compiler enabling unauthenticated code execution on affected servers. Patches are available in 19.2.8, 19.3.5, and 19.4.2; additional high-severity fixes address reflected XSS, improper authorization in protected-branch pipelines, and cache poisoning that could expose protected environment variables.

The Hacker News details CVE-2026-105445 in Docker Hub, where personal access tokens were reassigned during account-to-organization conversions without rotating secrets or owner consent. Docker patched the issue on September 30, 2026, reviewed around 304,000 pushes tied to transferred tokens with no evidence of abuse, notified affected users on October 2, and deactivated transferred tokens on October 8 unless explicitly retained.

BleepingComputer reports a critical Ghostscript heap overflow (CVE-2026-39919) triggered by crafted PDFs with JPEG 2000 images, affecting versions 9.21–10.07.1. Artifex released 10.08.0 on September 8 with backports; systems that render user-supplied PDFs (for example, via ImageMagick) should update promptly or apply mitigations such as disabling PDF rendering or blocking PDF uploads until patched builds are deployed.

The Hacker News covers CVE-2026-89111 (CVSS 10.0) in SAP’s Cloud SDK for Python, where a missing tenant-subdomain validation could send OAuth2 client credentials to attacker-controlled endpoints. The check was added in 0.45.2 and restored in 0.55.1 after a brief regression in specific modules; releases before 0.45.2 and certain 0.36.x and 0.53.0–0.55.0 lines are affected.

The Hacker News reports GitHub tightened npm Trusted Publishing after researchers showed abandoned repository slugs could be reclaimed to publish new package versions via OIDC without stolen credentials. Mitigations include a 48-hour expiry for unvalidated configurations, rejecting tokens from issue_comment events, and guidance to re-create trust bindings after repository path changes.

Frontier AI With Safety Guardrails

Google Blog describes the responsible development of Gemini 4 Argon, a next-generation model evaluated through limited programs and internal security teams that used it to uncover and patch critical vulnerabilities. Google implements layered protections—input screening, internal introspection probes, and continuous monitoring that can halt problematic reasoning—reporting reduced harmful completions on adversarial tests, sub‑1% success on tested bio-related jailbreaks, and strong resistance to prompt injection per Gray Swan’s IPI benchmark.

Google Cloud announced Gemini 4 Argon availability via the Gemini platform API, AI Studio, and Google Antigravity, with introductory pricing through November 30, 2026. The enterprise-focused model is designed for long, multi-step workflows across legal, finance, development, and security, with improved context handling, multi-format document processing, structured outputs with citations, and security features such as resilience to indirect prompt injection; vetted defenders can access an unmitigated version through the Fairwind Program.

AWS Updates for Visibility and Governance

AWS ECS added the LiveTaskCount metric at no charge to show all actively running tasks across transitional states, aiding autoscaling and capacity planning. AWS also removed charges for the Container Insights RunningTaskCount metric, clarifying its use as a health and stability signal; changes apply across all Regions with pricing effective October 1, 2026.

AWS Agent Registry now supports custom metadata schemas for registry records, enabling consistent tagging of attributes such as ownership, data classification, and review status. Publishers can define required and validated fields, and users can filter by any metadata via Console, CLI, SDKs, or the MCP endpoint across supported Regions.

Agent Toolkit introduced the AWS AI/ML skill to let coding agents manage SageMaker workflows via natural language. The consolidated, supported integration—also pre-installed in SageMaker Studio JupyterLab—expands coverage for inference optimization, end-to-end customization and fine-tuning, serverful training, MLflow tracking, JumpStart deployment and recommendations, and managed processing for ETL and data prep.

AWS DataSync Enhanced mode now supports FSx for OpenZFS as source and destination, adds NFS 4.2 for on‑prem servers and FSx for OpenZFS, and introduces an ObjectMetadata option to control user metadata copying in object transfers. The update removes prior mode limitations and improves interoperability for hybrid and multi‑cloud migrations.

Lifecycle, Tooling, and Assurance

BleepingComputer notes that Windows 11 version 24H2 Home and Pro reached end of updates, with the October 2026 security release as the last for those editions. Microsoft advises upgrading to Windows 11 26H2, which is rolling out as an enablement package and remains under mainstream consumer support through October 2029.

Infosecurity reports the UK government announced measures to strengthen defenses against AI-enabled threats, including using frontier models to find vulnerabilities, coordinated incident response processes, and amendments to the Cyber Security and Resilience Bill for loss‑of‑control risks and mandatory incident reporting. A National Cyber Action Plan is forthcoming, and AISI has resumed frontier model testing to inform risk management.

Fortinet Blog states the FortiOS product family (FortiGate, FortiGate Rugged, FortiWiFi, FortiGate VM) achieved IEC 62443 certification: component capabilities at IEC 62443‑4‑2 Security Level 4 and the development lifecycle at IEC 62443‑4‑1 Maturity Level 2. Coverage spans FortiOS v7.4.x, v7.6.x, and v8.x.x, offering a single body of evidence across appliances and virtual form factors for industrial and critical infrastructure environments.

VirusTotal introduced macOS Mirage, a dynamic analysis sandbox for Apple Silicon and macOS 26 that replaces Box of Apples. Mirage captures process, file system, persistence, and sensitive store access events, supports diverse payloads and installers, applies Sigma rules mapped to MITRE ATT&CK, and exposes behavioral data publicly in VirusTotal reports; enterprise users gain interactive live analysis via Private Scanning.