Windows: October Patch Tuesday with an actively exploited vulnerability

Microsoft has released the October 2026 security update (17 October) with more than 1,450 CVEs. Notable ones include CVE-2026-96951, a Shell Security Feature Bypass in Windows for which active exploitation has been observed, and CVE-2026-108398 in .NET Framework. Workstations running Windows should be updated quickly; check the MSRC release note for prioritisation.

Source: Microsoft Security Update Guide, October 2026

VMware vCenter: critical RCE in the Syslog component

CVE-2026-59310 is a directory traversal vulnerability (CVSS 9.8) in the Syslog server component of VMware vCenter. An unauthenticated attacker with network access can use it to execute arbitrary code; the vulnerability is already being actively exploited. Internet-facing, unpatched vCenter instances should be fixed urgently.

Source: Kudelski Security, VMware CVE-2026-59310

Xoscar: unauthenticated RCE via cloudpickle

CVE-2026-49950 in Xorbits Xoscar (the actor/RPC framework underneath Xinference) allows unauthenticated remote code execution through unsafe deserialisation in the transport layer. All released versions are affected and there is no fixed version (yet); keep actor pool ports within private network segments. Relevant for anyone running distributed AI inference.

Source: VulnCheck, Xorbits Xoscar

CISA adds Fortinet and BeyondTrust vulnerabilities to KEV

CISA has added several vulnerabilities in Fortinet products and in BeyondTrust Remote Support to the Known Exploited Vulnerabilities catalog. Affected products warrant urgent remediation, especially when they are reachable internally or from the internet.

Source: Security Affairs, CISA KEV update

Apple updates the App Review Guidelines

Apple has updated the App Review Guidelines, including a new guideline on creative assets (2.3.14), clarification on hidden or undocumented features (2.5.19) and a stricter interpretation of section 5 for apps that facilitate abuse. Developers submitting or maintaining an app should take a moment to read through the changes.

Source: Apple, App Review Guidelines