Patch and advisory news from ZeroDayFeed — Patch Tuesday, vendor security bulletins, CISA advisories, and which fixes to prioritize.
Google shipped Chrome 155 desktop updates on Oct 13 and Oct 15, 2026, fixing 47 security bugs, eight of them critical, including an ANGLE buffer overflow and a Prerender use-after-free. Google has not marked any of them as exploited in the wild.
Read the story →F5 fixed 11 NGINX defects, including two configuration-dependent heap overflows and an AIO use-after-free it scores CVSS 4.0 9.2, while Juniper shipped 17 advisories covering more than 150 Junos flaws. Neither vendor reports exploitation.
Microsoft's October 13 Patch Tuesday fixed a record of more than 1,400 vulnerabilities. One of them, CVE-2026-96951, is a Windows Shell Mark-of-the-Web bypass that attackers were already exploiting, and CISA added it to the KEV catalog the same day.
Microsoft says the October 2026 Windows Server updates can stall on-prem Exchange 2016, 2019 and Subscription Edition: OWA sign-in fails, mail stays in Outboxes and queues grow, because of a new Endpoint Mapper cap. The fix for now is a registry change, not removing the update.
Drupal fixed a critical remote code execution flaw in core's Field UI module (CVE-2026-108097, SA-CORE-2026-014) and a related Entity List bug, warned that exploits may appear within hours or days, and urged sites to update to 10.6.19, 11.3.19 or 11.4.10.
Free daily briefing — breaches, actively exploited bugs, ransomware, and the patches to prioritize.
You're in. ✓
Check your inbox to confirm your subscription.No spam. Unsubscribe any time. Read our privacy policy.
