Blog
1,413 CVEs in One Month: Why "Patch Everything" Is Dead and What Replaces It
Microsoft’s October 2026 Patch Tuesday fixed 1,413 CVEs, according to SecurityWeek . The same report says that is more than Microsoft patched in all of 2025, and that the surge is “largely driven by AI”, which is the reporter’s characterisation and not a Microsoft statement. Computerworld counts 1,408 CVEs requiring customer action, 72 of them rated critical. A small team cannot test 1,400 fixes a month. It also does not need to. The count has stopped telling you what is urgent.
Already Running ISO 27001? Your AI Governance Programme Is Mostly Built
“Do we have an AI policy?” now reaches IT managers from clients, auditors and tender documents. If your organisation already runs an ISO/IEC 27001 information security management system (ISMS), you hold most of the machinery needed to answer it. Two frameworks, two jobs A Kovrr comparison published on Security Boulevard in October 2026 sets out the choice. ISO/IEC 42001 is certifiable through accredited bodies in a two-stage audit. NIST AI RMF is voluntary and free to apply, and it carries no certification.
Copilot Just Became a Utility Bill: Set the Meter Before Microsoft Does
Microsoft moved default usage-based billing for new Microsoft 365 Copilot Business subscriptions bought through the Cloud Solution Provider (CSP) channel from 2 November to 1 December 2026, according to trade coverage of the delay . Reporting attributes the move to partners needing time in sandbox environments that open on 2 November. Those sources date the announcement to the first week of October. Those extra weeks belong to IT. Copilot now has a metered side, and the people who hold the admin controls decide how that meter runs.
Your Trust Store Is Infrastructure: What the eMudhra CA Compromise Exposed
On 17 October a researcher reported that eight eMudhra intermediate certificate authorities had private keys anyone could recover from the public certificates. Mozilla recovered the keys itself less than two hours after the report reached it, according to CSO Online . Google said the keys were generated with “insufficient randomness”. Scott Helme recovered all eight in under a second, and some of the values were as small as 4, 56 and 115. Six of the intermediates issued TLS certificates and two issued code-signing certificates.
The Weather Server Did It: ATNS and the Secondary Systems That Sink You
Air Traffic and Navigation Services (ATNS) manages 10% of the world’s airspace, according to MyBroadband’s report of 2 October 2026 ; TimesLive puts the figure at more than 6%. MyBroadband also reports that preliminary investigations found malware “commonly associated with the early stages of ransomware attacks” in the operational technology (OT) environment at Chief Dawid Stuurman International Airport. Facts as publicly reported at 2 October 2026; the investigation is ongoing and details may change. The reporting names a weather support system as the affected system. It does not establish that system as the origin, and it does not state how access was gained. Avi-Go reports the tender documents are unclear on whether East London Airport was also affected.
Your AI Coding Agent Is a Supply Chain: Plugins, Hooks and MCP Configs Need Governing Too
An AI coding agent is a supply chain. Every plugin, lifecycle hook and MCP server it loads is third-party software that runs with the developer’s access, and most organisations review none of it. In our analysis of agents causing accidental damage , the agent was the source of the failure. This follow-up covers the reverse: the extensions around the agent being turned against the organisation. What October’s AI coding agent threats mean in plain English Adversa AI’s 2 October 2026 roundup lists several disclosures and research findings. AIR Security named one flaw Plugin4Shell: a branch named like a pinned commit SHA silently swaps malicious code into a plugin during automatic updates. Researchers reported trojanised plugin lifecycle hooks succeeding up to 92.5% of the time per harness across ten attacker objectives. A tool called ZCode packaged whole workspaces, Git history included, into encrypted snapshots uploaded to Alibaba Cloud OSS. Separately, Manifold Security disclosed GitSpawn in early September 2026 (1 to 2 September): a git config remote code execution flaw affecting AI coding agents, as covered by The Hacker News.
The Breach a Journalist Had to Report: What Gauteng's e-Panic Button Teaches Us About Section 22
On 21 September, GroundUp told the Gauteng government and the vendor behind its e-Panic Button app that the database behind the app was unsecured. According to GroundUp’s investigation, the exposed data included names, phone numbers, email addresses, vehicle registration numbers, GPS coordinates and movement histories, the contents of crime reports, and more than 5,000 report photographs. Some reports concerned domestic violence and assault. The vendor, Evolve Value Added Services, responded and fixed the reported vulnerabilities. The government’s first public response came on Tuesday 29 September, eight days after the tip-off. It said no citizens’ personal information was compromised. On 30 September the Information Regulator told the Mail & Guardian it had not received a notification from the department. By 3 October the Gauteng Legislature’s e-Government Committee was saying the app was not safe to use and asking for a report on access logs going back to the app’s 2024 launch.
Your Vendor's Breach Is Your POPIA Problem: Third-Party Risk in SA's Breach Wave
South African enterprises operate in the middle of an aggressive supply chain breach wave. Major incidents across public and private institutions—including the Companies and Intellectual Property Commission (CIPC), the Department of Justice, major credit bureaus, and national healthcare administrators—demonstrate a consistent attack strategy. Sophisticated threat actors prioritize third-party vendors, IT service providers, and cloud processors. Compromising a single service provider unlocks access to the sensitive customer databases of hundreds of corporate clients simultaneously.
48,000 Files in 103 Seconds: Treat AI Agents Like Privileged Automation
In September 2026, an engineer tasked an autonomous AI coding assistant with an environment cleanup and dependency rebuild. The agent operated with broad shell permissions inside an interactive development session. Within 103 seconds, 48,000 files vanished across the developer’s workstation. The purge swept through parent directories, shared caches, and the local .git/objects store. The destruction of the object database eliminated uncommitted changes and wiped the local Git tree required for immediate repository recovery. Once the disk activity ceased, the terminal presented a polite single-line apology: the agent acknowledged the disruption and offered to help rebuild the workspace.
Constraints Breed Character: Why Older Games Feel More Cohesive Than Modern Bloat
In 1999, the development team at Konami faced a severe technical ceiling while building the original Silent Hill for the Sony PlayStation. The console possessed two megabytes of main system RAM and one megabyte of video memory. Rendering a fully three-dimensional town square with dynamic camera angles overwhelmed the hardware, causing severe frame drops and aggressive geometry pop-in along the horizon. A lesser team would have scaled back the ambition, reverting to pre-rendered static backgrounds. The developers embraced the bottleneck directly. They enveloped the entire town in a dense, suffocating wall of volumetric fog that masked the short draw distance perfectly. What began as a desperate hardware workaround became the defining psychological atmosphere of the entire franchise. The hardware limitation gave the game its immortal soul.