ISO 27001
1,413 CVEs in One Month: Why "Patch Everything" Is Dead and What Replaces It
Microsoft’s October 2026 Patch Tuesday fixed 1,413 CVEs, according to SecurityWeek . The same report says that is more than Microsoft patched in all of 2025, and that the surge is “largely driven by AI”, which is the reporter’s characterisation and not a Microsoft statement. Computerworld counts 1,408 CVEs requiring customer action, 72 of them rated critical. A small team cannot test 1,400 fixes a month. It also does not need to. The count has stopped telling you what is urgent.
Already Running ISO 27001? Your AI Governance Programme Is Mostly Built
“Do we have an AI policy?” now reaches IT managers from clients, auditors and tender documents. If your organisation already runs an ISO/IEC 27001 information security management system (ISMS), you hold most of the machinery needed to answer it. Two frameworks, two jobs A Kovrr comparison published on Security Boulevard in October 2026 sets out the choice. ISO/IEC 42001 is certifiable through accredited bodies in a two-stage audit. NIST AI RMF is voluntary and free to apply, and it carries no certification.
Your Trust Store Is Infrastructure: What the eMudhra CA Compromise Exposed
On 17 October a researcher reported that eight eMudhra intermediate certificate authorities had private keys anyone could recover from the public certificates. Mozilla recovered the keys itself less than two hours after the report reached it, according to CSO Online . Google said the keys were generated with “insufficient randomness”. Scott Helme recovered all eight in under a second, and some of the values were as small as 4, 56 and 115. Six of the intermediates issued TLS certificates and two issued code-signing certificates.
The Weather Server Did It: ATNS and the Secondary Systems That Sink You
Air Traffic and Navigation Services (ATNS) manages 10% of the world’s airspace, according to MyBroadband’s report of 2 October 2026 ; TimesLive puts the figure at more than 6%. MyBroadband also reports that preliminary investigations found malware “commonly associated with the early stages of ransomware attacks” in the operational technology (OT) environment at Chief Dawid Stuurman International Airport. Facts as publicly reported at 2 October 2026; the investigation is ongoing and details may change. The reporting names a weather support system as the affected system. It does not establish that system as the origin, and it does not state how access was gained. Avi-Go reports the tender documents are unclear on whether East London Airport was also affected.
Your AI Coding Agent Is a Supply Chain: Plugins, Hooks and MCP Configs Need Governing Too
An AI coding agent is a supply chain. Every plugin, lifecycle hook and MCP server it loads is third-party software that runs with the developer’s access, and most organisations review none of it. In our analysis of agents causing accidental damage , the agent was the source of the failure. This follow-up covers the reverse: the extensions around the agent being turned against the organisation. What October’s AI coding agent threats mean in plain English Adversa AI’s 2 October 2026 roundup lists several disclosures and research findings. AIR Security named one flaw Plugin4Shell: a branch named like a pinned commit SHA silently swaps malicious code into a plugin during automatic updates. Researchers reported trojanised plugin lifecycle hooks succeeding up to 92.5% of the time per harness across ten attacker objectives. A tool called ZCode packaged whole workspaces, Git history included, into encrypted snapshots uploaded to Alibaba Cloud OSS. Separately, Manifold Security disclosed GitSpawn in early September 2026 (1 to 2 September): a git config remote code execution flaw affecting AI coding agents, as covered by The Hacker News.
The Breach a Journalist Had to Report: What Gauteng's e-Panic Button Teaches Us About Section 22
On 21 September, GroundUp told the Gauteng government and the vendor behind its e-Panic Button app that the database behind the app was unsecured. According to GroundUp’s investigation, the exposed data included names, phone numbers, email addresses, vehicle registration numbers, GPS coordinates and movement histories, the contents of crime reports, and more than 5,000 report photographs. Some reports concerned domestic violence and assault. The vendor, Evolve Value Added Services, responded and fixed the reported vulnerabilities. The government’s first public response came on Tuesday 29 September, eight days after the tip-off. It said no citizens’ personal information was compromised. On 30 September the Information Regulator told the Mail & Guardian it had not received a notification from the department. By 3 October the Gauteng Legislature’s e-Government Committee was saying the app was not safe to use and asking for a report on access logs going back to the app’s 2024 launch.