Vulnerabilities & Security
Exploited and newly patched software vulnerabilities (CISA KEV, Microsoft, Apple, Google, Android, routers), with simple protection steps and a link to the source. RSS
-
Vulnerabilities & Security
Windows flaw that hides the warning on dangerous files is already used in attacks
With its October updates Microsoft fixed CVE-2026-96951, a flaw in Windows Shell that attackers are already exploiting. A specially crafted file sent by email, chat or a web page bypasses the Mark of the Web label, so no SmartScreen warning appears and Office does not open it in Protected View. Windows 10, Windows 11 and Windows Server are affected. CISA added it to its Known Exploited Vulnerabilities catalogue on 13 October.
What it means: Mark of the Web is one of the quiet mechanisms that protect Windows users every day: each file that arrives from the internet gets a label, and based on it Windows and Office show warnings or open the file in a restricted mode. When the label is bypassed, the user loses the last message that would have made them stop before opening something dangerous. That is why such flaws often appear in phishing campaigns against businesses, where a fake invoice or a supposed offer is enough to start an attack. It is the third actively exploited Windows Shell flaw this year, which shows that attackers keep coming back to this spot. For Greek offices and accounting firms, which exchange attachments with clients and suppliers every day, installing the October updates promptly is the main defence. The support cycle also matters: the Home and Pro editions of Windows 11 24H2 stopped receiving updates on 13 October, so anyone still on that version needs to upgrade to keep getting fixes. Finally, the lack of a warning does not mean a file is safe; an unexpected attachment stays suspicious until the sender is confirmed another way.
-
Vulnerabilities & Security
Plex Media Server: four chained flaws under mass attack, update to 1.43.3.10861
Plex confirmed on 19 October that four flaws in Plex Media Server, when combined, let an attacker with no account run code on the server over the internet. After proof-of-concept code was published on 16 October, attacks became widespread, installing cryptocurrency miners and proxy software. CISA added CVE-2026-96652, -96654, -96655 and -96656 to its Known Exploited Vulnerabilities catalogue on 20 October. The fix is available from version 1.43.3.10861.
What it means: Plex is one of the most popular programs for personal film and music libraries, and it often runs on a NAS, an old computer or a small office server. Many people have opened it to the internet to watch content away from home without thinking of it as a service that needs maintenance. That makes it an ideal target: a machine that stays on around the clock, with a good connection and often with access to shared folders on the network. The fix came out in early September, yet mass attacks began only once demonstration code was published, which shows that the critical window is the days after a flaw is analysed in public. NAS devices lag behind in particular, because vendor app stores do not always ship the new version straight away and a manual install is needed. For anyone running Plex the steps are simple: check the version in the settings, update, and turn off remote access if you do not use it. If the server was old and exposed, the safest option is a clean install, a new account password and a check of every folder and password that was reachable from the same machine. For small businesses, the case is a reminder to keep a list of which devices on their network are open to the outside, because a forgotten media server can become the door to the whole network.
-
Vulnerabilities & Security
Chrome 156 ships 353 security fixes, six of them critical, and they only apply after a restart
Google released Chrome 156 on 20 October with 353 security fixes, including six rated critical and 61 rated high. Most of the flaws involve memory handling, with 163 memory-corruption cases and 125 use-after-free bugs. Google does not report active exploitation for any of them. The release is 156.0.8078.47/.48 for Windows and macOS and 156.0.8078.47 for Linux.
What it means: The number of fixes is unusually large, and much of it comes from automated tools and AI systems that find flaws far faster than people can. That is good news for security in the long run, but it means browser updates will keep getting more frequent and more important. The practical problem is not downloading the update, which happens automatically, but applying it: Chrome keeps running the old version until it is fully closed, and many users leave the browser open for days with dozens of tabs. The page chrome://settings/help shows the current version and a relaunch button, and tabs are restored automatically. The same applies to Edge, Brave, Opera and other Chromium-based browsers, which bring the same fixes through their own updates. Businesses should use policies to set a maximum time before a restart is forced, so office computers do not stay on an old version for weeks. The browser is now the main work tool, with access to email, banking, accounting software and cloud apps, so updating it on time protects far more than the page in front of you.
Summaries are ours. Copyright in the original articles remains with their publishers.
Have a project in mind?
Tell us what you need to achieve. You get a concrete proposal with scope, timeline and cost — no obligation.