Software
October 2026 Patch Tuesday: Windows Zero-Day Already Exploited
October 2026 Patch Tuesday brings a record 1,400-plus fixes, and one Windows zero-day is already exploited, slipping files you open past SmartScreen. Patch it first.
TH
Theo Vance
Writer, Software
The apps and tools worth your time, and the free ones that quietly beat the paid subscriptions. Would rather show you a working option that costs nothing than a monthly fee for the same thing.
// 23 stories by Theo VanceAll writers →
Software
Anthropic Replaced Git With Its Own 'Scion' After AI Agents Broke It
Anthropic moved its entire codebase off Git onto a custom system called Scion, built by a seven-person team and rolled out in five months, after Claude's AI agents pushed daily merges from 2,500 to more than 30,000. Here is what Scion actually is, why Git could not keep up, and whether this really means anything for your own git workflow.
Software
iOS 27's new Siri AI is here, and its hardest thinking now runs in Google's cloud
iOS 27 shipped on 14 September with a rebuilt Siri AI, and its hardest requests now run on a Gemini-based model in Google's cloud. Here is what actually changed, which iPhones get it, the waitlist, and the privacy trade-off.
Software
A maximum-severity zero-day hit the software MSPs use to run their clients' networks
N-able rushed out an emergency hotfix for CVE-2026-86218, a perfect-10 pre-authentication flaw in its N-central platform that its own customer notice says was exploited in the wild. Because managed service providers use N-central to reach thousands of downstream businesses, one flaw can cascade. Here is what to patch, and the honest picture of what is and is not known.
Software
SonicWall's SMA 1000 appliances hit by two actively exploited zero-days: what to patch, and how fast
On 1 September SonicWall disclosed two zero-days in its SMA 1000 remote-access appliances, one of them a maximum-severity flaw, and both, SonicWall says, already under attack. CISA gave federal agencies just three days to fix them. Here is exactly what is affected, what is not, and the builds you need.
Software
Google has pulled uBlock Origin from the Chrome Web Store: what changed, and your best ad-blocker options now
On 31 August Google removed the last Manifest V2 extensions, uBlock Origin included, from the Chrome Web Store. It is the final step of a phase-out that has run since 2024, not a sudden ban. Here is what actually changed, why Google and its critics disagree, and where full uBO still runs.
Software
Hackers used Cursor's AI coding agent in a real ransomware campaign: what the Aurora case shows
Researchers documented a ransomware crew using Cursor's AI coding agent, powered by Claude, to help break into companies. It is a milestone, but the AI assisted a human, it did not attack on its own. Here is what happened, and how to defend against it.
Software
How to remove the background from a photo for free (2026)
You do not need to pay for this. We tested the free background removers and found the trap most people fall into, plus the genuinely free tools that give you a full-resolution cutout, including ones that never upload your photo at all.
Software
That maximum-severity Oracle WebLogic flaw with a three-day deadline is not a new zero-day
On 24 August, CISA added a CVSS 10.0 Oracle flaw, CVE-2026-21962, to its Known Exploited list with a three-day federal deadline. It reads like an emergency zero-day but is not: Oracle patched it in January 2026. What changed is the KEV listing, not the bug or the fix.
Software
The AI refused to steal the secrets, so researchers split the request into harmless pieces. It worked
Researchers at ASSET detailed GhostSplice, which makes AI coding agents leak local secrets by splitting a refused request across trusted channels, each fragment harmless alone. It roughly doubled compliance, from 42 to 82 percent, though Claude models mostly refused. A warning about how agents combine tool inputs.
Software
A Ray AI-framework bug got a rare three-day federal patch order. Here is what CVE-2025-62593 actually is, and what it is not
On 17 August, CISA added a critical Ray flaw, CVE-2025-62593, to its Known Exploited list with a three-day deadline; it lets a malicious web page reach a developer's local Ray dashboard and run code. It is narrower than the scary numbers, which belong to an older Ray bug.
Software
A poisoned Rust crate with 245 million downloads shows how a build script can compromise you before you run the program
On 20 August, attackers pushed malicious versions of three popular Rust crates, led by arrayref, with 245 million downloads. The malware ran at compile time, not runtime, so merely building a project could infect you. A registry supply-chain attack, not a Rust flaw; the team pulled all three within about 90 minutes.
Software
A security scanner was the way in: the LiteLLM package hijack that put thousands of companies' secrets at risk
In March, attackers hijacked the vulnerability scanner inside LiteLLM's build pipeline, stole its package-publishing keys and pushed two poisoned versions to PyPI. They were live only about 40 minutes, but a Python auto-run trick did the rest. Researchers estimate the fallout put credentials from more than 2,500 companies at risk.
Software
Patch Tuesday keeps breaking records because Microsoft aimed AI at its own code
Microsoft's monthly security fixes have exploded: 200 in June, a then-record 570 in July, nearly 400 in August, and a fresh all-time record of roughly 970 in September 2026. The reason is not that Windows got less safe. It is that AI now finds bugs at machine scale, and Microsoft says giant monthly updates are the new normal.
Software
Even Linux is embracing AI now, and drowning in it at the same time
Linus Torvalds has made it official: arguably the world's most important open-source project 'is not one of those anti-AI projects.' At the same time, the volunteers who maintain the Linux kernel are being buried under a flood of AI-generated bug reports and patches. Both things are true, and together they are the story of open source in 2026.
Software
Meta just entered the AI coding-agent wars. The big two are now a big three
With Muse Code, Meta has launched its own AI agent that writes, tests and ships software from your terminal, going straight at Anthropic's Claude Code and OpenAI's Codex. Its headline trick is running many AI coders in parallel without them tripping over each other. Here is what it is, what's genuinely new, and the honest caveats.
Software
'Vibe coding' let anyone build an app. Now the security bill is coming due
AI tools now let people describe an app in plain English and ship it without writing code, nicknamed 'vibe coding.' It is genuinely empowering, and it is producing a wave of live apps riddled with basic, avoidable security holes. Here is what the scans find and why AI-written code fails this way.
Software
Europe's Digital Markets Act just landed three big blows on Apple and Google
In two weeks last July, the EU's tech law forced a court defeat on Apple, ordered Google to share search data with rivals and AI chatbots, and hit Google with its first fine under the act. Here is what happened, why the three events differ, and why it could reshape Big Tech.
Software
npm just disabled the feature attackers loved most, after 16 years
For most of its life, the world's biggest code registry ran strangers' scripts on your computer the moment you typed 'npm install'. After a brutal year of supply-chain attacks, npm v12 finally turns that off by default. Here is what changed, what did not, and what it means if you write software.
Software
The best free PDF tools in 2026, no Acrobat subscription needed
Adobe Acrobat Pro is a subscription, and Acrobat Reader, the free one, cannot actually edit a PDF. Here are the free tools that merge, split, compress, sign and genuinely edit PDFs, including one that never uploads your files to anyone.
Software
The best free video editors in 2026 (you do not need Premiere)
Adobe Premiere is a subscription at about $23 a month, and Final Cut costs $300. Meanwhile the best free video editor in the world is used to finish Hollywood films and costs nothing. Here are the free editors worth your time, from pro-grade to social-ready to the one already built into your PC.
Software
The best free photo editors in 2026, no Photoshop needed
Photoshop is now a subscription you rent forever, from about $20 a month bundled with Lightroom to $23 for the app on its own. You do not need it. Here are the free photo editors that do the same jobs, from a full desktop suite to an editor that lives in a browser tab.
Software
The best free alternatives to Microsoft Office in 2026
Microsoft Office is now a $100-a-year subscription, and for most people that is money thrown away. Here are the free office suites that open your Word and Excel files, do the same job, and cost nothing, including Microsoft's own.