Fall 2026 security roundup: record patch counts and AI-found bugs

TL;DR

• The story of the last three months is volume. Microsoft’s October Patch Tuesday fixed a record 1,411 flaws, and that’s not counting the 348 fixed earlier in the month.
• The worst exploited bugs were the usual suspects: edge devices. Citrix NetScaler had two zero-days exploited for weeks before the September 27 patch.
• Browsers and phones got exploited bugs too: Chrome CVE-2026-87491 (the seventh Chrome zero-day this year) and Apple CVE-2026-86950.
• A Shai-Hulud-style npm worm got valid provenance signatures by releasing through the victim maintainer’s own CI, and parked persistence in .vscode and .claude directories.
• AI is on both sides now. It’s finding bugs faster than maintainers can patch them, and AI coding agents are themselves a target.

Why I keep a list like this

I run a homelab with a public blog, a k3s cluster, a pile of self-hosted apps and a coding agent with a shell. Every category below has a version that applies to me. This roundup is the list I worked through for my own stuff, cleaned up. It’s dated: everything here is as of late October 2026.

Edge devices: NetScaler, again

If you only read one section, read this one. Internet-facing appliances keep being the easiest way in.

Citrix NetScaler ADC and Gateway, patched on Sunday, September 27:

Fixed in 14.1-73.37 and 13.1-64.23 (plus FIPS builds). CISA added both to the Known Exploited Vulnerabilities catalog the same day with a three-day federal deadline. Rumours surfaced two days before the patch, and Kevin Beaumont said attacks had been running all month. Once a public proof of concept landed, Help Net Security reported it turned into mass exploitation.

If you patched a NetScaler after a month of exposure, patching isn’t the end of it. Assume compromise and go looking for web shells.

The October 14 KEV batch kept the theme going: a Palo Alto PAN-OS management interface bug, a Cisco Secure Email Gateway bug, and two Ahsay backup server bugs. The PAN-OS one is a reminder that a management interface should never be reachable from the internet in the first place.

Browsers and phones

• Chrome CVE-2026-87491, an out-of-bounds write in V8, fixed in Chrome 153 on September 8. Google said an exploit exists in the wild. Chrome 153 fixed 230 vulnerabilities in total, and this was the seventh Chrome zero-day of 2026.
• Apple CVE-2026-86950, an out-of-bounds write in CoreGraphics, fixed September 28 in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and Sequoia 15.8.1. Apple said it may have been used in an “extremely sophisticated attack” against specific people. iOS 27 doesn’t appear to be affected.
• Windows: the one exploited bug in October’s Patch Tuesday was CVE-2026-96951, a Mark of the Web bypass in Windows Shell. That’s the protection that warns you before opening a downloaded file. October was also the last update for Windows 11 24H2 Home and Pro.

A browser fix only takes effect once the browser restarts. A machine that downloaded the update and never restarted is still running the vulnerable build. Restart your browser.

Supply chain: a worm that earned its signature

On August 4, an attacker took over the GitHub account of the maintainer of keyv, a key-value library with a large download count, plus sibling packages like cacheable. The VentureBeat writeup is worth reading in full. The key details:

• Malicious releases were cut through the maintainer’s own GitHub Actions workflow, so npm issued legitimate provenance attestations. “The worm did not forge that signature. It earned it.”
• It stole cloud keys, CI secrets and npm tokens, then used the npm tokens to backdoor more packages. Aikido counted at least 868 packages across 1,381 versions. JFrog counted 400-plus packages and 1,700 versions.
• Wiz found persistence payloads in VS Code and .claude directories, so the malware runs again when you open the project in an editor or start a coding agent session.
• npm 12 disables install hooks by default, and JFrog found the payload didn’t run at install time there.

Two takeaways for me. First, provenance tells you which pipeline built a package, not that the pipeline’s owner was still in control. Second, a coding agent’s config directory is now a persistence location. A repo can ship its own settings, hooks and MCP servers, so look at .claude/ and .vscode/ in anything you clone before an agent opens it.

AI tools as the target

This was the summer AI coding agents became an ordinary attack surface:

• Researchers showed hidden instructions in GitHub issues leading to code execution and credential theft in several coding CLIs. Some were patched. Others need workflow changes on your side.
• A Cloud Security Alliance note pointed out that several popular coding tools auto-run MCP servers defined in a project with the developer’s privileges. Cloning a repo and opening it is now enough to execute its config.
• Recorded Future’s September exploited-vulnerability list included AI tooling like Flowise and LiteLLM next to the usual routers and VPNs.

I run LiteLLM. It’s on the list. I wrote about my guardrails for the agent’s shell access earlier this month. Those cover what the agent decides to do. They don’t help when someone else’s text gets into its context.

The AI-finds-bugs part

Here’s what the volume numbers look like:

• Anthropic’s Project Glasswing update in May said about 50 partners had found more than 10,000 high or critical vulnerabilities with a preview model. In an open-source scan of 1,000-plus projects, humans checked 1,752 findings and 90.6 percent were real. Then the uncomfortable part: of about 530 high or critical bugs disclosed, 75 had been patched, and some maintainers asked them to slow down disclosures. Skeptics, including VulnCheck and Bruce Schneier, pushed back on how little of that was verifiable. Both things can be true.
• Epoch AI counted roughly 1,550 high and critical CVEs in June and about 2,500 in July, against a prior monthly record of about 490. Their read: some of the increase is “almost certainly” because discovery got easier.
• On the attacker side, CrowdStrike reports that 88 percent of exploitation of bugs with a public proof of concept happened within 48 hours of the PoC going public.

So the bottleneck has moved. Finding bugs is cheap now. Triage, fixing and deploying are the expensive part, and that’s where it’s piling up. The UK’s NCSC told organisations in May to prepare for a “patch wave”. CISA’s new BOD 26-04 gives federal agencies as little as three days for exposed, actively exploited flaws that can be exploited automatically.

The checklist I’m working from

This is the list for my homelab this round. It’s a to-do list, not a victory lap:

[ ] Browsers restarted everywhere, including kiosk and wall-board machines
[ ] Phones and Macs on 26.7.1 or 27.x
[ ] Windows: October cumulative installed; 24H2 Home/Pro machines moved to a supported release
[ ] npm >= 12 on build images; lockfiles committed; install hooks off
[ ] Lockfiles checked for keyv/cacheable releases from early August; rotate tokens if found
[ ] LiteLLM and other AI tooling on current images, admin UIs not exposed
[ ] .claude/ and .vscode/ inspected in any cloned repo before an agent opens it
[ ] Nothing management-plane reachable from the internet

What I expect next

• More patches, more often. If finding bugs keeps getting cheaper, monthly cadences start to look slow. Expect out-of-band releases to stop being unusual.
• The gap is deploying patches, not writing them. Most of the exploited bugs above had a fix available. The ones that hurt were on boxes nobody updated in time.
• Unmaintained software gets worse fast. Abandoned packages and end-of-life firmware don’t get fixes no matter how many bugs get found. AI finding more bugs mostly makes that problem bigger.
• Agents are a new kind of endpoint. Anything that reads untrusted text and holds credentials needs the same thought as a VPN appliance.

None of this needs new tools. It needs the boring stuff, done faster: update automatically, restart things, keep management interfaces off the internet, and retire what can’t be patched.