Fall 2026 security roundup: record patch counts and AI-found bugs
TL;DR The story of the last three months is volume. Microsoft’s October Patch Tuesday fixed a record 1,411 flaws, and that’s not counting the 348 fixed earlier in the month. The worst exploited bugs were the usual suspects: edge devices. Citrix NetScaler had two zero-days exploited for weeks before the September 27 patch. Browsers and phones got exploited bugs too: Chrome CVE-2026-87491 (the seventh Chrome zero-day this year) and Apple CVE-2026-86950. A Shai-Hulud-style npm worm got valid provenance signatures by releasing through the victim maintainer’s own CI, and parked persistence in .vscode and .claude directories. AI is on both sides now. It’s finding bugs faster than maintainers can patch them, and AI coding agents are themselves a target. Why I keep a list like this I run a homelab with a public blog, a k3s cluster, a pile of self-hosted apps and a coding agent with a shell. Every category below has a version that applies to me. This roundup is the list I worked through for my own stuff, cleaned up. It’s dated: everything here is as of late October 2026. ...