The Patch

A 5,000-year-old arrow has emerged from melting mountain ice in Norway, part of a growing series of archaeological discoveries being exposed as glaciers and ice patches retreat. Finds preserved in ice for millennia are now surfacing at increasing pace, with researchers noting the thaw is revealing older artifacts than previously recorded. Commenters highlight both the scientific value of the discoveries and the climate change driving them.

Cloudflare has fixed a critical security vulnerability that could have exposed customers' container data. The flaw, now patched, raised concerns about isolation between customer workloads in cloud environments. Security professionals are sharing the disclosure and debating how such cross-tenant exposure risks should be handled and reported across the industry.

Security authorities have issued an alert over a remote code execution vulnerability affecting Apple products, warning users that attackers could potentially run malicious code on affected devices. Apple is expected to address the flaw through a software update, and users are advised to install patches promptly and review official advisories for affected models and versions.

The US Cybersecurity and Infrastructure Security Agency says attackers are actively exploiting two critical vulnerabilities in Citrix NetScaler devices worldwide. The flaws affect NetScaler ADC and Gateway products, which are widely used by organisations to manage and secure application traffic. Security teams are being urged to patch immediately, as exploited NetScaler vulnerabilities have historically enabled large-scale breaches of governments and businesses.

Google researchers say the hacking group ShinyHunters has broadened its attacks targeting Oracle's PeopleSoft software. The group, previously known for large-scale data theft campaigns, is reportedly exploiting vulnerabilities to compromise enterprise systems. The finding raises concerns for organizations running PeopleSoft, with security teams urged to patch systems and review exposure to the campaign.

Citrix is warning customers to upgrade NetScaler products immediately, citing widespread exploitation attempts against the devices. NetScaler appliances are widely used by enterprises for application delivery and secure remote access, making them a frequent target for attackers. Administrators are being urged to patch as a priority while security teams assess whether their systems have been targeted.

Apple has released patches for CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics affecting older versions of iOS, iPadOS and macOS. Processing a maliciously crafted file could allow arbitrary code execution. Apple says the flaw may already have been exploited in targeted attacks, prompting users of older devices to update promptly.

Google researchers say the hacking group ShinyHunters has broadened its attacks targeting Oracle's PeopleSoft software. The group, known for large-scale data theft and extortion, is reportedly exploiting vulnerabilities to breach organizations using the enterprise platform. The findings raise concerns for companies running PeopleSoft, as security teams are urged to patch systems and monitor for intrusion attempts linked to the campaign.

Cybersecurity Dive reports that niche AI tools pose a major cybersecurity risk to infrastructure operators. The article suggests that lesser-known, specialized AI applications used by operators of critical systems may introduce vulnerabilities that are not widely tracked or patched, creating exposure for energy, water and other essential services.

Blizzard released a round of hotfixes for World of Warcraft on October 1, 2026. The patch notes cover the usual mix of bug fixes and balance adjustments applied to the live game without requiring a client download. Players are checking the notes to see which classes, dungeons or encounters were touched and whether their specs or favorite content was affected in the current season.

Apple has released an emergency security patch fixing a zero-day vulnerability in CoreGraphics that was actively exploited in real-world attacks. The flaw affects iPhones and other Apple devices, renewing debate about how secure iOS really is. Commenters note that no system is 100 percent safe and urge users to update their devices promptly.

Apple has released iOS 27.0.1, a new software update for iPhone users. The point release follows iOS 27 and is expected to bring bug fixes and security patches rather than major new features. Details on the full changelog remain limited, and iPhone owners are being prompted to install the update through Settings.

Citrix has confirmed two zero-day remote code execution vulnerabilities in its NetScaler application delivery products, tracked as CVE-2026-88771 and CVE-2026-88772, both under active exploitation. The company has released patches, and security researchers are urging administrators to update internet-facing NetScaler and VPN appliances immediately, warning that unpatched systems could allow attackers to run code remotely.

The Clop ransomware gang has moved to new server infrastructure after exploiting a vulnerability in Grav CMS, the open-source flat-file content management system. The extortion group, known for large-scale data-theft campaigns against corporations and government agencies, is continuing operations despite the disruption. Security teams are being urged to patch Grav CMS installations and review whether their systems were targeted.

A question circulating among electric vehicle owners: when a carmaker discontinues an EV model, will it continue to receive software updates and support? The concern is growing as several automakers retire older electric models, leaving owners uncertain whether features, security patches and performance improvements will keep coming to cars they already bought.

ESET reports that 49% of UK small and medium-sized businesses have suffered a security breach, with cybersecurity experts outlining practical measures firms can take to reduce risk. The findings highlight persistent gaps in SMB defences, and commentary is focused on affordable fixes such as staff training, patching and multi-factor authentication that smaller firms can adopt without large budgets.

Several security vulnerabilities have been discovered in the Linux kernel, prompting attention from developers and system administrators. Details on affected versions, severity, and available patches are being circulated, and maintainers are expected to issue fixes. Users running Linux systems are advised to follow distribution security updates and apply patches as they become available.

Check Point has confirmed that attackers began exploiting CVE-2026-85102, a vulnerability in its VPN products, just three days after patches were released. CISA has added the flaw to its exploited-vulnerabilities catalog and given federal agencies a September 25 deadline to apply the fix. Security teams are urged to patch immediately as exploitation continues.

Sweden's red-green bloc is in crisis, and Expressen reports that secret meetings have been held behind the scenes as parties scramble to manage the situation. Sources describe the talks as important, suggesting efforts to patch up internal divisions. The political drama is drawing wide attention in Sweden as the left bloc's cooperation faces strain.

A proposed law in Pennsylvania would require game publishers that shut down an online game's servers to either provide an offline mode, release an independent server patch so players can host the game themselves, or issue a refund of at least 25%. The bill targets the growing problem of digital games becoming unplayable when publishers end support, and is being discussed as a potential model for consumer protection in the games industry.

Apple has rolled out iOS 26.7.1 to iPhones, an update focused on security fixes rather than new features. Users are advised to install it to patch vulnerabilities. The release comes as many iPhone owners continue adjusting to the broader iOS 26 software generation.

The Philadelphia 76ers have signed one of the richest jersey patch sponsorship deals in the NBA. Reports tie the milestone to LeBron James, whose star power and market impact helped drive up the value of jersey advertising across the league. The agreement places Philadelphia among the top franchises for patch revenue in basketball.

Deadlock, Valve's in-development hero shooter and MOBA hybrid, has received a substantial new update, bringing balance changes, adjustments and new content to the game's ongoing public testing phase. Players are discussing the patch details and what the changes mean for the game's evolving meta as Valve continues to shape the title ahead of a wider release.

A cross-tenant data exposure flaw in Cloudflare's Containers and Sandboxes has been disclosed and fixed. The issue stemmed from dm-thin storage pools running with skip_block_zeroing enabled, meaning newly written 4 KiB pages into unmapped 64 KiB blocks could leave residual data on raw devices. A Workers Paid tenant could reportedly read up to 60 KiB of data left behind by a previous tenant from /dev/vdc. Cloudflare has patched the issue, and security communities are discussing the implications of shared-storage isolation failures in multi-tenant cloud platforms.