This is the news from Tuesday 13 October. Read the latest news
Daily news
GitLab’s CVSS 10 fix, SonicWall attacks and 64-day certificates
Today in 30 seconds
- GitLab fixes CVSS 10 flaw CVE-2026-97229 in self-managed servers
- SonicWall SMA1000 flaw CVE-2026-102255 is now under attack
- Let’s Encrypt certificates will last 64 days from February 2027
- Google is feeding rank trackers wrong results, Nozzle says
- Google Discover may become an AI “concierge”, a job ad suggests
- Microsoft Maia 300 will run its AI services from 2027
- Microsoft’s Copilot app can now create Office documents
- Windows 11 23H2 Enterprise gets its last update in November
- TinyJS builds desktop apps with JavaScript in about 6MB
- Google’s Fitbit Edge tracker has a bigger screen and GPS
- Raspberry Pi Desktop for PCs moves to Debian 13
Good morning. Today is a patch day for people who host their own tools. GitLab has a perfect 10 flaw, and SonicWall boxes are under attack. Google is also making life hard for rank trackers, and there’s a tiny tracker with a big screen. Coffee first, then updates.
GitLab fixes CVSS 10 flaw CVE-2026-97229 in self-managed servers
GitLab has fixed a CVSS 10 flaw in its CI/CD regular expression compiler. An attacker with no login could run code on your GitLab server with a crafted regular expression. It affects GitLab Community and Enterprise Edition from 19.1 up to the fixed versions.
The fixed versions are 19.2.8, 19.3.4 and 19.4.2. GitLab.com already runs the fix, and GitLab Dedicated customers don’t need to do anything. GitLab has not said the flaw is being used in attacks.
Why it matters A GitLab server holds your code, your secrets and your deploy keys. If you host your own, upgrade today. Researchers often turn a fix like this into working attacks within days.
I would do this before lunch. If you don’t know who patches your company’s GitLab, that is the first problem to fix.
SonicWall SMA1000 flaw CVE-2026-102255 is now under attack
Attackers are going after a CVSS 10 flaw in SonicWall SMA 1000 remote access appliances. SonicWall fixed it on 6 October. The first attacks came two days later, and Previdian has now counted 135 attempts.
The flaw lets an attacker with no login make the appliance send requests for them. That can open up internal functions. The fixed versions are 12.4.3-03670 and 12.5.0-03082.
Why it matters Remote access boxes are a favourite way into a business network. If your office uses an SMA 1000, install the hotfix now and check the device for signs of a break-in.
Let’s Encrypt certificates will last 64 days from February 2027
Let’s Encrypt will cut its default certificate life from 90 days to 64 days on 10 February 2027. You can test the change in its staging system from 14 October. A 45-day default is planned for 2028.
Current certificates will not be revoked. Rate limits, ACME addresses and certificate chains stay the same. You can also ask for 45-day or 6-day certificates if you want them.
Why it matters If your server renews at a fixed number of days, it may renew too late. Check your renewal setup. Clients with ACME Renewal Info (ARI) support will handle it for you. Otherwise, renew at about two-thirds of the certificate’s life.
I’d search your cron jobs and scripts for numbers like 60, 80 or 83. Then add an alert for failed renewals. An expired certificate is the most avoidable outage there is.
Google is feeding rank trackers wrong results, Nozzle says
Many SEO rank tracking tools are showing unreliable Google positions. Nozzle says Google has been “poisoning” the results it serves to rank trackers since September 2026. About 8% of the results pages it checked had swapped results.
Sistrix, DataForSEO, SE Ranking, Advanced Web Ranking and Morningscore have all posted notices. Google is also blocking big proxy networks and showing more captchas. Google has not commented.
Why it matters A sudden drop in your rank tracker may not be real. Check Search Console before you panic, because it is Google’s own data. It still has gaps for AI Overviews and AI Mode.
If you want to know which numbers to watch, my post on why SEO matters keeps it simple.
Google Discover may become an AI “concierge”, a job ad suggests
A Google job ad for a Discover design lead describes a “proactive, hyper-personalized concierge experience”. It also mentions AI formats and closer links with YouTube, Shopping, Chrome and Android. Google has not announced any change.
Discover is also testing new content. It now shows Bluesky post cards, next to the X, Threads and TikTok cards it already shows.
Why it matters Discover sends a lot of traffic to news sites and blogs. A feed that helps people do tasks may send fewer clicks. Watch your Discover numbers in Search Console and don’t rely on one traffic source.
Microsoft Maia 300 will run its AI services from 2027
Microsoft has announced Maia 300, its third AI chip. It is built to run AI models, not train them. From 2027, Microsoft plans to make Maia its main system for running AI in its products, possibly with more than a million chips.
Microsoft says it makes 40% more tokens per megawatt than the top GPU systems, but it did not name them. A full rack holds 96 chips. Maia 200 already serves Microsoft Copilot and some OpenAI models.
Why it matters Cheaper AI for Microsoft can mean cheaper or faster Copilot, GitHub Copilot and Azure AI for you. It also means less reliance on Nvidia.
Microsoft’s Copilot app can now create Office documents
The Copilot app can now make an Office document, such as a Word file, from a prompt. You can edit it in the Office app while the chat carries on. Other people can change a shared document with their own prompts.
It is rolling out to Frontier customers in Chat and Cowork first. It stores files in OneDrive, not SharePoint. Microsoft is also retiring Themes by Copilot in Outlook. If you use one now, you keep it until you change themes.
Why it matters First drafts of quotes, briefs and reports get faster. Check where the files land before your team relies on it.
Windows 11 23H2 Enterprise gets its last update in November
Microsoft says the November 2026 security update is the last one for Windows 11 23H2 Enterprise, Education and IoT Enterprise. After that, these PCs get no more monthly security fixes. Home and Pro editions of 23H2 already lost support in November 2025.
Microsoft wants you on Windows 11 26H2. Go to Settings, then Windows Update, then “Check for updates”, and install version 26H2 if it is offered.
Why it matters An unpatched work PC is an easy target. Plan the upgrade this month, not the week after support ends.
TinyJS builds desktop apps with JavaScript in about 6MB
TinyJS is a new open-source JavaScript runtime for tiny desktop apps. It uses the web view built into each operating system instead of shipping a whole browser like Electron. It runs on macOS, Windows and Linux.
The starter package is about 5.6MB. Sample apps range from 3.7MB for a clipboard history tool to 7.4MB for a Winamp clone. One clock app used just 15.5MB of memory.
Why it matters If you know HTML, CSS and JavaScript, you can ship a small internal tool without a 200MB download. Test each platform, though. Web views don’t all behave the same.
I like this for small office tools. Most of them don’t need a whole browser inside.
Google’s Fitbit Edge tracker has a bigger screen and GPS
Google has launched the Fitbit Edge, a slim tracker that replaces the Fitbit Charge 6. It costs US$179.99 and ships on 27 October in the US. The screen is 46% bigger than the Charge 6, and the battery can be replaced.
It has GPS, ECG, SpO2 and skin temperature sensors, and it is water resistant to 50 metres. The battery lasts about a week with the always-on display off. It has no NFC, so there is no Google Wallet.
Why it matters It is a cheaper choice than a smartwatch with most of the health features. Google has not shared Australian pricing yet, so I’ll wait for that before I get excited.
Raspberry Pi Desktop for PCs moves to Debian 13
Raspberry Pi has released a new Raspberry Pi Desktop for PCs and Intel Macs, based on Debian 13 “Trixie”. It is the first PC version since 2022. It now uses the same Wayland desktop as the Pi itself.
It is 64-bit only and includes Raspberry Pi Connect for remote access. Apple Silicon Macs are not supported. Old 32-bit installs need a fresh install.
Why it matters An old laptop can become a light, free machine for kids, a kiosk or a test box.
Quick hits
- No new critical WordPress core or browser flaws came out, but attacks on the Bricksforge plugin continue. Update to 3.1.8.10. SecurityWeek
- Canonical says a DDoS attack took ubuntu.com and its security notices offline for about four hours. SecurityWeek
- Google Merchant Center will no longer hide products just because their images are poor quality. Search Engine Roundtable
- Google AI Overviews now show up even for typos and searches with no good results. Search Engine Roundtable
- Bing and Copilot are testing Microsoft-Decision-1, the fast yes or no model, on some searches. Search Engine Roundtable
- OSV-Scanner 2.7.0 from Google adds package URLs to JSON output and scans Dart projects by default. GitHub
- LineageOS 24 is out on Android 17, with a new photo editor and faster updates. 9to5Google
- Apple holds its “Welcome home” event on 13 October US time, and a new Apple TV 4K is expected. 9to5Mac
You're all caught up
That's today's web, tech and SEO news. The next edition lands tomorrow morning, around 3 am Melbourne time.That was the news from Tuesday 13 October. A newer edition is waiting for you.
Read the latest news → ← Monday's news Every edition
Get the news by email
One short email every morning. Free, and you can unsubscribe any time.
That’s you caught up. GitLab, SonicWall and certificate renewals are all jobs that hide until they break. My site updates service keeps patches and renewals on schedule for you. See you tomorrow.
Opens in a new tab
Comments
No comments yet. Questions, fixes and better ways are all welcome.