This is the news from Tuesday 6 October. Read the latest news
Daily news
Citrix NetScaler zero-day, ChatGPT image ads and Google timelines
Today in 30 seconds
- Citrix NetScaler zero-day CVE-2026-88779 is under attack
- Rejetto HFS file server flaw CVE-2026-61500 is now exploited
- Dell System Update flaw CVE-2026-86360 gives attackers root
- OpenAI will show ads in ChatGPT while it makes your images
- Google shares how long crawling and indexing really take
- Google says it now uses AI to find AI spam
- Anthropic asks Claude users if it can train on their voice chats
- Strata runs Qwen’s 125B AI model on a gaming PC
- Windows 11 update KB5124010 crashes some games and apps
- RemoveMacAI turns off Apple Intelligence and frees 12 GB
- Apple TV 4K with an A19 chip reportedly lands on 13 October
Good morning. Citrix has another NetScaler zero-day, so admins have a busy start to the week. ChatGPT is getting ads in a new spot, and Google told us how long indexing takes. I like that one a lot.
Citrix NetScaler zero-day CVE-2026-88779 is under attack
Citrix has patched CVE-2026-88779, a memory overflow in NetScaler ADC and NetScaler Gateway. Attackers are already using it. It only hits appliances set up as a SAML Service Provider or SAML Identity Provider. CISA added it to its exploited list on 4 October.
Citrix says the attacks cause denial of service, and some admins saw repeated reboots. BleepingComputer rates it CVSS 8.7. Researchers also saw crafted usernames that try to download and run a script, so it may go further than a crash. It is the sixth exploited NetScaler flaw on CISA’s list this year.
Why it matters If your login or VPN runs through NetScaler with SAML, it can go offline again and again. Update to 14.1-73.41 or 13.1-64.28 (FIPS builds 14.1-73.41 FIPS or 13.1-37.282). Then run Citrix’s check script to look for signs of a break-in.
Rejetto HFS file server flaw CVE-2026-61500 is now exploited
Attackers are going after CVE-2026-61500 in Rejetto HTTP File Server (HFS), rated CVSS 9.3. Versions 3.0.0 to 3.2.0 are affected. The bug lets an attacker work out the secret key for login cookies. Then they can pretend to be the admin and run code on the server.
The fix, version 3.2.1, came out in July. A public proof of concept followed in late September, and VulnCheck saw attacks on 1 October. Fun fact: researchers at Horizon3.ai found the bug with Anthropic’s Mythos AI model.
Why it matters HFS is a popular way to share files from a Windows PC or small server. Update to HFS 3.2.1 or later now. If you don’t need it on the internet, take it off.
Dell System Update flaw CVE-2026-86360 gives attackers root
Dell has fixed a critical path traversal flaw in Dell System Update (DSU), the command line tool that installs updates on Dell servers. Dell says an attacker with no login and remote access could run code as root. Four more high severity flaws were fixed in the same release.
Dell has not seen any attacks. Why it matters: DSU runs with full rights on the server, so a hole here means the whole machine. Update to DSU 2.3.0.0 or later.
OpenAI will show ads in ChatGPT while it makes your images
OpenAI will test a new visual ad format in ChatGPT later in October, starting in the US. The ads show up while ChatGPT is still creating your image. OpenAI says they will be clearly labelled and kept apart from the image. It also says ads don’t change ChatGPT’s answers.
Advertisers also get new ways to measure sales, with partners like Hightouch, Tealium and LiveRamp. DoubleVerify and Integral Ad Science will help keep ads away from sensitive chats.
Why it matters ChatGPT is turning into a real ad channel next to Google. If you sell products, keep an eye on it. I would wait for real results before you move budget.
Google shares how long crawling and indexing really take
Google’s Gary Illyes shared typical times for each step of Google Search at Search Central Live in Barcelona. A new URL is usually found in about 20 hours. A sitemap is processed in about 24 hours. A title or snippet change shows in one to two days.
The slow cases take much longer. A site move usually takes one to three months. Removing a manual action takes one to two weeks. Recovery from a core update takes three to six months, and sometimes a year. Illyes warned that a delay in one step carries into the next.
Why it matters Now you can tell a client what “normal” looks like. Don’t panic if a new page isn’t indexed in an hour. Do worry if it’s still missing after a few weeks. My post on why SEO matters has fixes you can start now.
Google says it now uses AI to find AI spam
At the same Barcelona event, Google explained why spam updates come more often in 2026. There are more content types in Search, many more pages, and much more spam. Google says it filters about 40 billion spam pages a day. It now uses AI to catch more of it, especially “AI slop” in Discover.
Google also judges quality page by page, not site by site. That’s why some pages on a site can drop while others climb. Its test is simple: if you swapped your brand for a competitor’s, would the page still be just as useful?
Why it matters Mass-produced AI pages are a growing risk. Check your pages for effort, original ideas and accuracy before the next update arrives.
Anthropic asks Claude users if it can train on their voice chats
Anthropic has added a new option to use Claude voice conversations for model training. It is off by default. When you use voice, a prompt asks you to choose “Allow” or “Not now”. You can change it any time in Settings, under Privacy, with “Allow us to use your voice data”.
This setting is separate from the one for text chats and coding sessions. You can turn one on and leave the other off. You can also delete voice data from settings.
Why it matters If your team talks to Claude about client work, decide on this before someone taps “Allow” by accident.
Strata runs Qwen’s 125B AI model on a gaming PC
Strata is a new open source app that runs Qwen3.8-Flash-Next, a 125 billion parameter model, on a normal gaming PC. It was near the top of Hacker News yesterday. It keeps the busy parts of the model on your graphics card and the rest in RAM.
The project says it gets 53 tokens a second on an RTX 5070. You need a card with at least 12 GB of video memory, 32 to 64 GB of RAM and about 80 GB of disk space. It is MIT licensed and runs on Windows and Linux. Expect your PC to freeze for a minute or three while it loads.
Why it matters A year ago, a model this size needed a server. If you want private AI coding help without a monthly bill, this is worth a weekend test.
Windows 11 update KB5124010 crashes some games and apps
Microsoft has confirmed that update KB5124010 for Windows 11 breaks some apps and games. Programs that use Windows’ built-in AC-3 (Dolby Digital) audio decoder can fail to open or close without warning. Apps with their own audio decoder are fine.
On Windows 11 24H2 it installs on its own if you turned on “Get the latest updates as soon as they’re available”. Microsoft hasn’t given a date for a fix.
Why it matters If a media app or game starts crashing this week, this update is the likely cause. Uninstall it, or pause updates until Microsoft fixes it.
RemoveMacAI turns off Apple Intelligence and frees 12 GB
RemoveMacAI is a free, open source tool for macOS 27 on Apple silicon. It turns off Apple Intelligence and deletes its downloaded models, which frees about 12 GB. It uses a configuration profile, so you don’t need to switch off System Integrity Protection. Dictation still works.
You lose Writing Tools, Genmoji, Image Playground and the new Siri features. You can undo it with one command. MacRumors notes it relies on older settings keys that Apple could change.
Why it matters On a Mac with a small drive, 12 GB is a lot. Try it on a spare Mac first, and only if you don’t use the AI features.
Apple TV 4K with an A19 chip reportedly lands on 13 October
Bloomberg’s Mark Gurman says Apple will hold an event on 13 October. It will reportedly show the smart home hub with a screen, a new HomePod mini and a new Apple TV. 9to5Mac reports the Apple TV 4K jumps from the A15 chip to an A19-class chip. It also gets Apple’s new Siri.
Why it matters The current Apple TV chip is from 2021. If you were about to buy one, wait one more week.
Quick hits
- No new critical WordPress flaws came out in the last 36 hours, so it’s a good day to catch up. Patchstack
- Sirv for WordPress, up to 8.2.5, has a SQL injection for logged-in users. Watch for an update. Strix
- Cling botnet hijacks old Realtek-based routers and DVRs. Update or replace devices that get no fixes. The Hacker News
- Google Search Console is getting dark mode soon, Google showed in Barcelona. Search Engine Roundtable
- Gemini on phones has a new Map tool for questions about a place. Notebookcheck
- Windows 10 extended updates for business double to US$122 a device for year two. The Register
- Ubuntu 26.10 beta is out with GNOME 51 and more Rust tools. Final release is 15 October. The Register
- iCloud Mail now lets you create nine aliases instead of three. MacRumors
- MagSafe 3 cable got its first firmware update since 2023, with no release notes. MacRumors
- SQLDoom runs the classic Doom game logic in about 5,900 lines of SQL. Tom’s Hardware
You're all caught up
That's today's web, tech and SEO news. The next edition lands tomorrow morning, around 3 am Melbourne time.That was the news from Tuesday 6 October. A newer edition is waiting for you.
Read the latest news → ← Monday's news Every edition
Get Riksi News by email
One short email each morning with every headline. Free, and you can leave any time.
That’s you caught up. If Google’s timelines made you wonder why your pages are slow to rank, my SEO service can find out. Have a great Tuesday.
Opens in a new tab
Comments
No comments yet. Questions, fixes and better ways are all welcome.