This is the news from Thursday 15 October. Read the latest news
Daily news
Windows zero-day fix, a Ghostscript PDF flaw and ChatGPT traffic
Today in 30 seconds
- Microsoft fixes 1,411 flaws, including an exploited Windows zero-day
- Ghostscript flaw lets a PDF upload reach WordPress servers
- Chrome 155 update fixes 37 flaws, seven of them critical
- Ivanti Connect Secure zero-day CVE-2026-104935 is under attack
- ChatGPT visits now show up as direct traffic after GPT-6
- CrUX adds Core Web Vitals that count single-page app clicks
- Google Tag Manager can now send data without loading gtag.js
- Gemini 4 Argon reaches developers at US$2 per million tokens
- Google AI Studio apps now install from Google Play for free
- Anthropic swaps Git for Scion as Claude lifts merges to 30,000 a day
- Apple TV 4K gets an A19 chip, and HomePod mini 2 ships 30 October
Good morning. Microsoft just shipped its biggest Patch Tuesday ever, and one Windows flaw is already under attack. A sneaky PDF bug also reaches WordPress, and ChatGPT visits are hiding in your “direct” traffic. Coffee first, then updates.
Microsoft fixes 1,411 flaws, including an exploited Windows zero-day
Microsoft’s October 2026 Patch Tuesday fixes 1,411 flaws, a new record. Seventy are rated Critical. One Windows Shell flaw, CVE-2026-96951, is already used in attacks. It gets around Mark of the Web, the warning Windows shows for files from the internet.
Two more flaws were public before the fix. One in .NET Framework (CVE-2026-108398) can get past Windows Defender Application Control. The October update is also the last one for Windows 11 24H2 Home and Pro.
Why it matters Mark of the Web is what warns you before a downloaded file runs. Attackers are getting around it right now. Run Windows Update today and restart. If you are on 24H2 Home or Pro, move to Windows 11 26H2 to keep getting fixes.
Ghostscript flaw lets a PDF upload reach WordPress servers
Wordfence found a critical bug in Ghostscript, the tool that reads PDF files on many servers. CVE-2026-39919 lets a crafted PDF with a JPEG 2000 image overflow memory and maybe run code. Versions 9.21 to 10.07.1 are affected, and 10.08.0 fixes it.
WordPress can call Ghostscript through Imagick when it makes a PDF thumbnail. So a PDF upload can reach the bad code. Wordfence has not seen attacks, and its exploit only worked on a test server built for it.
Why it matters Forms and plugins that accept PDF uploads are the risk. Ask your host if Ghostscript is on 10.08.0 or a patched build. If it isn’t, block PDF uploads or turn off PDF rendering in ImageMagick for now. Docker users should rebuild with a fresh base image.
Chrome 155 update fixes 37 flaws, seven of them critical
Google has updated Chrome to 155.0.8059.79 on Windows, Mac and Linux. It fixes 37 security flaws, and seven are rated Critical. They sit in ANGLE, PDF, SVG, Media, Network and other parts of the browser. Google does not say any are used in attacks.
A researcher at Anthropic reported at least 15 of the bugs with help from Claude. Firefox 158 also landed with 77 security fixes.
Why it matters Critical browser bugs can let a bad web page run code. Open Chrome’s menu, go to Help, then About Google Chrome, and restart. Edge and other Chromium browsers should follow soon.
Ivanti Connect Secure zero-day CVE-2026-104935 is under attack
Ivanti has fixed CVE-2026-104935, a login bypass in its Connect Secure VPN. Attackers have used it since at least 1 October. They chain it with other bugs to get full root access. CISA has told US agencies to fix it by Friday.
The fixed versions are 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Ivanti’s Integrity Checker may miss an attack, because the attacker’s commands run in memory.
Why it matters A hacked VPN gives attackers a door into the whole office network. If you run Connect Secure, patch today and check for signs of compromise. If you find any, reset the device and change every password and key it held.
ChatGPT visits now show up as direct traffic after GPT-6
Since GPT-6 arrived around 9 October, links from ChatGPT seem to lose their utm_source=chatgpt.com tag. They also send no referrer. So your analytics now counts many ChatGPT visits as direct traffic.
Cedric Huesler at Adobe checked about 500 pages. ChatGPT visits fell by about 31,000 a day, while direct visits rose by about 26,000 a day on the same pages. OpenAI has not commented.
Why it matters Your ChatGPT numbers may look like a crash when they are not. Compare direct traffic on pages that used to get ChatGPT visits. A jump there since 9 October is probably ChatGPT in disguise. My guide on how AI search finds your site covers the bot side of this.
CrUX adds Core Web Vitals that count single-page app clicks
Google’s Chrome UX Report (CrUX) now has experimental versions of LCP, INP and CLS that include soft navigations. A soft navigation is when a single-page app changes the page and URL with JavaScript, without loading a new document. The data is in BigQuery, the CrUX API and CrUX Vis from the October release.
Most sites will see little change. Google says single-page apps should see better LCP and CLS. The goal is to make these the main metrics around May 2027, and Search Console will switch then.
Why it matters If your site is built with React, Vue or Next.js, your real scores may be better than you think. Check the new numbers now, so May 2027 brings no surprises. New to these metrics? Read my Core Web Vitals guide.
Google Tag Manager can now send data without loading gtag.js
Google Tag Manager containers can now send data straight to supported Google products, like Google Analytics and Google Ads. Before, Tag Manager loaded the extra gtag.js script to do this. Google says the change means less JavaScript and more reliable data.
It is not automatic. You need to optimise each container to use the new destination tags, and only supported Google destinations work.
Why it matters One less script on every page is good for speed. Open your container this week and look for the optimisation prompt. Test your conversions in Preview mode before you publish.
Gemini 4 Argon reaches developers at US$2 per million tokens
Google’s Gemini 4 Argon is now open to all developers on the paid Gemini API and in AI Studio. The launch price is US$2 per million input tokens and US$10 per million output tokens until 30 November. From 1 December, it doubles to US$4 and US$20.
GitHub also added Argon to Copilot Pro+, Max, Business and Enterprise. It works in VS Code, JetBrains IDEs, Xcode and the Copilot CLI, and is rolling out slowly. Google AI Pro and Ultra users can use it in the Gemini app.
Why it matters The half-price window is a cheap time to test it on your own jobs. Note the December date in your calendar. Cached input is 95% cheaper, so reuse long prompts where you can.
Google AI Studio apps now install from Google Play for free
You can now build an Android app by chatting with Gemini in Google AI Studio, then install it from Google Play. You only need a normal Google account, and you must be 18 or older. It starts today in the US and some other markets.
These apps stay private and show in a new personal library in the Play Store. Sharing with friends and family comes in the next few months. Google will offer a path to a full public release later, with the normal review.
Why it matters A small business can now make a simple staff tool or price calculator in an afternoon. I’d still keep customer data out of a vibe-coded app. For customer apps, my app or PWA guide helps you choose.
Anthropic swaps Git for Scion as Claude lifts merges to 30,000 a day
Anthropic has built its own version control system, called Scion, for its main code repository. Daily merges grew from about 2,500 in May to over 30,000 in September. Anthropic says Claude now writes, reviews and lands much of that code.
Seven engineers built Scion and moved the repository in five months. Checkouts now take seconds instead of minutes. Scion is not open source, and Anthropic says it is no Git replacement for most teams.
Why it matters It shows where AI coding is heading. The tools around the code break before the coding does. For your projects, Git is still fine. Watch your CI and review queue as your team uses more AI.
Apple TV 4K gets an A19 chip, and HomePod mini 2 ships 30 October
Apple’s new Apple TV 4K has an A19 chip, far-field microphones for hands-free Siri, more storage and Wi-Fi 7. It costs US$299 for 128GB and ships on 13 November. A new Siri Remote with Find My costs US$59.
The HomePod mini 2 has a faster chip, new colours and a glowing top. It costs US$149 and ships on 30 October. Siri AI comes to it later, not at launch.
Why it matters Apple is building a full smart home around Siri AI, with HomeView at the centre. Older Apple TV 4K models also get Siri AI, so you may not need to upgrade.
Quick hits
- Docker Hub fixed CVE-2026-105445, which let old tokens push images as another user. Review your tokens. The Hacker News
- curl 8.23.0 fixes CVE-2026-92392, an HTTP/2 upload bug in versions 8.12.0 to 8.22.0. The Hacker News
- npm trusted publishing links now expire after 48 hours until first use, after the SlugFest flaw. The Hacker News
- Meta says attackers used one employee’s stolen login to copy code from its GitHub repositories. SecurityWeek
- Next.js plans its out-of-band fix for two Critical flaws on 14 October, US time. Upgrade when it lands. Next.js
- GitHub secret scanning now blocks pushes with Anthropic API keys by default. GitHub
- Yoast SEO 28.7 lets AI tools edit SEO titles and descriptions, and removes old deprecated code. Yoast
- Cloudflare Web Analytics now splits LCP and INP into their phases, so slow parts are easy to spot. Cloudflare
- Google is testing the AI Mode sidebar with chat history on normal search results. Search Engine Roundtable
- Mozilla launched Firefox Enterprise, with a management console you host yourself. SecurityWeek
You're all caught up
That's today's web, tech and SEO news. The next edition lands tomorrow morning, around 3 am Melbourne time.That was the news from Thursday 15 October. A newer edition is waiting for you.
Read the latest news → ← Wednesday's news Every edition
Get the news by email
One short email every morning. Free, and you can unsubscribe any time.
That’s you caught up. If the Ghostscript news has you wondering what your server runs, my site updates service checks this kind of thing for you. And if your ChatGPT numbers just fell off a cliff, my SEO service can help you read them. See you tomorrow.
Opens in a new tab
Comments
No comments yet. Questions, fixes and better ways are all welcome.