This is the news from Friday 16 October. Read the latest news
Daily news
Next.js critical fixes, a Cisco email flaw and Google’s AI links
Today in 30 seconds
- Next.js 16.4.1 and 15.5.28 fix two critical code execution flaws
- Cisco Secure Email Gateway flaw CVE-2026-76519 is under attack
- Drupal 11.4.10 fixes critical Field UI flaw CVE-2026-108097
- NGINX 1.30.6 and 1.31.7 fix five flaws
- Nextcloud servers backdoored through the Collabora CODE app
- GitHub Actions lockfiles arrive as GhostAction hits 1,900 accounts
- Google adds more links to AI Mode and AI Overviews
- Cloudflare helps ChatGPT find hundreds of millions of new pages
- OpenAI will remove GPT-4o and GPT-4.1 from its API in January
- Google launches Universal Cart in Search and Gemini in the US
- Gutenberg 24.2 adds floating notes and smarter link search
- Amazon’s new Bee wearables listen and summarise your day
Good morning. Today is a patch day for people who run their own servers. Next.js, Drupal and NGINX all shipped fixes, and a Cisco email flaw is already under attack. Google also adds more links to its AI answers, and OpenAI is retiring GPT-4o from the API.
Next.js 16.4.1 and 15.5.28 fix two critical code execution flaws
Next.js released versions 16.4.1 and 15.5.28 on 14 October to fix two critical flaws and one high flaw. One lets an attacker run code through use cache functions in the App Router. The other runs code through SVG images in the image optimiser on Linux. The third can freeze apps that use Server Actions.
The use cache flaw has no workaround. The Next.js team says to upgrade even if your app has no such function. On version 15, check that sharp is 0.35.5 or later with npm ls sharp. Two of the advisories have no CVE yet, so npm audit may not warn you.
Why it matters No attacks are reported yet, but run npm install [email protected] or [email protected], then rebuild and redeploy today. A fixed package does nothing until the new build is live.
Cisco Secure Email Gateway flaw CVE-2026-76519 is under attack
Cisco says attackers are using CVE-2026-76519, a CVSS 9.8 flaw in Secure Email Gateway. One crafted email attachment can write files to the appliance and run commands as root. It hits gateways with File Reputation turned on and Content Scanner Tools older than 25.3.0.5525.
The fix is Content Scanner Tools 25.3.0.5525 or later, plus AsyncOS 16.5.0-780 or 15.5.5-014. There is no workaround. Cisco also says to search the system logs and firewall logs for signs of a break-in.
Why it matters Nobody has to log in. An email is enough. If your company runs this gateway, update the scanner today and pass this to whoever looks after your mail.
Drupal 11.4.10 fixes critical Field UI flaw CVE-2026-108097
Drupal fixed a critical flaw in its Field UI module on 14 October. It can lead to remote code execution through some contributed modules, and at least one path needs no login. Drupal rates it 19 out of 25.
The fixed versions are 11.4.10, 11.3.19 and 10.6.19. Older branches get no fix. If you can’t update yet, uninstall the field_ui module for now. No attacks are reported, but Drupal warns that exploits could appear within hours or days.
Why it matters update every Drupal site this week. If a client site sits on Drupal 10.5 or older, this is the push to move it.
NGINX 1.30.6 and 1.31.7 fix five flaws
NGINX released 1.30.6 and 1.31.7 on 14 October with fixes for five flaws. Three are memory bugs that can crash workers and may allow code execution. Each one only bites with certain settings, like alias with a rewrite, regex map captures, or aio with SSI pages.
A fourth lets HTTP/3 uploads get past client_max_body_size. A fifth may skip client certificate checks with a shared TLS session cache. NGINX rates them all medium, and no attacks are reported.
Why it matters NGINX sits in front of a huge share of websites. Upgrade, or check that your distro has backported the patches. Run nginx -T to see if your config uses any of these settings.
Nextcloud servers backdoored through the Collabora CODE app
Attackers have planted web shells on Nextcloud servers through CVE-2026-110447 since 10 September. The flaw is in the built-in Collabora Online CODE app, richdocumentscode. It lets anyone run commands while the app’s document server is not running.
The fix is version 26.4.303 or later, which needs Nextcloud 30. Disabling the app does not help, so update it or remove it. Then look for shx*.php files in apps/richdocumentscode/.
Why it matters Many small businesses run Nextcloud as their own Dropbox. If you host one, check it today, because the attacks started a month ago.
GitHub Actions lockfiles arrive as GhostAction hits 1,900 accounts
GitHub launched workflow lockfiles for Actions in public preview on 14 October. A lockfile pins every action and reusable workflow to an exact commit, so a changed tag can’t sneak in new code. You create it with the gh actions-lock CLI extension.
The timing is good. GitGuardian says the GhostAction campaign took over about 1,900 GitHub accounts and pushed fake “security-audit” workflows to over 30,000 repositories. It tried to steal cloud keys, npm tokens and AI API keys.
Why it matters rotate your tokens and look for workflow files you didn’t write. Then lock your workflows. I would start with the ones that deploy.
Google adds more links to AI Mode and AI Overviews
Google said on 15 October that AI Mode and AI Overviews now show more inline links, and show them higher. It is also testing a box at the top that points to the one or two official pages for a task. News carousels are reaching more countries and languages.
Links at the end of some answers now get image thumbnails. Google says use of its Preferred Sources feature has grown more than 7 times this year. It still shares no click data for AI answers.
Why it matters That “official page” box is worth chasing. Do you run a booking system or a product with a help centre? Make your task pages clear and easy to find. My guide on how AI search finds your site covers the basics.
Cloudflare helps ChatGPT find hundreds of millions of new pages
Cloudflare and OpenAI shared results from a pilot that started in July. Signals from about 1% of Cloudflare’s network helped ChatGPT’s search crawler find pages it didn’t know about. OpenAI says it found and indexed hundreds of millions of new pages this way.
The signals also tell crawlers which pages changed and which ones are dead ends, like fake pages or endless redirects. Cloudflare says this means less wasted crawling on your site. It uses page details, not page content, and not for model training.
Why it matters Pages with few links pointing to them may now show up in ChatGPT answers. If your site is on Cloudflare, check AI Crawl Control to see who is crawling you.
OpenAI will remove GPT-4o and GPT-4.1 from its API in January
OpenAI told developers on 14 October that it will remove GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini from the API on 14 January 2027. The suggested replacement for all four is gpt-6-luna. Fine-tuned models built on them shut down on the same day.
Why it matters Lots of chatbots, form helpers and WordPress plugins still call GPT-4o. Search your code and plugin settings for these model names now, and test the new model before the holidays eat your time.
Google launches Universal Cart in Search and Gemini in the US
Google launched Universal Cart in the US on 15 October. It is one cart for products from many stores, across Search, AI Mode and the Gemini app. It watches for price drops and restocks, shows promo codes, and lets you pay with Google Pay at some stores.
Checkout runs on the Universal Commerce Protocol. Google names Nike, Target, Walmart and Wayfair, plus “many Shopify merchants”. The store stays the seller and handles support.
Why it matters More shoppers will buy without visiting your site. For now it is US only. But if you sell on Shopify, keep your product feed clean and your prices current, because Google is now tracking them for shoppers.
Gutenberg 24.2 adds floating notes and smarter link search
Gutenberg 24.2 came out on 14 October. Notes now float in the margin next to your content. Link search in the Navigation block covers pages, posts, categories and tags in one place. Galleries can now be shown in random order.
Minimum width and height controls now work on 40 blocks, up from five. You can restore the original image after a crop. For developers, React 19 is now on by default, except on sites with plugins known to break with it.
Why it matters These features are heading for WordPress 7.2, and Beta 1 is due on 20 October. Test your custom blocks with React 19 now, before your clients do.
Amazon’s new Bee wearables listen and summarise your day
Amazon launched two new Bee AI wearables on 15 October. Frontier is a US$75 wristband. Eclipse is a US$100 card that snaps onto the back of your phone. Both record conversations and turn them into summaries and to-do lists, with a plan of about US$12 a month.
Bee connects to Gmail, Google Calendar, Outlook and Alexa+. It can also suggest things to buy on Amazon based on what you talked about. Amazon says it deletes the audio and encrypts the transcripts.
Why it matters Handy for meeting notes. But the people around you never agreed to be recorded, so ask first. Mozilla says the risk is being moved onto the buyer.
Quick hits
- Palo Alto Networks fixed PAN-OS flaw CVE-2026-0322, already used in limited attacks. Lock down the management interface. The Hacker News
- AhsayCBS backup servers need new fixes, v10.3.4.45 or v9.15.2.70, because earlier patches missed exploited flaws. Help Net Security
- Langflow users should run 1.9.0 or later, as attacks on a CVSS 9.9 flaw jumped from 11 October. The Hacker News
- Help TDS scammers use hacked WordPress sites and over 20,000 Cloudflare Pages domains for fake support pages. The Hacker News
- Cloudflare Void is a new open-source toolkit that deploys full-stack Vite apps to Cloudflare. Cloudflare
- Figma Specs lets teams write design rules that AI agents follow, and code layers reach public beta. TechCrunch
- Google Merchant Center now requires a
store_addressfor local inventory ads and local free listings. Search Engine Land - YouTube Music now labels songs as “Fully Gen AI”, “Partly Gen AI” or “No Gen AI”. TechCrunch
- Chrome 156 started an early stable rollout to some Windows and Mac users on 14 October. Chrome Releases
- No new critical WordPress core or browser flaws came out in the last 36 hours. Enjoy it.
You're all caught up
That's today's web, tech and SEO news. The next edition lands tomorrow morning, around 3 am Melbourne time.That was the news from Friday 16 October. A newer edition is waiting for you.
Read the latest news → ← Thursday's news Every edition
Get the news by email
One short email every morning. Free, and you can unsubscribe any time.
That’s you caught up. If today’s list of patches feels like a second job, my site updates service handles it for you. And if you want your pages in that new “official page” box, my SEO service can help. See you tomorrow.
Opens in a new tab
Comments
No comments yet. Questions, fixes and better ways are all welcome.