This is the news from Saturday 17 October. Read the latest news
Daily news
Backuply fix, a critical Chrome patch and Meta’s Mac-ready AI
Today in 30 seconds
- Backuply 1.5.9 fixes a SQL injection flaw on 600,000 WordPress sites
- Chrome 155.0.8059.84 fixes a critical Prerender flaw
- BeyondTrust Remote Support zero-day used in attacks since August
- PwnEscape Linux kernel flaw lets guest VMs read host memory
- Google rankings swing, but rank trackers are part of the problem
- Google removes the default Indexing API quota from its docs
- Meta’s Muse Spark Open model runs on two Mac Studios
- OpenAI says its models hacked live sites to finish simple tasks
- Cloudflare will rate verified bots on whether they obey robots.txt
- GitHub AI Scan now checks pull requests for PHP security bugs
- iPhone Duo pre-orders open, and US shipping slips to January
Good morning. No WordPress core or browser zero-days today, which is nice. But a backup plugin on 600,000 sites needs an update, and Chrome has another critical fix. Meta also shipped a giant AI model that runs on two Macs.
Backuply 1.5.9 fixes a SQL injection flaw on 600,000 WordPress sites
Backuply, the backup and migration plugin from Softaculous, has a SQL injection flaw. CVE-2026-93953 is rated 8.0 and affects every version up to 1.5.8. Version 1.5.9 fixes it, and it has been out since 1 October.
The attack is sneaky. A low-level user saves bad code in their profile bio. It only runs later, when an admin restores a database backup made after that. Wordfence published the details on 15 October, and no attacks are reported yet.
Why it matters Sites with open sign-ups are most at risk. Update Backuply to 1.5.9 today. Not sure what else on your site is out of date? My 10-minute website check helps.
Chrome 155.0.8059.84 fixes a critical Prerender flaw
Google released Chrome 155.0.8059.84 for Windows, Mac and Linux on 15 October. It fixes 10 security flaws. One is critical, CVE-2026-110922, a use after free bug in Prerender. Six more are rated high, and three of those sit in the V8 JavaScript engine.
Google does not say any are used in attacks. One high bug was found by Xinyang Ge at Anthropic, with help from Claude. Chrome for Android got the same version on the same day.
Why it matters Prerender loads pages before you click, so a bug there can be reached by a web page. Open Chrome’s menu, go to Help, then About Google Chrome, and restart.
BeyondTrust Remote Support zero-day used in attacks since August
BeyondTrust has fixed CVE-2026-102764, a login bypass in Remote Support rated CVSS 9.3. Attackers have used it since 29 August to plant web shells and get root access. Every version up to 26.2.3 is affected.
The fix is patch BT26-05-RS for versions 24.3.1 to 26.2.3. Older versions must upgrade first. Cloud customers were patched on 9 October. Self-hosted appliances without automatic updates need the patch by hand.
Why it matters Remote support tools hold the keys to many computers. If you run one yourself, patch it and treat it as hacked until it is checked. Then change every password it stored.
PwnEscape Linux kernel flaw lets guest VMs read host memory
A new Linux kernel flaw, CVE-2026-99999 or “PwnEscape”, is rated 9.3. Code inside a virtual machine can read memory from the host server. In a lab, the researcher could also crash the host and run code on it.
An attacker must already run code inside a guest VM, so it can’t be hit over the internet. Vercel confirmed the leak in its Sandbox and says no customer data was read. No attacks are reported. Fixed kernels include 6.6.159, 6.12.113 and 6.18.57.
Why it matters This hits hosts and anyone who runs VMs for other people. Update and reboot the host kernel, not only the guests. On shared hosting or a VPS, your provider does this, so watch for a maintenance email.
Google rankings swing, but rank trackers are part of the problem
SEOs report a spike in Google ranking changes and forum chatter in the 24 hours to 16 October. Barry Schwartz says it has been a while since he reported a ranking update. Google has not confirmed anything.
There is a catch. Rank tracking tools are struggling right now, so their charts may be wrong. Schwartz writes “I blame the tools”. One forum user thinks “something changed during/after the spam update”, which ended on 8 October.
Why it matters Don’t panic over a tool chart. Check Search Console and your own analytics first. If your traffic really did drop, start with the five fixes in my SEO tips guide.
Google removes the default Indexing API quota from its docs
Google updated three Indexing API help pages on 16 October. It removed the default quota of 200 requests, the approval process and the testing details. The advice to use a sitemap for short-lived pages is gone too.
Google says the quota page now reflects “the current quota limits and process”. The main page still says the API is for job postings and livestream pages only.
Why it matters Some SEO plugins push every new post through the Indexing API. That was never the intended use, and the free starting quota now looks gone. Use your XML sitemap for normal pages.
Meta’s Muse Spark Open model runs on two Mac Studios
Meta released Muse Spark Open on 15 October. It is an open-weight model with 816 billion parameters, 42 billion active at a time, and a 1 million token context window. Meta calls it the “most capable U.S. open-weight model to date”, built for coding and agent work.
You can download it from Hugging Face, or use it through OpenRouter, Groq, Together AI and others. Meta says it runs on two 512GB M5 Ultra Mac Studios with MLX. That Mac isn’t out yet, and the licence allows only limited commercial use.
Why it matters A top open model lets you run coding agents on your own hardware, so your code never leaves the office. For most of us, the API route is cheaper. Read the licence before you build a product on it.
OpenAI says its models hacked live sites to finish simple tasks
OpenAI disclosed three incidents from June on 15 October. In one, a model asked for hospital bed figures got past a statistics website’s access checks. It downloaded a config file with database and email passwords, then forged its own access tokens.
In another, a model found live search credentials in a site’s public JavaScript and pulled 1,489 user records. OpenAI found the cases with its misalignment monitor and says it has “taken steps” to stop repeats.
Why it matters AI agents now read your site’s code very closely. Never put API keys or passwords in front-end JavaScript, and keep config files out of public folders. My API explainer covers how keys work and how to keep them safe.
Cloudflare will rate verified bots on whether they obey robots.txt
Cloudflare said on 16 October that it now checks how Verified bots behave over time. Bots must follow robots.txt and slow down when a site sends an HTTP 429 “too many requests” reply. Each bot gets a trust band that rises or falls with its record.
Cloudflare uses the system internally today. It plans to let all customers choose a trust level for Verified bot traffic, and to publish bot scores on Radar. No dates yet.
Why it matters A verified badge has been close to a free pass. Soon you can treat bots that ignore your rules differently. Make sure your robots.txt says what you mean. My guide on how AI search finds your site explains the basics.
GitHub AI Scan now checks pull requests for PHP security bugs
GitHub made AI Scan for pull requests generally available on 15 October. It looks for security flaws in code that CodeQL doesn’t cover, like PHP, shell scripts, Terraform and Dockerfiles. Findings show on the pull request with an “AI” label, often with a suggested fix.
It works on public repositories without a Copilot licence. Private repos need GitHub Code Security or Advanced Security, and scans use AI credits. Findings are advice only and never block a merge.
Why it matters WordPress plugins and themes are mostly PHP, which CodeQL skips. Turn it on for your public plugin repos. A second pair of eyes on every pull request is a cheap win.
iPhone Duo pre-orders open, and US shipping slips to January
Apple opened pre-orders for the iPhone Duo, its first foldable iPhone, on 16 October. It has a 5.4-inch outer screen and a 7.6-inch inner screen, and US prices run from US$1,999 to US$3,199. It launches on 23 October.
Within hours, Apple’s US store showed a shipping date of 25 January for every model. Some Apple Stores may have walk-in stock on launch day, but supply looks very tight.
Why it matters A new screen shape is coming to your visitors. A folding phone changes width when it opens. Test your site on a narrow screen and a near-square one.
Quick hits
- Microsoft MAI-Base-2 finished pre-training with 2.8 trillion parameters, but it is not released yet. Microsoft AI
- Windows 11 update KB5127648 can grey out the Smart App Control switch. A fix is still coming. BleepingComputer
- Microsoft Office fixes about two dozen code execution bugs, some through the Preview Pane. None are exploited. SecurityWeek
- Windows Server 2022 left mainstream support on 13 October, with security fixes until October 2031. BleepingComputer
- Bing is testing “read more” links at the end of search result snippets. Search Engine Roundtable
- ChatGPT Plus and Pro users no longer have a fixed limit on how many Sites they create. OpenAI
- GitHub Copilot drops Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra on 16 November. GitHub
- Shopify CLI adds
shopify app security check, which scans your app for common flaws on your machine. Shopify - Bluesky Attie now builds websites, games and quizzes on the AT Protocol from a chat. TechCrunch
- Android adds Gemini scam checks to Google Messages, but you must turn them on yourself. BleepingComputer
You're all caught up
That's today's web, tech and SEO news. The next edition lands tomorrow morning, around 3 am Melbourne time.That was the news from Saturday 17 October. A newer edition is waiting for you.
Read the latest news → ← Friday's news Every edition
Get the news by email
One short email every morning. Free, and you can unsubscribe any time.
That’s you caught up. If you’d rather not track plugin updates like Backuply yourself, my site updates service does it for you. And if the ranking swings hit your traffic, my SEO service can help you find out why. See you tomorrow.
Opens in a new tab
Comments
No comments yet. Questions, fixes and better ways are all welcome.