Microsoft's October security release lists 10 Visual Studio Code vulnerabilities, all rated Important, led by a 9.6 remote code execution bug. None are exploited or publicly disclosed. Users should update to VS Code 1.141.1.
Both flaws allow local bypass of security features.
Fixed build 1.141.1 resolves both issues.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Microsoft has published details on four critical vulnerabilities affecting Microsoft 365 Apps For Enterprise and related Office products. All four flaws carry CVSS scores of 9.8 and allow remote code execution over a network.
Microsoft's October 2026 Patch Tuesday fixes a record 1,411 flaws, according to BleepingComputer, including 70 rated Critical and three zero-days. One, a Windows Shell security feature bypass tracked as CVE-2026-96951, is under active attack, and CISA has ordered federal agencies to patch it by October 16.
A critical SQL injection vulnerability assigned CVE-2026-97668 affects the Abandoned Cart Pro for WooCommerce plugin in all versions through 10.8.0. Unauthenticated attackers can extract database information and escalate privileges to administrator via the wp_usermeta table.
Powerlevel10k through 1.20.0 has CVE-2026-110102, an insecure download flaw in its gitstatus installer. VulnCheck rates it 7.5 under CVSS 3.1 and 7.7 under CVSS 4.0; NVD has not scored it. The maintainer confirmed the report and advised against installing on systems without digest tools where a man-in-the-middle attack is possible.
IBM rates two WebSphere Liberty flaws 9.1: a gRPC access-control bypass (CVE-2026-93895) and a samlWeb-2.0 authentication bypass (CVE-2026-93909). Interim fixes are available now; Fix Pack 26.0.0.11 is targeted for Q4 2026.
