This week's trouble came from building blocks hardly anyone lists as attack surface: a library that sits in almost every container, an image annotation, and a password change that does less than people assume. Eight of our posts from this week are below. Where we measured on our own fleet it says so, and the others rest on sources which we disclose.

Deep Dive: patch levels the host does not show

curl 8.23.0: 24 advisories, one rated HIGH

The curl project released version 8.23.0 on 14 October, four weeks ahead of schedule. Of the 24 advisories published the same day, one is HIGH: CVE-2026-92392, a use-after-free in the HTTP/2 upload. Exploiting it needs several conditions at once, and the project considers it extremely difficult. The real finding is elsewhere. We read 19 hosts and 23 containers. Three hosts lack one package revision, Alpine 3.23 has no update at all yet, and 12 of 18 readable containers carry a curl at revision deb13u5, which a host update never touches. The measurement with evidence is in curl 8.23.0: one HIGH flaw, 24 advisories, and the package revision our fleet still lacks.

Podman: an annotation instead of a sandbox

CVE-2026-94603 lets podman run treat an image with a particular annotation as a checkpoint and take over the image's security settings. An operator's --cap-drop=ALL then no longer applies. The maintainer scores it CVSS 10.0, Red Hat 8.6, and the distribution packages for Debian 13 and RHEL are still open. Docker is not affected according to the sources. 20 of the 21 hosts we reached run Docker, and we have Podman nowhere. The sequence, the vector comparison and the check command for images are in Podman CVE-2026-94603: an image annotation switches the sandbox off.

Assessment: In both cases the host does not tell you what runs inside the container. Anyone who only runs apt upgrade has not reached the images, and anyone who starts images from foreign registries trusts them more than the documentation suggests. The next step is a list of which containers ship a curl of their own and where their images come from. It takes an afternoon to build.

Deep Dive: deadlines and access

64-day lifetimes at Let's Encrypt

Let's Encrypt switches to 64-day lifetimes on 10 February 2027, and the staging environment has been switched since 14 October. The schedule comes from the CA/Browser Forum and ends at 47 days from March 2029. We laid nine common ACME clients against their documentation: Caddy, Certbot from 4.1, lego and nginx-acme renew with ARI, while HAProxy, Traefik and Proxmox VE work with fixed distances and get tighter with shorter lifetimes. Our two edges renew through ACME without any cron job, and the internal side remains open. The table and checklist are in 64-day certificates from February 2027.

Mailbox taken over, password changed, attacker keeps reading

On 11 October Mike Kuketz described a case where a forwarding rule and a filter rule survived the password reset. Microsoft prescribes six steps for the real thing, Google separates password and sessions, and Stalwart revokes tokens but not Sieve scripts. For our Stalwart at version 0.16.25 the documented token revocation is untested. The checklist is in Hacked mailbox: why the new password does not lock the attacker out.

Assessment: Both topics are inventory questions. A certificate pipeline nobody has listed shows its gaps in February, and a mailbox whose rules and forwarding nobody checks has no clean state after an incident. Two scripts that read both on a schedule cost less than one incident.

Deep Dive: browsers under your own management

Firefox Enterprise: ten policies only with the console

Mozilla announced Firefox Enterprise on 12 October, with a console on the customer's infrastructure. Comparing the new policy reference with the open templates in version 8.4 leaves ten policies that exist only in the Enterprise channel, among them DataLossPrevention and DisableLocalPolicies. The rest, WebsiteFilter, ContentAnalysis and AIControls, is already in the free Firefox. Mozilla names neither a price nor the console's server requirements. The count, the table and our own browser statistics are in Firefox Enterprise: what the console takes over.

Assessment: Anyone who wants to stop employees pasting into AI services needs no console for it today. The ADMX file from the open templates and a decision on what to block are enough. Buying makes sense once the console's price and operating effort are known.

Deep Dive: attacks through devices and platforms

Ivanti: three flaws to root

Volexity describes a chain on a fully patched Ivanti Connect Secure, first trace from 3 October. Two links, the login bypass in welcome.cgi and the file write in wu.cgi, fall under CVE-2026-104935 and have been fixed since 13 October, while the third link, the privilege escalation, had no fix at the time of the report. The Integrity Checker does not detect the activity. Versions, traces and measures are in Ivanti Connect Secure: three flaws add up to root on a patched VPN appliance.

Cold chains: what is documented

In France, refrigeration controls from Danfoss were altered remotely. The entry point is unconfirmed. Documented are three flaws in the management system AK-SM 800A since August, 2,765 reachable interfaces and a firmware R4.3.1. The Hacker News thread on the case has over 1,000 comments, and most technical statements in it are guesses. What is documented and what an operator can check is in Cold chains under attack.

npm and GitLab: trust in names and expressions

npm tied publish rights to the name of a GitHub repository, and over 1,500 packages were exposed according to Bloom. In GitLab a regular expression in the CI configuration leads to code execution, CVSS 10.0, with a public proof of concept from Rapid7. The comparison of both cases and the checks are in Supply chain in practice.

Assessment: All three cases show that the message "patched" leaves a question open: what the attacker left behind earlier and which bindings stayed in place. For Ivanti it is the appliance itself, for npm the binding to a name, for GitLab the path an account may create.

Digest: other important news

Security

Ivanti Connect Secure: three flaws add up to root on patched appliances Volexity dates the first trace to 3 October, on a then-current version 22.8R2.4. The first two links fall under CVE-2026-104935 (in the CISA catalogue since 13 October, fixed in 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5). For the privilege escalation to root, Ivanti is still working on a fix. | verified
CISA: update Ivanti immediately, rebuild if compromise is suspected Affected are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The Integrity Checker may miss the exploitation because commands run in memory. If in doubt, the appliance has to be reset and all credentials renewed. 22.8 reaches end of life on 31 January 2027. | verified
October Patch Tuesday: 1,413 CVEs, three zero-days CVE-2026-96951, a bypass in the Windows Shell (CVSS 8.8), is exploited. CVE-2026-108398 in .NET Framework and CVE-2026-92707 in MessagePack-CSharp are publicly known but not exploited. 75 entries are critical. | verified
GitLab: CVSS 10.0 through a regular expression in the CI configuration CVE-2026-97229, fixed in 19.2.8, 19.3.5 and 19.4.2 of 12 October. Rapid7 reproduced code execution on 19.4.1 and published a proof of concept on GitHub, and exploitation in the wild is not confirmed. On instances with public projects an ordinary account is enough. | verified
npm Trusted Publishing: bound to the repository name, not the ID After a GitHub repository was renamed or deleted, an attacker could claim the old name and obtain a publish token for foreign packages. More than 1,500 packages were exposed according to Bloom Security, and GitHub announced a correction on 2 October. Maintainers check with npm trust list. | reported
Cold chains in France, disruption at Ahold Delhaize In France, Danfoss refrigeration controls were altered remotely and several retail chains were affected. The entry point is not confirmed. The incident at Ahold Delhaize in the Netherlands and Belgium has no recognisable link, according to the source. | reported

Software releases

ONLYOFFICE Docs 10.0 By the project's account the version closes about 35 security flaws and over 1,000 bugs. AI was removed from the open-source builds and is installed separately. The self-hosted version was not yet available on 13 October. | reported
Firefox and Thunderbird 158 Both versions appeared on 13 October, and Firefox 158 adds JPEG XL support on Linux. | reported

Self-check: what of this hits us

We keep version control on Gitea, so the GitLab flaw does not affect us. Anyone running GitLab themselves needs one of the three builds of 12 October. For curl and Podman the results are above and in the posts: three host updates are open for the next maintenance window and new container images on the updated base image, and we have Podman nowhere. Our two edges renew certificates through an ACME client with ARI support, and the measurement of internal certificates is still outstanding. For Ivanti, the Windows Shell and .NET we made no inventory measurement this week. For customers with Ivanti Connect Secure and for every Windows estate, Patch Tuesday counts as the deadline.

From the blog

Eight new posts this week:

Sources for this edition

Compiled on Friday, 16 October 2026. Anything after that appears in the next edition.

IT News Week 43/2026: curl flaw rated HIGH, Podman sandbox bypassed, Ivanti chain to root, Firefox gets a console