Ivanti zero-days, record Patch Tuesday and Gemini 4 Argon goes wide

Security
Attackers chained three Ivanti Connect Secure zero-days for unauthenticated root access (opens in a new tab)
Volexity says actor UTA0576 exploited an Ivanti VPN on 22.8R2.4, fully patched at the time, from October 3; Ivanti fixed two flaws as CVE-2026-104935, with the privilege escalation still unpatched. Connect Secure users should upgrade, hunt for compromise and rotate credentials stored on the appliance.
Source: Volexity
Security
Microsoft Patch Tuesday fixes a record 1,411 flaws, one exploited zero-day (opens in a new tab)
The release patches an actively exploited Windows Shell Mark-of-the-Web bypass (CVE-2026-96951), which CISA ordered agencies to fix by October 16, among 70 critical bugs. BleepingComputer ties the record to Microsoft's AI-driven bug hunting, so plan for heavier patch cycles.
Source: BleepingComputer
AI
Google opens Gemini 4 Argon to developers via the Gemini API and AI Studio (opens in a new tab)
Google's frontier model, previously limited to vetted cyber defenders, is now in the paid Gemini API, AI Studio, Antigravity and Gemini Enterprise at an introductory $2/$10 per million tokens until November 30. From December 1 Google's price doubles to $4/$20.
Source: VentureBeat
Security
npm Trusted Publishing flaw exposed 1,500+ packages with 10M+ downloads to takeover (opens in a new tab)
Bloom Security showed npm bound trusted publishers to repository names, so anyone reclaiming an abandoned GitHub repo slug could publish to its packages. Unvalidated configs now expire after 48 hours; maintainers should run npm trust list and confirm every repository still belongs to them.
Source: Help Net Security
Security
Docker discloses critical Docker Hub flaw that let tokens push images as other users (opens in a new tab)
CVE-2026-105445 let an attacker reassign a personal access token they held to another user through account-to-organisation conversion, then push or delete images as them. Docker fixed it server-side on September 30 and found no exploitation; no client update is needed.
Source: BleepingComputer
Security
SAP patches CVSS 10 Cloud SDK for Python flaw that leaks OAuth2 credentials (opens in a new tab)
October Patch Day fixes CVE-2026-89111, a server-side request forgery in SAP's Cloud SDK for Python that can send OAuth2 client secrets to an attacker. BTP teams should move to 0.55.1 or later; The Hacker News found releases 0.53.0–0.55.0 skip the check.
Source: The Hacker News
Languages
Rust soundness bug lets safe code bypass struct lifetime bounds (opens in a new tab)
Issue #164250, filed October 13 and labelled I-unsound and P-high, shows covariant field assignment plus a Drop impl yielding use-after-scope in safe code on current stable. Exploiting it needs a deliberately malicious Drop, so the practical risk sits in untrusted dependencies.
Source: GitHub (rust-lang/rust)
Business
Netflix to cut about 1,000 jobs, mostly in product, tech, legal and HR (opens in a new tab)
The streamer confirmed roughly 6% of staff (it had 16,000 at end-2025) will go, mostly in product and engineering; co-CEOs Ted Sarandos and Greg Peters said it remains on track for its full-year forecast. Profitable firms are trimming tech headcount to fund narrower priorities.
Source: TechCrunch

My take

Today's most important pattern is not a model launch but identity rot in the software supply chain: npm trusted publishing and Docker Hub both broke on the assumption that a repo name or a token keeps pointing at the same owner. At the same time, AI-assisted bug hunting is pushing patch volume past what monthly rituals can absorb, as Microsoft's record release and the Ivanti and SAP fixes show. Before you evaluate Gemini 4 Argon, bind your publish credentials to immutable identities and make patching a continuous pipeline rather than a calendar event.