Security alerts and updates
The latest warnings and updates from official sources such as Scamwatch, the Australian Cyber Security Centre and software makers, explained in plain English. Each item links to the original announcement and to our related guides.
October 2026
- Google moves Chrome 156 to the Stable channel for Windows, Mac and LinuxGoogle announced on 20 October 2026 that Chrome 156 is being promoted to the Stable channel for desktop computers, a week after the Chrome 155 release.Source: Google Chrome Releases
- PHP fixes two critical flaws that can let attackers take over websitesPHP has released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical remote code execution flaws. The ACSC has also issued an alert.Source: The PHP Group (php.net)
- WA Cyber Security Unit flags an actively exploited Windows vulnerability fixed by MicrosoftA WA Government advisory says Microsoft has released updates for CVE-2026-96951, a Windows flaw that Microsoft says has been exploited.Source: WA Cyber Security Unit (DGOV Technical)
- Google publishes October 2026 Android security bulletin, with Pixel updates at the 2026-10-05 patch levelGoogle's October 2026 Android bulletin lists fixes addressed by the 2026-10-01 security patch level, including critical System issues. Pixel phones get 2026-10-05.Source: Android Open Source Project (Google)
- Apple fixes a CoreGraphics flaw it says may have been exploited, in iOS 26.7.1 and macOS 26.7.1Apple has released iOS 26.7.1, iPadOS 26.7.1 and macOS Tahoe 26.7.1 to fix a file-processing flaw it says may have been used in targeted attacks.Source: Apple
- ATO warns fake "payment update" emails can install remote access softwareThe ATO says scam emails about a payment update or income statement link to remote desktop software that could let scammers into your device. Here's what it lists.Source: Australian Taxation Office
- Google releases Chrome 155 for desktop with 37 security fixesGoogle says Chrome 155 for Windows, Mac and Linux includes 37 security fixes. The update rolls out over the coming days and weeks.Source: Google Chrome Releases
- Microsoft Entra is retiring its built-in SMS and voice sign-in codes and making passkeys the defaultMicrosoft says Entra ID is moving to passkeys by default and retiring Microsoft-provided SMS and voice authentication in stages from February 2027.Source: Microsoft Learn
- Microsoft releases October 2026 security update for Exchange Server Subscription EditionMicrosoft's 13 October 2026 update KB5128895 for Exchange Server SE fixes six vulnerabilities, including one remote code execution flaw.Source: Microsoft Support
- Scamwatch warns investment scams can start in chat groups, referrals and fake news storiesScamwatch says some investment scams begin without an obvious sales pitch, through group chats, trusted referrals or fake news articles. Here are the signs it lists.Source: Scamwatch (ACCC)
- Microsoft releases October 2026 Windows 11 security update, the last for 24H2 Home and ProMicrosoft's 13 October 2026 update KB5127648 brings security fixes to Windows 11 24H2, 25H2 and 26H2, and is the final update for 24H2 Home and Pro editions.Source: Microsoft Support
Alerts are summarised from the official sources named on each item. For advice about your own situation, contact the official services linked on each page. RSS feed