‼️ An Android app with **no permissions** could pretend to be Teams and obtain work-account tokens from Microsoft Authenticator. The flaw affected phones with Authenticator and a signed-in work account. Pwnwatch reports that an exported activity, a door other apps can open, accepted a request for a token without verifying which app had sent it. A token works like a temporary key to account resources; Authenticator was acting as the gatekeeper but trusted the caller's claimed identity. That could let a malicious app access resources as the signed-in user. WindowsForum reports that version 6.2606.4246 or later fixes the issue. Audit affected devices, update Authenticator, restrict untrusted app installs, and inspect work-account sign-in logs for unexpected access. A familiar app name in a token request is not proof of which app made it. Early report: these facts come from first disclosures and are not confirmed yet. Expect them to change.

If PHP serves your web requests, **patching is no longer precautionary**. CISA has put both PHP2Shell bugs on its Known Exploited Vulnerabilities list, a register of flaws attackers have used. The Hacker News also reports that a test server confirmed outsiders could make PHP run code without signing in, though that test does not show which production systems were breached. Audit the PHP versions serving web requests and apply the CISA-listed update for your branch: 8.2.35, 8.3.36, 8.4.27 or 8.5.12; restrict access where possible and alert on unexpected commands started by the web server. An unpatched, exposed PHP service needs investigation as well as an upgrade.

Your device’s admin page may have **a bypassable login** even though it asks for a password. GoAhead’s 6.1.1 release notes confirm an authentication bypass. Pwnwatch reports that it affects Basic and form logins using BF1 password hashes. A hash is a one-way fingerprint used to store a password; BF1 names the method used to make it. That makes the stored-password format part of the exposure, not just the GoAhead version. Audit deployed versions and password formats, update affected builds to 6.1.1, restrict access to management pages, and check login logs for unexpected successes.

Designing offline is easy. Keeping files editable and collaborators in sync is harder. Desigma is a native Rust design app for interface design, with Figma file import and live collaboration. > Import Figma REST API JSON or .fig files > Build with frames, auto layout, components and variants > Prototype, edit vectors, and create decks > Collaborate live by sharing a link, with no account Its README says panning and dragging on a 5,000-layer page stay well under a frame. ⭐ 728 stars in 16 days · Rust · Apache-2.0

Your agent can run the command. The hard part is keeping its output from filling context. RTK filters and compresses shell-command output before an AI agent reads it. > `ls` and `tree` become a tree with file counts. > Test output keeps failures and collapses passing tests to a count. > `git diff` gets reduced context, with headers stripped. Its README reports support for 100+ commands and under 10ms overhead. ⭐ 84.7k stars · Rust · Apache-2.0

For Wayland remote desktop support, **a proposed protocol is not a feature you can rely on yet.** Remote desktop software needs a way to work with Wayland, the rules desktop programs use to communicate with the display system. Phoronix reported on October 25 that a change called ext-transient-output, a set of rules for making a temporary display available to remote software, like adding a screen for a remote session, has been proposed for software such as VNC servers, which let someone view and control a computer remotely. The proposal is a draft submitted for review, not evidence that the display system or VNC server you use supports it. Check both in your own setup before making a compatibility promise. Treat this as something to test, not a fix to ship.

Before changing the map of your production data, you need to know **what else it touches**. Open Ontologies plans changes to an ontology, the map that defines how data concepts fit together. - It reports which parts a planned change could affect. - It applies changes and supports rolling them back. - It produces evidence an auditor can check later without installing the tool. The supplied project description does not state pricing or licensing. Open Ontologies by fabio-rovai

You can patch the wrong server while **the exposed one stays online**. On October 25, an X post warned that an unpatched PHP server could lead to stolen data and downtime. It reported a possible consequence, not an observed breach. The post is a public warning, not a signed laboratory report. The post names no affected version or fix. That matters because the person deciding what to patch needs a match between a published flaw and a running installation. The useful question is not whether PHP risks are serious. It is which servers run an affected version, and what evidence would show that someone reached them. There is a more specific lead outside the post: Wikipedia identifies two flaws as CVE-2026-109618 and CVE-2026-109619. A CVE is a public flaw identifier, like a case number. McAfee says fixes went out on October 21. Neither source establishes that the server in the warning was attacked. The post says, “Attackers exploit vulnerabilities. Businesses pay the price.” It offers no incident timeline or attack path to test against that claim. There is a gap between its list of possible losses and evidence of an actual loss. Treating the list as an incident report would send an investigation looking for damage that has not been shown. Inventory the PHP versions you run, check the published advisories before patching, and review access logs for signs of exploitation. Which part of that check would you trust to distinguish exposure from an attack?