Friday is the patch date.
- Four edge bugs are on CISA’s list, and the federal date is Friday.
- Microsoft disrupted a device-code phishing service tied to 12,000 inboxes.
- GitHub will require larger new RSA SSH keys from 14 October.
- Claude Opus 5.5 blocks edits to prior thinking on newer API accounts.
- GPT-6 Sol and Luna are rolling into Copilot on by default.
Security
Four edge bugs share a Friday federal date
CISA Known Exploited Vulnerabilities catalog
On 22 September CISA added four vulnerabilities to that catalog. Each has a federal due date of 25 September, and each requires forensic triage. The products sit on the network edge: Check Point gateways and management servers, F5 BIG-IP APM, and on-prem VeloCloud Orchestrator.
Check Point says CVE-2026-85102 is unauthenticated remote code execution in Security Gateway and Spark Firewall VPN certificate handling, scored 9.8, with exploitation attempts against Spark customers since 12 September. The same advisory says CVE-2026-93616 is a pre-authentication path traversal on Security Management, also scored 9.8, that can run a script from an arbitrary path. Check Point reports a handful of those attacks dated 23 July, and says LivePatch Take 28 and Take 29 leave that bug unfixed. CISA’s entry also names Multi-Domain Security Management, Log Server, Multi-Domain Log Server, and SmartEvent.
The CVE-2026-94127 record describes a heap overflow, scored 9.8, that allows unauthenticated remote code execution on BIG-IP APM when an access policy and an OAuth profile are configured on the same virtual server. The affected trains are 21.1.0, 17.5.0, and 17.1.0 until F5’s engineering hotfixes. CISA’s catalog note says to apply the vendor iRule first, then the final patch, and points at K000162605.
Arista says CVE-2026-93952, scored 10.0, is being exploited. On-prem orchestrators are exposed when edges authenticate with certificates and the web interface is reachable. Hosted orchestrators are already patched. The fixed builds named so far are 5.2.3.16 and 6.4.2.8. The 6.1 and 7.0 trains are still waiting.
This week. Before Friday, confirm whether you run Check Point management or Spark VPN, a BIG-IP virtual server with both an APM policy and an OAuth profile, or an on-prem VeloCloud Orchestrator, and install the vendor fix for those four identifiers.
Microsoft disrupts EvilTokens
Steven Masada, of Microsoft’s Digital Crimes Unit, said the company disrupted EvilTokens, a service that takes over a Microsoft mailbox through the device-code sign-in page and then uses a chatbot to choose who to impersonate. He said that within months of a February 2026 launch it was linked to more than 12,000 inboxes at more than 10,000 organizations, that Microsoft seized 50 websites and disabled more than 150 domains, and that a password reset leaves the session in place until those tokens are revoked. Microsoft Threat Intelligence says to block the device-code flow except where a Teams device still needs it. Anyone who can be talked into approving a code on a real Microsoft login page is the audience, because the phish never asks for the password.
This week. Block the device-code flow in Entra Conditional Access. Limit any exception to the Teams device accounts that still need it, and revoke sessions on a mailbox that approved a code it did not request.
Platforms
GitHub raises the floor on new RSA SSH keys
GitHub will reject new RSA SSH keys smaller than 3072 bits after 14 October 2026. The same changelog schedules removal of the ssh-rsa signature type, RSA with SHA-1, and the diffie-hellman-group-exchange-sha256 key exchange. The first brownout is 4 November 2026, and a second is 9 December 2026. From 14 October, GitHub will also offer the mlkem768x25519-sha256 key exchange on github.com and on GitHub Enterprise Cloud with data residency, except the U.S. region. HTTPS remotes are outside this change. An existing RSA key keeps working when the client signs with SHA-2, and GitHub lists OpenSSH 7.2p1 as the oldest release that does that by default. The people who have to move are anyone pushing over SSH from an old client, a CI image, or a short RSA key.
This week. Find clients and CI images that still offer ssh-rsa or diffie-hellman-group-exchange-sha256, and stop issuing new RSA keys under 3072 bits.
AI
Claude Opus 5.5 blocks edits to prior thinking
Anthropic released Claude Opus 5.5 on 22 September as claude-opus-5-5, on the Claude Platform and on AWS, Google Cloud, and Azure. The company prices input at $4 per million tokens, output at $20, and cache reads at $0.20, and says its own tests put a typical workload about 40% under the cost of Opus 5. Preserved thinking, which Anthropic says stops an API caller from editing Claude’s prior context to extract its reasoning, applies to Opus 5.5 and Fable 5.1 on API accounts created on or after 31 August 2026. GitHub is adding the model to Copilot for Pro+, Max, Business, and Enterprise, on unless an admin has turned off new models or this one. The integrations that rewrite a Claude transcript between turns are the ones that will break.
This week. If an integration rewrites Claude’s previous thinking, test it on an API account created on or after 31 August before you point that workload at claude-opus-5-5.
GPT-6 Sol and Luna arrive in Copilot and the API
GitHub is rolling out GPT-6 Sol and GPT-6 Luna in Copilot beside GPT-6 Astra. Sol is on Pro+, Max, Business, and Enterprise. Luna is also on Pro. On Business and Enterprise, a new model turns on unless an administrator has disabled the global default or that model. OpenAI’s rate card lists Sol at $2 input, $0.20 cached input, and $10 output per million tokens, and Luna at $0.10, $0.01, and $0.50. The card says both are for ChatGPT Work and Codex, and that they are not available in Chat. Copilot administrators on those paid plans, and anyone about to move API traffic onto a cheaper GPT-6 tier, are the ones who need a decision this week.
This week. If those plans should not pick the models up on their own, disable GPT-6 Sol and GPT-6 Luna in the Copilot model policy before the rollout reaches the org.
Link of the day
The Friday dates sit under CISA’s current patch directive: BOD 26-04.
Leave a Reply