FortiMail’s exploited bug still has no shipped fix, and GitHub’s macOS 14 runners start failing on Monday.
- FortiMail’s path traversal is exploited, and the fix is still upcoming. The federal due date is 4 October.
- GitHub Actions jobs on macOS 14 start failing on 5 October.
- Actions retention now deletes checks, runs, and statuses.
- Copilot computer use is a public preview on macOS and Windows.
- GitHub’s async merge API is generally available.
Security
FortiMail’s path traversal is exploited, and the fix is still upcoming
Fortinet’s advisory FG-IR-26-175, published on 1 October, rates CVE-2026-104286 at a CVSS v3 score of 9.8. It affects the FortiMail GUI. Fortinet says a path traversal and NULL-byte handling flaw lets an unauthenticated attacker write arbitrary files through crafted HTTP or HTTPS requests, and that this has been reported exploited in the wild. Fortinet’s impact field says the bug can execute unauthorized code or commands. Affected releases are 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fortinet lists the fixes as upcoming 8.0.2, 7.6.7, and 7.4.9, and tells the 7.2 train to move to branch 7.4 or above. Virtual patching is marked No. The workaround on the advisory is to disable IBE, or to keep the management interface off the internet. Fortinet lists added and modified files, including /data/lib/liblog.so, /bin/smit, /data/bin/webconsole, /data/bin/mailservice, /data/etc/httpd.conf, /data/etc/ld.so.preload, and /data/migadmin.tar.gz, plus the addresses 79.141.169.187 and 45.129.0.192. CISA said on 1 October that it added the CVE to the exploited catalog. The catalog, version 2026.10.01, adds the CVE on 1 October, sets the federal due date at 4 October, and sets forensic triage to Yes.
This week. On an affected FortiMail, run config system encryption ibe, then set status disable, then end. If IBE has to stay on, limit the management interface to a trusted network. Fortinet lists 8.0.2, 7.6.7, and 7.4.9 as upcoming. A move from 7.2 onto 7.4.0 through 7.4.8 stays on an affected release. Where the management interface faced the internet, follow the catalog’s forensic-triage requirement and compare the host with the file paths and addresses on the advisory. The federal due date is 4 October.
Platforms
macOS 14 GitHub Actions runners start failing on 5 October
GitHub’s changelog of 1 October says the macOS 14 runner image retires on 2 November 2026. Jobs that use it fail during scheduled brownouts, each from 14:00 UTC to 00:00 UTC the next day: 5–6 October, 12–13 October, 16–17 October, 19–20 October, 23–24 October, 26–27 October, 29–30 October, and 30–31 October. GitHub says the labels are macos-14, macos-14-large, and macos-14-xlarge. GitHub says it may reduce macOS 14 capacity before retirement, which can lengthen queues. The replacements GitHub names are arm64 labels: macos-latest (macos-26), macos-15, macos-latest-xlarge (macos-26-xlarge), and macos-15-xlarge.
This week. Before 5 October, 14:00 UTC, replace macos-14, macos-14-large, and macos-14-xlarge with an arm64 label GitHub lists: macos-latest, macos-15, macos-latest-xlarge, or macos-15-xlarge.
Actions retention now deletes checks, runs, and statuses
GitHub’s changelog of 1 October says checks, workflow runs, and statuses now follow the same Actions retention setting as artifacts and logs. GitHub says this was previously announced, and that the cleanup applies to checks and statuses from GitHub Actions and from third-party applications. The setting label GitHub gives is “Check, workflow run, status, artifact and log retention.” Repository retention stays under organization and enterprise caps. Public repositories max out at 90 days. GitHub says changing the setting does not restore data already removed. The change applies to GitHub Actions on github.com.
This week. Read the retention value on each repository before check history disappears. Leave it where it is if that history still has to be there. Lowering it to clear artifacts deletes checks, runs, and statuses as well.
AI
Copilot computer use is a public preview on the desktop
GitHub’s changelog of 1 October says computer use is in public preview in GitHub Copilot CLI and the GitHub Copilot app on macOS and Windows. GitHub says Copilot can read accessible app content, click, type, press keys, scroll, drag, and move across applications, including software that offers no API, command line, or MCP integration. GitHub says Copilot asks for approval before it controls an app, and that organization-managed settings can disable the feature. On macOS, GitHub says the preview walks through Accessibility and Screen Recording permissions. In the CLI, /computer on enables it, /computer show checks it, and /computer off disables it. In the Copilot app, the switch is Settings, Computer Use, Enable Computer Use.
This week. If desktop control should stay off, disable computer use in the organization policy before anyone turns the preview on.
Architecture
The async merge API is the supported way to merge from automation
GitHub’s changelog of 1 October says the async merge API is generally available. GitHub says a caller can merge one pull request or a stack, add a pull request to a merge queue, or merge directly, and can bypass rules when the caller has permission. The call is a PUT. A later GET with the returned request ID reads the status. GitHub says this is now the recommended path for programmatic merges, in place of the synchronous REST endpoint or GraphQL mutations, and that it is the only merge API that supports stacked pull requests.
This week. Point merge automation at the async merge API. Submit with PUT, then poll with GET and the returned request ID.
Link of the day
GitHub on the macOS 14 runner image: GitHub Actions: macOS 14 runner image retirement.
Leave a Reply