Monday, 26 October 2026
Java patching follow-up: Amazon Corretto shipped its October builds (27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512). CISA added Arista VeloCloud Orchestrator and Collabora Online CODE (Nextcloud) flaws to the KEV catalog, Kubernetes has two September CVEs to check, and AWS adds 1:1 NAT on Transit Gateway and Cloud WAN.
On 22 Oct Amazon released the quarterly security and critical updates for Corretto LTS: 27.0.1.0.10, 25.0.5.0.9, 21.0.13.0.10, 17.0.21.0.10, 11.0.33.0.9 and 8u512. If you run Corretto base images, rebuild and redeploy them, and check the Oracle Java alert from 24 Oct against the exact build you use.
Managed one-to-one NAT on attachments, through Regional Private NAT Gateway, lets networks with overlapping CIDR blocks connect without renumbering, a NAT appliance or return-traffic rules. Useful for mergers and partner networks.
Added on 23 Oct with a due date of 26 Oct. The on-prem VeloCloud Orchestrator SQL injection may let a remote attacker reach privileged internal functions and impact the VCO host. CISA lists known ransomware use as Unknown.
Also added on 23 Oct, due 26 Oct. The built-in CODE server, when used within Nextcloud, has an OS command injection that allows remote code execution when the CODE server is not running. Check if you run Nextcloud with the built-in CODE server.
CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation. CVE-2026-76654: subpath symlinking on Windows nodes permits NTLM coercion. Both were published on 14 Sep. Review who has write access to StatefulSets and ControllerRevisions, and compare your version with the fixed versions in the linked issues.
The web_search tool accepts up to 100 allowed_domains or up to 100 blocked_domains, plus a user location control, in the existing OpenAI Responses API request. Allow-listing trusted domains is a simple way to limit what an agent can ground on.