Tech & Security Roundup — October 23, 2026
A look at today's notable stories from across the tech and infosec world.
## Top Story: Sweden Moves to Ban ChatGPT and Claude in Government
Sweden's government offices (Regeringskansliet) are reportedly moving to prohibit the use of ChatGPT and Claude, according to a report from Sveriges Radio making the rounds on Hacker News. The move signals growing caution among European public institutions around commercial AI assistants and data handling. ([Hacker News discussion](https://news.ycombinator.com/item?id=50207405))
## Critical Vulnerabilities to Watch
Several high-severity vulnerabilities surfaced today via the EU Vulnerability Database (EUVD) feed:
- **agenticSeek (Fosowl) — CVSS 9.2**: A remote code execution flaw exists because `llm_server/app.py` hardcodes Flask debug mode while binding to all interfaces, letting attackers reach the server and obtain a derivable Werkzeug debugger PIN.
- **Aider (Aider-AI) — CVSS 8.5**: Versions through 0.86.2 allow command execution via a malicious `.aider.conf.yml` that auto-loads without a trust prompt, letting attackers set `notifications-command` or similar options.
- **Snap7 (davenardella) — CVSS 8.3**: An out-of-bounds write in the passive partner lets a malicious active partner overflow buffers via an unvalidated BSend length — relevant for industrial/SCADA deployments.
- **req_llm (agentjido) — CVSS 9.1**: Improper certificate validation in the WebSocket streaming client allows an on-path attacker to read/modify OpenAI WebSocket sessions, including the bearer token, via a TLS downgrade.
- **Chatwoot — CVSS 2.3 (but notable)**: An authorization bypass lets authenticated agent bots access other accounts by supplying a foreign contact inbox `source_id`.
Additionally, a fresh **PHP2Shell** follow-up vulnerability (tracked as CVE-2026-115560) was flagged just two days after emergency patches went out for the original critical PHP2Shell remote-code-execution flaws — this one affects unusual session configurations, and PHP has issued urgent mitigation guidance. For background, Wiz's research on the original PHP2Shell class of bugs — described as affecting roughly 70% of internet-facing PHP — is worth a read: ["PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet"](https://www.wiz.io/blog/php2shell-php-rce).
## Linux Kernel & Distro Notes
A batch of Linux kernel fixes landed, including:
- A `ksmbd` fix removing stale channels from sessions on teardown.
- A `crypto: ccp` fix for a possible deadlock in the SEV init failure path.
- Several `irqchip` (GICv4/GICv5) correctness fixes and a `host1x` null-check fix for error teardown.
On the distro side, **Tails 7.15.1** shipped as an emergency security update, addressing compromised CA certificates that could let attackers impersonate HTTPS sites through malicious Tor exit nodes.
## Phishing Watch
- A write-up on [More phishing messages via Booking.com and Novotel](https://shkspr.mobi/blog/2026/10/more-phishing-messages-via-booking-com-and-novotel/) details WhatsApp phishing attempts that accurately knew the victim's name, phone number, and stay details — a reminder that hotel-booking phishing is getting more targeted (if still "fairly inept" in execution).
- A possible phishing domain (`app.qpointsurvey[.]com`) was flagged via automated URL analysis.
## Around the Tech World
- **iOS 27** introduces a new "Call Context" feature in the Phone app, drawing early praise in hands-on coverage.
- **Apple's iPhone Duo** (foldable) got a hands-on review alongside news of upcoming MacBook Pro and "Tell" event announcements.
- **Motorola** is rolling out Android 17 to another flagship foldable, the Razr Ultra 2025.
- **Spotify** is testing QR-code address verification for Family plan Premium members, aimed at curbing shared accounts outside one household.
- **1Password** highlighted AI-assisted secure login features giving users full control over authentication.
