Vendor Security Advisory
Google Chrome 154 Stable Fixes Thirty-Two Security Vulnerabilities
Chrome 154's September 29 desktop release includes thirty-two security fixes. Update through the supported endpoint channel and relaunch; both listed Windows/macOS builds are valid releases, and deployment assignment alone does not prove running browsers changed.
AWS Updates GluonTS for Unsafe Model Deserialization
GluonTS before 0.17.0 can execute commands while loading an untrusted model directory. Update each notebook, worker image and relevant fork, restrict artifact provenance, and never load a suspect model merely to inspect its behavior.
WatchGuard AP 3.4.8 Fixes Three Access and Command-Injection Vulnerabilities
WatchGuard AP 3.4.8 fixes internal-API access and command-injection flaws plus an administrator-only diagnostic CLI issue. Update access-point firmware while preserving coverage and management access; this is not a Firebox advisory.
ABB PCM600 Hotfix Blocks Project-Import Path Traversal
ABB PCM600 2.14 Hotfix 20260923 fixes project-archive path traversal using the importing user's permissions. Restrict untrusted imports while updating; this hotfix does not resolve the separate Scheduler privilege-escalation issue.
ABB AC500 V3 Firmware Fixes Web Visualization Denial of Service
ABB AC500 V3 firmware 3.9.1 fixes denial of service in running web visualization servers. Coordinate controller maintenance with the process owner; updating Automation Builder alone does not prove the controller has received the firmware.
ABB Automation Builder 2.9.1 Fixes Project File Code Execution
ABB Automation Builder 2.9.1 fixes project-file code execution involving print or printer-setting interaction. Update engineering workstations and restrict untrusted projects; obtain ABB clarification before relying on the incompletely documented local-access-only workaround.
ABB PCM600 Scheduler Service Requires Privilege-Escalation Workaround
ABB PCM600 Scheduler has a local privilege-escalation flaw with a documented service-account workaround, not a fixed release. Coordinate changes with the engineering owner and preserve certificate validation; changing accounts does not repair the permission defect.
Google Cloud Patches Three Application Integration Vulnerabilities
Google has patched Application Integration authorization, deserialization and Email Task confused-deputy issues and states no customer action is required. Confirm service applicability and retain the bulletins; do not invent a local package or service-recreation task.
hMailServer 6.3.4 Fixes Pre-Authentication Script Injection
hMailServer 6.3.4 fixes script-injection paths with specific event and rule conditions. Plan manual installation and tested database/mail-data recovery; live update will not install this release, and a binary downgrade cannot reverse its database migration.
Citrix NetScaler Fixes Eight Flaws; Exploitation Observed
Citrix reports exploitation of two NetScaler flaws in this update set. Patch every affected customer-managed appliance and HA peer, coordinate forensic triage, and separately apply the required enhanced-ISN configuration where applicable.