← Thursday 29 Octobernote 9 of 11
CybersecurityThu 29 Oct 2026 · 9 of 11

Chrome 156 and Firefox 159 updates patch over 200 security flaws

Verified · 14/14 supported1 cited · 1 min read

securityweek.com reports that Google released Chrome version 156.0.8078.73/.74 for Windows and macOS and 156.0.8078.73 for Linux, patching 52 security bugs including four critical flaws . securityweek.com reports that Chrome 156 also patches 46 high‑severity bugs, mainly memory corruption, improper input validation, and use‑after‑free issues . securityweek.com reports that no bug bounty rewards will be paid for 39 of the Chrome vulnerabilities, most of which were found internally or with the aid of AI . securityweek.com reports that Mozilla released Firefox 159, which patches 167 security defects, including 108 high‑severity flaws, primarily fixing use‑after‑free issues and also addressing sandbox escape, privilege escalation, boundary and same‑origin policy bypass problems . securityweek.com reports that together the Chrome and Firefox updates address more than 200 vulnerabilities .

Why it matters. securityweek.com reports that the updates protect users by addressing over 200 security flaws across the two major browsers .

Earlier on Cybersecurity

Wed 28 Oct 2026Data breach at Denver Health Medical Plan exposes 238,000 members' informationsecurityweek.com reports that Denver Health Medical Plan (DHMP) notified roughly 238,000 members that their personal and health information may have been compromised. securityweek.com reports that the breach involved third‑party vendor SquareML, which provides a no‑code platform for healthcare analytics. securityweek.com reports that SquareML’s access key was inadvertently leaked on a publicly accessible website on June 27, 2025, and the vendor informed DHMP of the leak on August 14, 2026, with the key revoked on August 18, 2026. securityweek.com reports that the compromised account was read‑only, meaning the key could not be used to download, export, delete, or change any information. securityweek.com reports that potentially compromised data includes members’ names and health information, and that DHMP is a non‑profit managed‑care organization within the Denver Health and Hospital Authority system, administering Medicaid benefits in Denver and three surrounding counties.Wed 28 Oct 2026Tailscale prepares patch after uncoordinated Tailworm disclosuresecurityweek.com reports that Tailscale is preparing a client update to address privilege escalation flaws in Tailscale SSH following an uncoordinated public disclosure of the Tailworm vulnerabilities. securityweek.com reports that the Tailworm report from Cyberdione Labs lists 11 findings affecting Tailscale client version 1.104.2 and headscale version 0.29.5. securityweek.com reports that six of the findings are rated high severity, with four specifically concerning Tailscale SSH, which relies on device identity and network policy instead of passwords or keys. securityweek.com reports that the report states Tailscale SSH performs certain forwarding operations with root privileges and that the intended safeguards can be bypassed. securityweek.com reports that an attacker who compromises one device could exploit any server that device is permitted to reach via Tailscale SSH, leveraging the bypassed safeguards. securityweek.com reports that Cyberdione Labs released the vulnerability report before any patches were available, drawing criticism on social media, while the researchers argued that rapid awareness would accelerate remediation.Tue 27 Oct 2026Industrial Vendors Alert Customers to PHP2Shell Vulnerabilitiessecurityweek.com reports that industrial vendors Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have confirmed that some of their OT products are affected by the PHP2Shell vulnerabilities. securityweek.com reports that PHP2Shell refers to CVE‑2026‑109618 and CVE‑2026‑109619, two critical unauthenticated remote code execution flaws in the PHP engine. securityweek.com reports that PHP released patches on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 after a leak of the vulnerabilities. securityweek.com reports that the first exploitation attempt was observed on October 17, before the patches, and Cloudflare has reported millions of attempts, with the first confirmed attacks aimed at honeypots reported over the weekend. securityweek.com reports that Schneider Electric identified three affected products—EcoStruxure Security Expert, ProLeiT LINEoptimize and EcoStruxure Control Engineering—while other vendors are still assessing exposure or have determined no impact.
Next · Central banks and marketsFed FOMC keeps rates unchanged at 3‑3/4 to 4 percent →