Daily brief: Monday 26 October 2026

Microsoft ships an out-of-band .NET 10 security update, researchers show AI coding agents being hijacked by instruction files in the Downloads folder, Teams prepares third-party deepfake detection, and a US city confirms a ransomware attack.

Microsoft

Microsoft releases an out-of-band .NET 10 security update

On 25 October Microsoft released .NET 10.0.14, a security update outside the normal monthly cycle. It fixes four CVEs, including a Brotli decoder out-of-bounds write (CVE-2026-111497) and a remote code execution flaw in the Blazor WebAssembly debugger (CVE-2026-102870). Microsoft says to install it even if you already applied the 13 October update, because it includes fixes made after that release.

Why it matters for IT: Check servers and build machines that run .NET 10 and update them through Microsoft Update, WSUS or the Update Catalog. Updating the runtime doesn't update NuGet package references, so developers of Blazor WebAssembly apps also need to update their packages.

Source: Microsoft Support

AI coding agents hijacked by an instruction file in the Downloads folder

Forever Security found a malicious AGENTS.md file in a customer's Downloads folder, which was also the working directory of an AI coding agent. The file tricked the agent into installing a rogue npm package. The researchers reproduced the attack against OpenAI Codex and showed a related technique against Claude Code using a CLAUDE.md file. They say hundreds of their customers run agents from their Downloads folders, and that there is nothing for the vendors to patch.

Why it matters for IT: Tell developers and anyone using these tools never to start an agent in Downloads or another broad folder. Start it in the project folder, keep approval prompts and sandboxing on, and read any unfamiliar AGENTS.md or CLAUDE.md before letting an agent follow it.

Source: BleepingComputer

AI scams & spam

Teams will let third-party tools scan meetings for deepfakes

Microsoft has confirmed that Teams will support certified third-party tools that check meeting audio and video for deepfakes. The detection is done by the third-party provider, and Teams shows the alerts. A Targeted Release is planned between mid and late November for Teams on Windows, Mac and the web (roadmap ID 573451, message centre MC1509787). Microsoft hasn't named any providers yet.

Why it matters for IT: Nothing to switch on yet, but if deepfake calls are a worry, start asking vendors whether they will be certified. Before you enable one, check where it sends meeting audio and video, as it needs the Calls.ReportSyntheticMedia.All permission.

Source: Windows Latest

Cybersecurity

City of Columbia, South Carolina confirms ransomware attack

The city said a cyber incident found on Tuesday was a ransomware attack that disrupted several online services, including its MyColaSC portal, animal services, park bookings and mapping systems. Police, fire, 911, water and the payment centre are still running. The South Carolina Law Enforcement Division is investigating, and the city hasn't yet said whether sensitive data was taken.

Why it matters for IT: A good prompt to check that critical services keep running if the office systems go down. Make sure there's a written fallback process and a phone number staff can give out while systems are offline.

Source: WACH Fox 57

Weather

Live forecast

Loading the forecast…

Fact of the day

All facts

← All daily briefs