Two things this week that deserve a calendar entry, and one that is a patch you should not leave sitting.
Magento: APSB26-153 has five criticals
Adobe published APSB26-153 on 13 October. It covers 11 vulnerabilities: 5 critical (CVSS 9.1 to 10.0), 5 high (7.2 to 8.7) and 1 medium. The impacts include arbitrary code execution, privilege escalation, arbitrary file system writes and security feature bypasses. The listed categories are template engine input neutralisation, incorrect authorisation in B2B, stored XSS and improper input validation. Affected versions are Adobe Commerce 2.4.4 to 2.4.9, Magento Open Source 2.4.6 to 2.4.9, and B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3.
Adobe rates it Priority 2 and reports no known exploitation in the wild. I would not read that as permission to wait. Code execution bugs in a template engine get picked apart quickly once a patch is public, because the patch itself is the map. If you run Magento, get it onto staging this week, run your checkout end to end, and ship it. If you are on a version outside that range, you are not safe, you are just unsupported. That is a separate conversation.
Supabase: an old cipher deadline
On 12 October Supabase announced that an outdated subset of TLS 1.2 ciphers will be disabled on project HTTP APIs on 10 November 2026. Clients without modern TLS support will fail to connect. That is the changelog's wording, and I would add my own reading of it: the clients at risk are the forgotten ones. An old embedded device, a legacy integration, a script on a server nobody has logged into for a year. Ask the owners of anything that calls your Supabase project to confirm it, and test from the oldest client you have while there is still a month to spare.
Supabase and .NET
The .NET side of Supabase had a busy week. The .NET SDK became officially supported on 9 October. A new ASP.NET Core dependency injection package arrived on 12 October that registers the main client and all sub-clients with a single method. On 14 October the SDK gained OpenTelemetry traces and metrics for Auth, Postgrest, Storage and Functions, exportable to any observability backend. I do not build on .NET, so I will not pretend to have tested any of it. But official support and tracing are what teams look for before they let a backend tool near production.
Nothing new from Nuxt
Nuxt 4.6 is still the latest release, from 5 October. No new post this week, which suits me. I covered it last Friday, and the only date that matters is the one that has already passed: Nuxt 3 reached end of life on 31 July.
What went up here recently
Last Friday was the Nuxt 4.6 and scoped token round-up, followed the same morning by Claude against ChatGPT for a small business. This morning there is a practical piece on setting Claude up for your business.
That is the round-up. If you want a second opinion on a Magento patch plan or a Supabase setup, get in touch.