Home Assistant is getting a new integration called Debug console: a Python prompt inside the running Home Assistant, much like the console in a web browser's developer tools. Franck Nijhof's backend (#186547) and the frontend tab (#54937) were both merged on 16 October 2026, and the documentation lists the integration for Home Assistant 2026.11.
On Home Assistant OS, every Home Assistant update still waits for someone to open the update panel and press Install. That is about to change for patch releases. On 16 October 2026 the first two pieces of "Automatic Home Assistant updates for patch releases" were merged into the development branch, and the plan for the rest is public in the project
Tasmota 16.0.0, codenamed "Theo", was released on 16 October 2026. It follows 15.6.0 "Sylvie" from August and moves the ESP32 builds to Arduino core 3.3.12 on ESP-IDF 5.5.5. ESP8266 builds stay on core 2.7.8. Support for older cores has been removed from the code.
Home Assistant Core 2026.10.2 came out on the evening of 16 October 2026 (22:04 Warsaw time), with 50 changes listed in the release notes. Most are fixes for single integrations, but a few affect everyone who uses MQTT, state conditions or more than one user account.
On 16 October 2026 OPSWAT published the last part of its research into TP-Link's Tapo C200 and C120 cameras. The main flaw, CVE-2026-102369, is a command injection in a factory diagnostic service. On its own it needs administrator access, but an authentication bypass disclosed in August provides exactly that. Chained together, the two let an attack
On 16 October 2026 ESPHome merged a haier_water_heater platform that talks to Haier hOn water heaters over UART in place of the factory Wi-Fi module. TheLexus opened the pull request, bdraco reviewed it, and the matching esphome.io documentation merged the same afternoon. The author tested the stack on a Haier VH3W.
On 16 October 2026 Home Assistant gained three new Core triggers so automations no longer need template sensors to notice a version change or a pending restart. The work lands in the 2026.11 development tree. Franck Nijhof merged homeassistant.updated in the afternoon and, a few hours later, homeassistant.restart_required and homeassistant.host_reb
On 16 October 2026 ESPHome merged full duplex support for the i2s_audio component. A microphone and a speaker that share one I2S port can run together when you set full_duplex: true on that bus. Until now starting one side locked the other out, so a voice device with a single external audio codec could not listen while it played a reply.
On 16 October 2026 ESPHome merged a change to the web_server component that closes a quiet way around internal: true. Until now the device's REST endpoints answered requests for internal entities by name, even though the web page and the /events stream hide them. With the fix, those URLs return 404 unless include_internal: true is set under web_ser
