Companies selling products built on ESPHome will soon be able to produce a software bill of materials (SBOM) for its firmware without editing it by hand. Two pull requests merged on 24 October 2026 make ESPHome write the metadata that Espressif's esp-idf-sbom tool reads. The author names the reasons directly: EN 18031 and the EU Cyber Resilience Ac
ESPHome boards can already share sensor readings through packet_transport, over UDP or a UART. A new component, packet_interface, adds a level underneath: a common way to send packets over a link, with optional layers that resend lost packets, check whether the other side is still there and encrypt the traffic. The author, clydebarrow, split the wo
Since Home Assistant 2026.10, arming or disarming a Blink system from Home Assistant has worked, but the alarm panel entity kept showing the old state for up to five minutes. A fix by Sean Cardus, reviewed by frenck, was merged into the development branch on 24 October 2026. The pull request doesn't say which release will carry it.
Ukraine's computer emergency response team CERT-UA published an alert on 23 October 2026 about attacks on Dahua video surveillance equipment. According to the alert, attackers gained remote access to IP cameras and video recorders, watched the live video, changed device settings and created accounts of their own. CERT-UA did not say who was targete
If an ESPHome device forwards its logs to a syslog server, that server may have been receiving the device's passwords. A fix by Jonathan Swoboda, merged into ESPHome's development branch on 23 October 2026, replaces those values with [redacted] before the log line leaves the device. It is not in the 2026.10.0 release from 21 October, so it should a
A pull request from Paulus Schoutsen, Home Assistant's founder, merged into the development branch on 23 October 2026, closes a gap between users of the same Home Assistant instance. Anyone signed in who knew a conversation's ID could continue someone else's conversation with Assist, together with its history and the tools the agent had available.
Dominic Griesel (AlCalzone), who maintains Z-Wave JS, merged two fixes on 23 October 2026 that limit incoming requests a device on the network could abuse. One could keep the controller's radio busy, the other could freeze the driver completely. Both landed after Z-Wave JS 15.31.2 from 22 October, so they will arrive in the next release and then in
If you connect Music Assistant to a Jellyfin server, the account token it uses could be read by every client that has access to the music library. A fix by Marvin Schenkel was merged into the Music Assistant server on 23 October 2026 and shipped the same day in 2.11.0 beta 7. The issue was reported on Discord.
Wyze has launched the Bulb Cam Pan Color, a security camera built into a colour smart bulb. The Verge reported the launch on 22 October 2026, and the camera is listed in Wyze's store for $99.98, twice the price of the original $49.98 Bulb Cam from last year. The new model adds a motor, so the camera can turn and follow whatever it is tracking.
