Two small changes to Home Assistant's login code close timing gaps that let a burst of simultaneous requests get more tries than the limits allow. Both come from GitHub user zweckj, and Franck Nijhof (frenck) merged both into the development branch on 19 October 2026 at 09:33 Polish time. They are labelled as bug fixes, not security advisories, and
Supervisor 2026.10.3 changes the default of a feature many Home Assistant users only noticed last week: the check that compares app passwords with the Have I Been Pwned (HIBP) breach database. It now stays off unless you turn it on. The release reached the beta channel on 19 October 2026 at 21:43 Polish time. When we checked later that evening, the
TP-Link published two security advisories for Tapo cameras on 19 October 2026, and the three flaws they describe reached the National Vulnerability Database the same day. Two affect the Tapo C210 with hardware version 3.6, one affects the Tapo C320WS with hardware version 2. Each of them needs an attacker on the same local network as the camera, an
Out of the box, Home Assistant only listens on your local network. That is the safest state it will ever be in, and every way of reaching it from outside changes that. The official documentation lists four routes: Home Assistant Cloud, a VPN, a reverse proxy and plain port forwarding. They differ in what ends up visible on the internet, what you ha
Until now, an AI agent connected to Home Assistant could only work with the entities you exposed to Assist. Home Assistant 2026.11, due in early November, adds a second LLM API aimed at the system itself. It is called "Home Assistant", it only works for administrator accounts, and it is not limited to exposed entities. On 18 October Paulus Schoutse
A cheap Wi-Fi plug runs firmware you cannot audit, and many of them talk to a cloud you do not control. On a flat home network that plug sits next to your laptop, your NAS and your phone. Moving smart devices to their own VLAN means a compromised gadget can reach Home Assistant and nothing else.
Home Assistant's development branch now accepts sign-ins through a Tailscale address, a global IPv6 address or another public IP. The fix by Joakim Plate (elupus), reviewed by balloob, was merged on 17 October 2026. It went into the dev branch, so it should arrive with Home Assistant 2026.11 rather than in a 2026.10 patch release.
A Home Assistant backup is only useful if three things survive the day your server dies: the backup file, the key that decrypts it, and the username and password you had when it was made. When a restore fails, one of those three is usually missing, and very often it is the file itself, because the only copy sat on the SD card or SSD that just gave
Germany now has a national law to enforce the EU Cyber Resilience Act (CRA), which sets mandatory security rules for products with digital elements, from smart plugs to apps. The Bundestag passed the CRA implementation act in mid-October 2026. The Federal Office for Information Security (BSI) announced it on 16 October, describing the vote as havin
