Espressif released ESP-IDF v5.5.6 on 16 October 2026. It is a bugfix release for the 5.5 branch, the one ESPHome and the Arduino core currently build on: ESPHome's development branch recommends ESP-IDF 5.5.5, and Arduino core 3.3.12 for ESP32 is based on 5.5.5 too. Besides three security fixes, the release has two breaking changes, and one of them
Home Assistant is getting a new integration called Debug console: a Python prompt inside the running Home Assistant, much like the console in a web browser's developer tools. Franck Nijhof's backend (#186547) and the frontend tab (#54937) were both merged on 16 October 2026, and the documentation lists the integration for Home Assistant 2026.11.
On Home Assistant OS, every Home Assistant update still waits for someone to open the update panel and press Install. That is about to change for patch releases. On 16 October 2026 the first two pieces of "Automatic Home Assistant updates for patch releases" were merged into the development branch, and the plan for the rest is public in the project
Home Assistant Core 2026.10.2 came out on the evening of 16 October 2026 (22:04 Warsaw time), with 50 changes listed in the release notes. Most are fixes for single integrations, but a few affect everyone who uses MQTT, state conditions or more than one user account.
On 16 October 2026 OPSWAT published the last part of its research into TP-Link's Tapo C200 and C120 cameras. The main flaw, CVE-2026-102369, is a command injection in a factory diagnostic service. On its own it needs administrator access, but an authentication bypass disclosed in August provides exactly that. Chained together, the two let an attack
On 16 October 2026 ESPHome merged a change to the web_server component that closes a quiet way around internal: true. Until now the device's REST endpoints answered requests for internal entities by name, even though the web page and the /events stream hide them. With the fix, those URLs return 404 unless include_internal: true is set under web_ser
Security researcher Quentin Kaiser presented a flaw in Broadcom's Wi-Fi software at the Hexacon conference in Paris on 16 October 2026 and published a full write-up the same day. The bug is in the code that reassembles fragmented WPS (Wi-Fi Protected Setup) EAP messages in Broadcom's proprietary 802.11 stack. An attacker within radio range can trig
Two fixes that landed this week tighten who can do what in Home Assistant. Neither needs a configuration change, but both matter if more than one person has an account on your server.
CISA published advisory ICSA-26-288-02 on 15 October 2026 about three vulnerabilities in EseeCloud, the app and camera firmware from Guangzhou Juan IoT Technology. According to CISA, exploiting them could let an attacker take control of affected IP cameras. The advisory covers the EseeCloud app up to version 4.9.6 and EseeCloud firmware up to 4.9.8
