If your org still ships LibreOffice below 26.2.5 (or 26.8.0 on the new branch), the Oct 5 Calc external-data-link bugs mean opening a spreadsheet can write files or pull remote content before the user clicks Update Links. Patch first. Until then: disable automatic link updates, open untrusted ODFs/XLSX in a sandbox or web viewer, and block inbound office docs that embed Firebird/JDBC/SQL data mappings. On the 25.8 branch, stay at or above 25.8.7 for the EMF+ brush overflow (CVE-2026-6045) that ZDI republished Oct 16.