Cybersecurity
353 articles RSS
Git 2.56.1 and Six Backport Releases Fix Six CVEs, Including CVE-2026-111760, Which Can Run Attacker Code During Recursive Clones
Git 2.56.1 and backports to the 2.50 through 2.55 series fix six CVEs announced November 10, 2026; Git for Windows 2.56.1 was published at 22:13 UTC that day.
Attackers Used Ethersphere's Release Automation to Publish bee-js 13.3.0 and Swarm Desktop 0.56.2, Which Fetch Code Built to Steal Swarm Wallet Keys
The Hacker News reports bee-js 13.3.0 (npm) and Swarm Desktop 0.56.2 (GitHub) were published via Ethersphere's own automation on Nov 9, 2026; both run a loader for code built to steal Swarm node wallet keys. 0.56.3 replaces 0.56.2.
VulnCheck Honeypots Saw CVE-2026-58115 Exploited via Node-RED on October 30; Siemens-Sourced NVD Record Now Names Four IoT2050 Models, Up From One
Honeypots run by VulnCheck logged exploitation of CVE-2026-58115 between October 30 and November 1. The Siemens-sourced CVSS 10.0 NVD record names four IoT2050 models; GitHub's August copy named one.
RunSybil Says a CPython Bug Lets Chat Templates Escape Jinja Sandboxes; Python Security Team Does Not Consider the Escape a CPython Vulnerability
RunSybil says a CPython memory bug lets model chat templates escape Jinja sandboxes; Python's security team does not consider the demonstrated escape a CPython vulnerability. The crash fix shipped in 3.13.16, 3.14.8 and 3.15.0 release candidate 2.
Where Coding Agents Leave Secrets: A CI Prompt Injection, Saved Claude Code Approvals and AI-Driven GitHub Searches, as Reported in 2026
Three 2026 reports describe secrets exposed by a CI coding agent, saved in Claude Code approval files in public repositories, and sought by an agentic framework on GitHub; the sources agree on rotation but differ in scope and evidence.
LXD and MicroCloud Fix CVE-2026-112816, Rated CVSS 10.0, Which Let a Client Pose as a Trusted Client Without Its Private Key; Incus Also Fixes It
Canonical's LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15 and MicroCloud 3.4.1 and 2.1.5 fix a TLS certificate-chain flaw; CISA's entry in the CVE record, dated October 30, lists exploitation as none. Incus fixed it in 7.6.0.
Glow Labs Says Coding Agents Appear to Pick Archived MCP Servers From Training Data; No Fix Is Coming for a Reported Puppeteer Flaw
Per Help Net Security, Glow Labs says agents appear to take the package name from training data in 98% of sessions where a deprecated MCP server was installed or suggested.
eMudhra CA Compromise: uv Shipped Fixes October 20 and 21, an AWS CLI Fix Merged October 21, Azure CLI's certifi Pin Changed in 2.92.0 on November 3
A comparison of how uv, pip, CPython, the AWS CLI and the Azure CLI handled the compromised eMudhra intermediate CAs, drawing on release notes, pull requests, Mozilla and Cloudflare.
Cloudflare Opens Post-Quantum GeoKey Manager Closed Beta, Using ML-KEM-768 and X25519 Instead of Attribute-Based Encryption
Cloudflare launched a post-quantum GeoKey Manager in closed beta for its Data Localization Suite, with general availability planned for Q1 2027, and dropped attribute-based encryption.
Chrome 157, Rails and Gitea Security Releases in November 2026: Fix Counts Rest on Bug Entries, Advisories and CVE Lists
Chrome 157 states 213 security fixes and Rails 21 security issues, while Gitea 28.3's post states no total and lists 21 CVE entries; Linuxiac reported 20 for Gitea.
kaniko Before v1.25.20 Can Send Azure Entra ID Tokens to Lookalike Registry Hosts (CVE-2026-105769); Go Database Lists No Upstream Fix
A GitHub advisory says kaniko before v1.25.20 can send an Entra ID token to a lookalike registry host named in a Dockerfile; the Go vulnerability database lists no fixed version of the upstream helper.
Debian and Ubuntu Fix CVE-2026-109518, an APT Flaw in Download Retries That Lets an On-Path Attacker Install Unverified Packages
Debian, Ubuntu and APT's developers published fixes on November 4 for CVE-2026-109518, which needs an attacker on the HTTP path and a non-zero Acquire::Retries setting.