Cybersecurity
301 articles RSS
Go 1.27.2 and 1.26.9 Ship Security Fixes Including an HTTP/2 Server Crash and a CONNECT Response-Poisoning Bug in net/http
Go's October 8 point releases include security fixes to the go command, crypto/tls, html/template, net/http, net/textproto and os; Go's vulnerability database details four of the CVEs.
Node.js Pre-Announces October 21 Security Releases for 26.x, 24.x and 22.x With a Highest Severity of High, as 26.12.0 and 24.22.0 Ship
Node.js says new 26.x, 24.x and 22.x releases will land on or shortly after October 21 to fix vulnerabilities, highest severity High; 26.12.0 and 24.22.0 shipped October 14.
Malicious AUR Packages Impersonating yay and paru Run a Remote Script as Root, Raising a Fresh Alarm Over the Arch User Repository
An account named marchos1as uploaded typosquatted yay and paru lookalikes to the AUR; their install scriptlets ran a downloaded script as root before maintainers banned the account.
npm Trusted Publishing Configurations Now Expire After 48 Hours Unless Validated, and issue_comment Tokens Are Rejected
GitHub says unvalidated npm trusted publishing configurations now expire 48 hours after creation, and npm now rejects trusted publishing tokens from GitHub Actions issue_comment events.
OpenTofu 1.12.8 Release Notes List a Go HTTP/2 CPU-Usage Fix for tofu init, While a Maintainer Proposes Shipping the v1.13 Backport in 1.13.2
OpenTofu 1.12.8, published October 14, 2026, lists an HTTP/2 excessive-CPU fix for tofu init; a maintainer's pull request proposes shipping the v1.13 fix in 1.13.2.
PgBouncer 1.26.1 Fixes Three CVEs, Including a SCRAM Flaw That Lets a User Who Knows One Password Log In as Others
PgBouncer 1.26.1, dated October 14, fixes CVE-2026-107350, CVE-2026-107349 and CVE-2026-107348 in versions up to 1.26.0, and changes how ignore_startup_parameters interacts with search_path.
curl 8.23.0 Fixes CVE-2026-92392, a High-Severity HTTP/2 Upload Use-After-Free in 8.12.0 Through 8.22.0, Credited to Anthropic's Luna With Claude
curl's October 14 advisory rates the HTTP/2 upload use-after-free High, lists fixes in 8.23.0 and three older branches, and says remote code execution needs a tightly matched set of conditions.
containerd Patches Four Moderate Advisories on October 13 Across 2.4, 2.3, 2.2 and 2.0, With 2.0.14 Carrying Only a Disk-Exhaustion Fix
containerd 2.4.2, 2.3.7, 2.2.10 and 2.0.14 shipped October 13 with fixes for four Moderate-rated advisories, split unevenly by branch; 2.0.14 lists one.
Docker Says a Docker Hub Account-Conversion Flaw, CVE-2026-105445, Let Reassigned Personal Access Tokens Act as Other Users Until a September 30 Fix
Docker's advisory says account conversion reassigned personal access tokens to new owners from August 2024 until a September 30, 2026 fix; it reports no evidence of exploitation.
Storybook Patches Two Dev-Server Advisories Rated Critical and High, Changing Defaults in Versions 8 Through 11 Alpha
Storybook's maintainers published two advisories on October 12, rated critical (CVSS 9.4) and high (8.7) by the project, with fixes in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6.
SAP Cloud SDK for Python Advisory Rates an OAuth2 SSRF Flaw CVSS 10.0, With a Fix Listed as Version 0.45.2, Released August 21
A GitHub advisory published October 13 for SAP's Cloud SDK for Python lists CVE-2026-89111, a CVSS 10.0 OAuth2 SSRF flaw, as affecting versions before 0.45.2.
GitLab 19.4.2, 19.3.4 and 19.2.8 Fix CVE-2026-97229, a CVSS 10.0 Code-Execution Flaw in the CI/CD Regular Expression Compiler
GitLab's October 12 critical patch release fixes CVE-2026-97229, rated CVSS 10.0, which GitLab says could let an unauthenticated user run code via a crafted CI/CD regular expression.