Cybersecurity
353 articles RSS
Pluto Security Says a Hugging Face Cryptomining Campaign Returned With 19 More Repositories, Its Flagship Model Scanning Clean
Pluto Security counts 31 malicious Hugging Face repositories in two waves that abuse trust_remote_code to run a miner; the second-wave flagship model scanned clean and reached 28,412 downloads.
.NET 8.0.33, 9.0.22 and 10.0.14 Ship Out-of-Band Fixes for a Brotli Buffer Overflow, CVE-2026-111497, Alongside .NET 11 Release Candidate 3
Microsoft's out-of-band .NET release fixes CVE-2026-111497 in Brotli decompression and a Linux tarball ownership flaw, and re-releases two advisories the October 13 release did not fully address.
Dependabot Reachability Analysis Enters Public Preview for JavaScript and TypeScript, Labeling Alerts With Four Verdicts
GitHub says Dependabot reachability analysis is in public preview on Enterprise Cloud for JavaScript and TypeScript, using CodeQL call graphs to give each open alert one of four verdicts.
Apache Kafka's CVE List Shows 12 Entries Announced October 28, Including a JWT Signature-Verification Skip and Broker Memory-Allocation Flaws
Apache Kafka's CVE page dates 12 entries to 28 Oct 2026, covering OAUTHBEARER validation, broker and Streams memory allocation, and Connect REST exposure; fixed-version lists differ by entry.
Next.js 16.4.1 and 15.5.28 Fix Two Critical RCE Advisories and a High-Severity DoS, Including Two Fixes Postponed From September
Next.js published an out-of-band update on October 14 for two critical unauthenticated RCE advisories and one high-severity DoS, and has announced a November 3 release of seven medium fixes.
Disclosure Rules Shift Around AI-Found Bugs: Kernel Docs Say Treat Them as Public, GNOME Ended Its Bounty, Google Paused OSS Rewards
Kernel docs, GNOME, Google, Go and PHP each handled AI-found vulnerabilities differently in October, from report volume to CVE assignment and embargo timing.
Erlang/OTP 29.1.2, 28.5.0.8 and 27.3.4.19 Fix TLS, X.509 and httpc CVEs, and 29.1.2 Also Fixes an erl_tar Infinite Loop
Three Erlang/OTP patch packages dated October 14, 2026 list four shared CVEs; 29.1.2 adds a fifth, a denial-of-service in erl_tar that also affects Hex and rebar3 copies.
Redis and Valkey Each Ship Security Releases for a Cluster PUBLISH Heap Buffer Overflow on Messages Over 4 GB; Valkey Scores Its Advisory 8.8
Redis released seven security patches and Valkey five on October 26; Valkey's advisory GHSA-f4q9-j22m-xqq9 names an integer truncation and lists a CVSS score of 8.8.
Wiz Says Gheist Campaign Uses Stolen GitHub Tokens to Print Repository Secrets Into Actions Logs, Succeeding in Private Repositories
Wiz Research says the Gheist campaign planted workflows from more than 850 compromised GitHub accounts; GitHub's approval hold covers only public repositories on github.com.
curl Moves Minor Vulnerability Reports Public and Gentoo Seeks Sponsors, Weeks After EU Cyber Resilience Act Reporting Duties Began
Comparing curl's switch to public handling of LOW and MEDIUM reports, Gentoo's sponsor search and the EU CRA reporting regime, using the Commission, The Register, FOSS Force and curl's maintainer.
LiteLLM Revises Its 1.107.0 Breach Account, Tracing Entry to a Master Key Committed in May; Socket Finds Secret-Stealing Workflows Ran October 10
LiteLLM's root-cause analysis says an Agent Platform master key committed on May 27 and never revoked led to the 1.107.0 compromise, replacing its earlier log-leak theory; GitHub commits show exfiltration workflows on October 10 and 12.
Go Blocks Trust in Compromised eMudhra Intermediate CAs Under CVE-2026-111943, and Cilium, Terraform and OpenTofu Ship Releases
Go 1.26.10 filters certificate chains through a set of eMudhra intermediates; Cilium, Terraform and OpenTofu have since released builds, and the Go thread debates the hardcoded approach.