Cybersecurity
353 articles RSS
Pillow 13.0.0 Fixes Two Maintainer-Rated Critical Flaws and an EPS Filename Bug, CVE-2026-112900, That Can Reach Ghostscript Command Execution
Pillow 13.0.0, released October 16, fixes 40 advisories published October 17, including two rated critical and an EPS filename argument injection in the Ghostscript call.
Sandboxes and Permission Modes Versus Repository-Borne Attacks: What Three Reports on AI Coding Agents Show About Where Defenses Apply
Reports on GitSpawn, Plugin4Shell and IssueTrojanBench place attacks before, outside or inside the boundaries that Copilot sandboxing and Claude Code permission modes describe.
Dependency Cooldowns Spread From pnpm and pip to Bundler, Dependabot and GitHub's Package Firewall While Critics Question the Approach
Sources describe package-install delays appearing in pnpm, pip, Bundler, Dependabot and GitHub's firewall with differing defaults, alongside an LWN-reported dispute over cooldowns versus upload queues.
Docker Updates PHP Official and Hardened Images After the PHP2Shell Flaws, Moving the Four Supported Branches to 8.2.35, 8.3.36, 8.4.27 and 8.5.12
Docker says its PHP Official Images and Hardened Images were updated after CVE-2026-109618 and CVE-2026-109619; the DHI refresh landed within 24 hours of the upstream patches.
Ruby 4.0.9, 3.4.12 and 3.3.13 Fix Regexp Compiler Bugs Behind Four GitLab CVEs, and the Ruby Project Has Not Requested CVE IDs of Its Own
Ruby's October 23 releases fix Onigmo regular expression bugs that GitLab found could lead to remote code execution; Ruby says it has not requested CVE identifiers for them.
LiteLLM Says Stolen GitHub CLI Tokens and a Lookalike Repository Were Used to Publish Malicious 1.107.0 Releases to PyPI and Docker
LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer and backdoor; the project says attackers used stolen GitHub CLI tokens and a lookalike repository to publish it.
OpenCode Says a Distillation Attack Exposed Stored Provider API Keys for 1.4% of Console Users
OpenCode told 1.4% of Console users to revoke OpenAI, Anthropic and Google keys saved there; the company has not said how the attack worked.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 Fix Two Critical Unauthenticated RCE Flaws, CVE-2026-109618 and CVE-2026-109619
PHP's security release names the two CVSS 9.2 flaws as CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state), fixed in four branches.
Node.js Security Releases 26.12.1, 24.22.1 and 22.23.4 Fix Ten CVEs, Four Rated High Including a Brotli Decoder Out-of-Bounds Write
Node.js published its October 21 security releases for the 26.x, 24.x and 22.x lines: ten CVEs, four rated High, plus c-ares, Undici and certificate updates.
Hijacked Maintainer Accounts and Reclaimed Repository Names: What October's GhostAction, OVHcloud and npm Cases Show About Release Controls
Comparing three October 2026 cases, GhostAction, the OVHcloud CLI release swap and npm's SlugFest trusted-publishing gap, on how accounts, names and release settings were exploited.
PHP Pre-Announces October 21 Security Release for Two Critical Vulnerabilities Rated CVSS v4.0 9.2
The PHP security team says a release due October 21 at 14:00 UTC fixes two critical vulnerabilities, both CVSS v4.0 9.2, and urges users to prepare to upgrade.
Istio 1.31.2, 1.30.6 and 1.29.9 Patch an AuthorizationPolicy Method-Case Bypass Over HTTP/2 and an Ambient-Mode istiod Crash
Istio's patch releases fix a High-severity AuthorizationPolicy bypass over HTTP/2 (CVSS 7.4) and a mesh-wide istiod crash in ambient mode (CVSS 7.7), per GitHub advisories.