Cybersecurity
353 articles RSS
GitHub Puts a Package Firewall in Public Preview for Enterprise Cloud, Screening npm Installs With a Default One-Day Cooldown
GitHub's package firewall, in public preview for Enterprise Cloud, checks npm downloads against malware advisories, attestation changes and a minimum package age; only npm is supported.
OVHcloud CLI Releases Hijacked Through a Contributor's GitHub Account, With Swapped Binaries Live for Up to 94 Minutes
An attacker replaced download archives on five OVHcloud CLI releases on October 19; a customer's pinned SHA-256 caught it, and OVHcloud had not enabled GitHub's release immutability.
Grafana 13.2.4, 13.1.8, 13.0.11 and 12.4.13 Fix Four Medium-Severity CVEs Covering Git Sync, Prometheus Rule Conversion and Azure Monitor
Grafana's October 13 patch releases fix four CVEs rated Medium (CVSS 5.3 to 6.5) in Git Sync, the Prometheus rule conversion API and the Azure Monitor data source.
Bloom Security's SlugFest Research Says Over 1,500 npm Packages Were Open to Hijacking via Trusted Publishing; GitHub Now Expires Unvalidated Configs
Bloom Security says SlugFest let attackers claim freed GitHub slugs to publish to over 1,500 npm packages; GitHub now expires unvalidated trusted publishing configurations after 48 hours.
Go 1.27.2 and 1.26.9 Ship Security Fixes Including an HTTP/2 Server Crash and a CONNECT Response-Poisoning Bug in net/http
Go's October 8 point releases include security fixes to the go command, crypto/tls, html/template, net/http, net/textproto and os; Go's vulnerability database details four of the CVEs.
Node.js Pre-Announces October 21 Security Releases for 26.x, 24.x and 22.x With a Highest Severity of High, as 26.12.0 and 24.22.0 Ship
Node.js says new 26.x, 24.x and 22.x releases will land on or shortly after October 21 to fix vulnerabilities, highest severity High; 26.12.0 and 24.22.0 shipped October 14.
Malicious AUR Packages Impersonating yay and paru Run a Remote Script as Root, Raising a Fresh Alarm Over the Arch User Repository
An account named marchos1as uploaded typosquatted yay and paru lookalikes to the AUR; their install scriptlets ran a downloaded script as root before maintainers banned the account.
npm Trusted Publishing Configurations Now Expire After 48 Hours Unless Validated, and issue_comment Tokens Are Rejected
GitHub says unvalidated npm trusted publishing configurations now expire 48 hours after creation, and npm now rejects trusted publishing tokens from GitHub Actions issue_comment events.
OpenTofu 1.12.8 Release Notes List a Go HTTP/2 CPU-Usage Fix for tofu init, While a Maintainer Proposes Shipping the v1.13 Backport in 1.13.2
OpenTofu 1.12.8, published October 14, 2026, lists an HTTP/2 excessive-CPU fix for tofu init; a maintainer's pull request proposes shipping the v1.13 fix in 1.13.2.
PgBouncer 1.26.1 Fixes Three CVEs, Including a SCRAM Flaw That Lets a User Who Knows One Password Log In as Others
PgBouncer 1.26.1, dated October 14, fixes CVE-2026-107350, CVE-2026-107349 and CVE-2026-107348 in versions up to 1.26.0, and changes how ignore_startup_parameters interacts with search_path.
curl 8.23.0 Fixes CVE-2026-92392, a High-Severity HTTP/2 Upload Use-After-Free in 8.12.0 Through 8.22.0, Credited to Anthropic's Luna With Claude
curl's October 14 advisory rates the HTTP/2 upload use-after-free High, lists fixes in 8.23.0 and three older branches, and says remote code execution needs a tightly matched set of conditions.
containerd Patches Four Moderate Advisories on October 13 Across 2.4, 2.3, 2.2 and 2.0, With 2.0.14 Carrying Only a Disk-Exhaustion Fix
containerd 2.4.2, 2.3.7, 2.2.10 and 2.0.14 shipped October 13 with fixes for four Moderate-rated advisories, split unevenly by branch; 2.0.14 lists one.