Cybersecurity
353 articles RSS
Gradle 9.8.1 Patches Three High-Rated Vulnerabilities, Two Involving Unsafe Java Deserialization in Its Build Daemon Channels
Gradle 9.8.1 fixes three high-rated flaws: two Java deserialization bugs in daemon communication and an SSL-failure repository fallback, plus three 9.8.0 regressions.
Tensorlake npm Package Compromised With a Shai-Hulud Worm That Targets AI Tool Configs and Wipes Home Directories If Stolen Tokens Are Revoked
StepSecurity and Socket report that [email protected] on npm steals credentials and AI-tool configs, and installs a monitor that deletes files if a stolen GitHub token is revoked.
Google Pauses Product Vulnerability Rewards in Its Open-Source Bug Bounty, Citing a Rise in Automated Submissions
Google's Open Source Software Vulnerability Reward Program stopped accepting product vulnerability reports as of October 1, 2026, with an update promised in Q1 2027.
OpenSSH 10.6 Disables LZ77 Compression Over a Plaintext-Recovery Attack, Enables Hybrid Post-Quantum Signatures and Deprecates scp -R
OpenSSH 10.6 disables the LZ77 coder in ssh and sshd to mitigate a CCS 2026 compression side channel, enables ssh-mldsa44-ed25519 signatures, and starts deprecating scp -R.
Socket Links Two Malicious VS Code Themes With Thousands of Installs to the GlassWorm Campaign
Socket reports two malicious VS Code themes in a GlassWorm-linked cluster, one hiding a Windows downloader and one a Solana-resolving loader, months after a coordinated takedown.
Atlassian Patches Critical CVE-2026-21589 File-Read Flaw Across Bitbucket, Jira, Bamboo and Five Other Data Center Products
Atlassian disclosed CVE-2026-21589, a 9.3-rated path traversal letting unauthenticated attackers read known files in eight self-hosted products, with fixes listed for each.
Wasmtime 49.0.2 and 48.0.4 Fix Eight Advisories, Led by a Critical Stack Overflow in Async Component Callbacks
The Bytecode Alliance patched eight Wasmtime advisories on October 2, including a critical 9.3 CVSS stack buffer overflow that lets a guest write about 16KB to the host's native stack.
pgvector 0.8.7 Fixes an IVFFlat Index-Build Buffer Overflow, CVE-2026-103484, That Can Lead to Arbitrary Code Execution
pgvector 0.8.7 fixes CVE-2026-103484, a buffer overflow in IVFFlat index builds affecting 0.8.6 and earlier; users are urged to upgrade.
Angular Patches Four Server-Side Rendering Advisories in Eight Days, Three Rated High, Across Versions 20, 21 and 22
Angular's maintainers published four GitHub advisories between September 23 and October 1 covering router and platform-server flaws in server-side rendering, three rated High.
Truffle Security Finds 543,699 Credentials Still Valid in Public GitHub Repositories, With a Median Exposure of 784 Days
A scan of 224 million public repositories found 543,699 working credentials; GitHub push protection cut protected-type leaks by 53 percent but 51.8 percent of live secrets fall outside it.
Redis Patches ACL Transaction Bypass and Unauthenticated Cluster Bus Across Five Release Branches
Redis 8.10.2, 8.8.3, 8.6.7, 8.4.7 and 8.2.10 ship security fixes; four close an ACL key-check gap at EXEC, and all add an opt-in refusal for unauthenticated cluster buses.
GitLab Patches Critical Self-Hosted AI Gateway Flaw CVE-2026-90970, a CVSS 9.9 Prompt-Template Sandbox Escape
GitLab fixed CVE-2026-90970, a CVSS 9.9 flaw that let authenticated Duo Agent Platform users escape a prompt template sandbox on self-hosted AI Gateways.