#security
46 posts
The one fix that matters in Deno 2.9.8: it stops trusting the compromised eMudhra root
This patch release has 13 fixes, half of them permission and sandbox edges, half Node-compatibility semantics. The eMudhra distrust lines up with what uv and CPython did the same week.
Node ships three security releases in one day: 11 CVEs, five high, two in tls and one in dns
On October 21 Node released 26.12.1, 24.22.1 and 22.23.4 together, fixing 11 CVEs. The high-severity ones cluster in tls and dns input parsing, alongside two permission-model edge cases and a root store bump to NSS 3.131.1.
Redis patches three lines at once: propagating a 4GB+ message over the cluster bus overflows the heap
8.10.3, 8.8.4 and 8.6.8 fix the same bug: in cluster mode, propagating a PUBLISH or SPUBLISH message larger than 4GB over the cluster bus overflows a heap buffer. Narrow impact, but the trigger conditions are worth remembering.
Traefik 3.7.16: ForwardAuth finally speaks NTLM and Kerberos, plus one CVE
Two things in this patch: a fix for GHSA-hrpp-p4fc-wwf8, and NTLM/Kerberos support in ForwardAuth and ingress-nginx auth-url. The latter fixes the long-standing "corporate SSO behind a gateway never authenticates" problem.
uv 0.13.5 drops the compromised root and moves managed CPython onto three security patches
0.13.4 removed the eMudhra/emSign root from uv's own certificate store; 0.13.5 rebuilds managed CPython 3.11+ on python-build-standalone 20261021, with 3.15.1, 3.14.9, 3.13.17, pip 26.2.2 and certifi 2026.10.19. Run uv python upgrade afterwards.
BeyondTrust Remote Support auth bypass is exploited in the wild, CISA adds it to KEV
CVE-2026-102764 is an auth bypass in BeyondTrust Remote Support up to 26.2.3, added to CISA KEV on October 16. Blast radius, patch path and what to hunt.
MCP Inspector's 9.4: a dev tool that runs commands should not listen on 0.0.0.0
Before 0.14.1, MCP Inspector had no authentication between its browser UI and its local proxy, so an unauthenticated request could launch MCP commands over stdio. CVSS 9.4 — and the lesson applies to every local-proxy dev tool.
PHP's two 9.2 RCEs: the official root causes, and what the public PoC actually demonstrates
On October 21 PHP fixed CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2); a public PoC with a full lab appeared the next day. Here are the longjmp and stale-global-state root causes, a reproducible lab, the PoC, and where the PoC diverges from the advisory.
The CVSS 10.0 React bug: one request, code execution on your server
A flaw in how React Server Components decode payloads earned a perfect 10.0 — unauthenticated remote code execution. Here is who is affected, how to check, and what to do about it.
A retargeted tag: twenty thousand repos leaked secrets into build logs
In March 2025 the version tags of tj-actions/changed-files were pointed at a malicious commit, and CI tokens were printed into workflow logs. CVE-2025-30066 is the bill for mutable tags.
TLS certificates are heading to 47 days: automation is no longer optional
CA/Browser Forum ballot SC-081 caps certificate lifetimes at 200 days from March 2026, 100 days from 2027, and 47 days from 2029. Manual renewal has a deadline now.
What a CVSS 4.0 score of 9.2 says, and the three things it does not
Both PHP vulnerabilities today are rated CVSS v4.0 9.2. That number is a filter, not a priority: it measures the vulnerability, not your assets, your exposure, or the cost of patching.
Eight intermediate CA private keys that were all integers below 256
Someone scanned the CCADB certificate corpus and found that eight eMudhra intermediate CA keys could simply be enumerated — they were generated as integers between 0 and 255. Yesterday Mozilla decided to remove trust in emSign ECC Root CA - G3.
PHP ships two 9.2 fixes today at 14:00 UTC: what to do before then
PHP posted an advance notice on 20 October: a security release on 21 October at 14:00 UTC fixes two vulnerabilities, both rated CVSS v4.0 9.2. Details come with the release, but your rollback plan can be settled now.
Twelve PHP CVEs in three days, none of them in PHP
I pulled every PHP-related advisory NVD published between 19 and 21 October. All twelve are plugins, CMS modules and libraries. That is the more useful signal: your real inventory is not the language.
CVE-2026-99999: the IPv4 checksum bug that can escape a VM
Debian security tracker lists CVE-2026-99999 as a missing IPv4 checksum check in the Linux kernel, exploitable from a guest to the KVM host. Fixed in 6.1.190-1 (bookworm) and 6.12.113-1 (trixie).
873 bugs, 54 models: notes on the 2026 LLM security report
2,467 white hats tested 54 LLM and agent products from 25 vendors and found 873 vulnerabilities, 608 of them LLM-specific. Prompt injection still ranks first; a hardcoded API key exposed keys for 239 models at once.
Next.js October patch: three holes, two of them remote code execution
In mid-October Next.js and React shipped three vulnerabilities: an image-processing RCE, a use cache RCE and a Server Action denial of service. The patches are out of band — do not wait for the next minor version.
An agent identity is more dangerous than its capability
In the LLM security report, agent identity and permission abuse plus goal hijacking account for two categories. Delegation chains, memory defects and forged tool responses can give a low-privilege agent high-privilege credentials.
Prompt injection is still number one, because we still treat data as instructions
In the 2026 LLM security report, prompt injection remains the most common finding. It is hard to fix not because models are dumb, but because systems lack a boundary between data and instructions.
239 model keys behind one hardcoded variable
The sharpest example in the LLM security report: a product hardcoded cloud API keys for 239 models in its frontend. Key leaks are not new, but LLMs amplify them — one key is a whole fleet of models and a bill.
Three ways classical cipher tools go quietly wrong
Caesar, Vigenere and Atbash all look like table lookups, but case handling, non-letter characters and key alignment each fail silently when done wrong.
Debian DSA-6045: a poisoned resolver can also break DNSSEC
Debian issued DSA-6045-1 for pdns-recursor, fixing CVE-2026-52690 and related issues. An attacker can forge answers so the resolver marks an authoritative server as EDNS-incapable, which makes DNSSEC validation fail.
GEO manipulation: when model answers are decided by search ranking
When DeepSeek opened its search API it mentioned filtering SEO spam, GEO manipulation and low-quality AIGC. GEO optimizes the probability of being cited by a model, not a page rank. Here is how it works and why it is hard to defend.
Post-quantum TLS is already in your handshake, but it only solves half the problem
Browsers and CDNs now negotiate hybrid key exchange like X25519MLKEM768 by default, which closes the harvest-now-decrypt-later gap. The signature half is still open.
Ninth Circuit: AI-generated code is not a "copy" under the DMCA
On 16 September 2026 the Ninth Circuit affirmed dismissal of the Section 1202 DMCA claims in Doe v. GitHub, holding that generative AI outputs are not copies under that section.
MCP 2026-07-28: delete the session, make the protocol stateless again
The new MCP revision removes the initialize handshake and the Mcp-Session-Id header, and turns cross-call state into explicit server-minted handles. What changed, why, and what it means for an existing server implementation.
Artex goes closed source: what an author can do when a security tool is abused
An AI-driven pentest tool was linked to data breaches at Korean banks; its author stopped development and closed the source. The responsibility boundary for open security tooling is on the table again.
GhostAction: pushing a malicious workflow into tens of thousands of repos
Attackers hijacked maintainer accounts and injected GitHub Actions workflows disguised as security audits that scrape credentials out of the entire git history. By 9 October, 500+ accounts and tens of thousands of repos were involved.
Jensen Huang dancing like Michael Jackson: when a hit video needs no truth
An 86-second AI edit of "Jensen Huang world tour" went viral at home and abroad, and Musk joined in. It is funny, and it makes "is this video real" an everyday question.
Chrome 155: JPEG XL is back, and post-quantum lands in Web Crypto
Chrome 155 decodes JPEG XL directly through jxl-rs, a Rust decoder, and adds ML-KEM and ML-DSA to the Web Crypto API.
A poisoned npm release: what one postinstall can carry away
In October 2026, tensorlake 0.5.144 shipped a Shai-Hulud credential-stealing worm aimed at npm, GitHub, cloud and AI credentials. The bar for a supply-chain attack is now one compromised account.
An AI agent chained two zero-days: the seconds that took down DIVD
An autonomous AI agent chained two Zammad zero-days into a full attack path and took over DIVD, an organisation whose job is coordinating vulnerability disclosure.
GLPI template-injection RCE: why admin rights should not equal root
CVE-2026-26026 lets a GLPI administrator reach arbitrary command execution on the server by editing a template. CVSS 9.1. The interesting part is not the attack chain but the assumption it exposes: why should the person with the admin console be able to run system commands?
Base64: it is neither encryption nor compression
Base64 turns 3 bytes into 4 printable characters, growing the payload by a third. It solves carrying binary through a text channel, not keeping anything secret.
Idempotency keys: the one write that makes retries safe
A network timeout does not mean the server did nothing. An idempotency key identifies the same request so the server replays the first result instead of executing again.
JSON canonicalization: why the same object hashes two ways
Key order, number formatting and escape style all change the bytes. A stable hash has to pin those rules at serialization, not hope JSON.stringify is deterministic.
Catastrophic backtracking: why a regex can pin a CPU
Nested quantifiers make the number of match attempts grow exponentially; (a+)+b can hang a process on one long non-matching input. Drop the nesting or put a timeout on it.
iframe sandbox: it narrows capability, it does not harden
The sandbox attribute starts by removing everything and allow-* adds pieces back. Getting the direction backwards is common: scripts stop running because that is the default.
Unicode normalization: why two identical-looking strings differ
An e-acute can be one code point or a base letter plus a combining mark. Normalize to NFC before comparing, storing or indexing, or duplicates quietly slip through.
URL encoding: spaces, plus signs and double encoding
A plus is a space in the query string and a literal plus in the path; the two positions encode the same character differently; encoding twice yields a plausible value that never matches.
SharePoint deserialisation RCE: CVE-2026-45659
A plain Site Member account is enough to run code on a SharePoint server. Microsoft rated exploitation unlikely, and CISA put it in the KEV catalogue with three days to remediate.
n8n unauthenticated RCE (Ni8mare): CVE-2026-21858
The form node skips Content-Type validation, so one application/json request makes it read an arbitrary file. The key inside the config forges an admin JWT, and a sandbox bypass turns that into RCE.
Cisco FMC unauthenticated Java deserialisation RCE: CVE-2026-20131
CVSS 10.0, no authentication, code execution as root, and 36 days of use as a zero-day by a ransomware crew. Breaking the firewall management hub hands over every policy and log with it.
Next.js incremental cache path traversal to RCE: CVE-2026-75604
One unescaped backslash turns the incremental cache into arbitrary file read and write on Windows, and the leaked Server Action encryption key forges a request that walks a React Flight property chain to Function.
React Router prototype pollution chained into RCE: CVE-2026-42211
turbo-stream v2 calls a constructor while rehydrating the TYPE_ERROR branch without checking where it came from. If the app already has a prototype pollution bug, that path reaches Function and two moderate flaws become RCE.