PracticesForgejo drops OpenID 2.0 in v19, and your deadline depends on your release track3 NovA Forgejo notice dated 2 November 2026 says OpenID Authentication 2.0 support ends in v19, scheduled for 25 March 2027, with v15 LTS the last release to carry it on the LTS track and v17 and v18 on the stable track. The notice also says OIDC and OAuth are unaffected, gives no CVE or security reason, and sends readers to a discussion thread for the reasoning. No configuration keys or setup steps were collected for this note.
PracticesHaxy: a git forge in preview that keeps project metadata in the repo16 OctThe new MIT-licensed forge stores issues, discussions and patches as event commits on a repository branch so projects move between instances, serves its terminal UI over SSH, and warns that preview data is deleted before production.
The researchers behind October's kernel bug have published the other half: using that host-memory primitive to find Firecracker in memory, take over a live vCPU thread and redirect its return from KVM to a call of their choosing, with the VM left running and reachable. Their test used Firecracker v1.16.1 with the VMM launched as root and no jailer, and they say a jailer-hardened deployment needs a separate assessment. No new CVE, no vendor advisory and no Firecracker fix appears in the source.
meta.sr.ht before 0.89.0 still accepted POST /register/step2 on instances whose operator had disabled registration: the handler returned the closed message on every error path but did not check the setting on the success path, and a CSRF token lifted from /login made the request work. Email confirmation still applied where SMTP was configured. NVD scores it 5.3 Medium on its primary CVSS 3.1 metric and fixes 0.89.0, and nothing collected shows exploitation.
CVE-2026-115731 (CVSS 4.0 9.4) lets anyone holding a CA-signed agent certificate run code on the Puppet Server by submitting a crafted report, and autosign without strong verification turns that into an unauthenticated chain. CVE-2026-115732 (9.0) accepts a certificate whose name extends or shortens an authorised hostname as that host. OpenVox patched on 3 November with server 9.2.0 and 8.18.0 and agent 9.3.0 and 8.32.0; the NVD records carry Perforce's Puppet Enterprise ranges, and nothing collected shows exploitation in the wild.
Grafana shipped 12.4.14, 13.2.5 and 13.3.0 on 27 October with security lists that do not match: ten CVEs in 13.3.0's security section plus an eleventh fixed in its changelog, four in 13.2.5, three in 12.4.14. The collected records score 4.3 to 6.5, all Medium, and none is Critical.
CVE-2026-110264 is an integer overflow in GitLab's regular expression compiler that could let an unauthenticated user run code on the server. Patches are out for every supported line, with backports to older branches and two threat detections for self-managed instances.
Node.js published v26.12.1, v24.22.1 and v22.23.4 on 21 October with four issues rated high, including a Brotli decoder out-of-bounds write that permits remote code execution and two certificate hostname bypasses. The same releases refresh bundled dependencies, including the eMudhra CA fix.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical unauthenticated RCEs, CVE-2026-109618 and CVE-2026-109619, and the project's own advice is blunt: there are no complete mitigations, updating is the only safe choice.
The PHP security team will publish a security release on Wednesday 21 October at 14:00 UTC with fixes for two vulnerabilities rated CVSS v4.0 9.2. Affected versions, CVE ids and fixed builds come with the release, so the task now is to know which PHP your services run.
A high-severity advisory says an unauthenticated attacker could reach the dashboard, the service and bookmark APIs and the widget proxy on Homepage 2.0.0 through 2.5.0 by supplying a Next.js internal header; 2.6.0 fixes it, and a reverse-proxy rule is the stopgap while you update.
The Rust VMM's first live-migration compatibility guarantee accepts arrivals from v52.0 and v53.0, and the release adds VFIO device migration and migration cancellation, changes two defaults, tightens upgrade checks, and fixes silent data corruption after live migration.
The quarterly Forgejo feature release replaces the action-run webhooks with workflow-run events that cannot be migrated automatically, changes how absolute links resolve in repository documents, and lands as the 16.0 branch nears end of life on 29 October.
The self-hosted deployment platform ships built-in analytics for Traefik and Caddy that store rollups only, an experimental SQLite database service, OIDC sign-in, third-party secret managers, and Cloudflare DNS management.
Two releases in three days: 11.2.0 puts load, disk and uptime on the host card and adds a time filter for logs; 11.3.0 turns container updates into a managed operation that can roll back.
The lightweight monitoring stack now lists pending package updates, tracks Wi-Fi signal strength, checks TLS expiry on HTTPS monitors, and shows systemd logs, with ten first-time contributors in the batch.
Deno's daemon gives you Workers, Durable Objects, KV, Queues, D1 and R2 as open source on your own hardware, with a storage bucket as the only shared state.
Google hands the sandboxed container runtime to the foundation behind Kubernetes: Sandbox status first, the repository leaving the google org, and a maintainers model with Ant Group, Modal and Tines joining.
A major release with three breaking lines for busy instances: Git network operations now go through an internal proxy with new egress settings, Actions can auto-delete old runs, and 32-bit and gogit builds are gone. Audit logging, bot accounts, deploy tokens and admin impersonation lead the features; the security write-up lands in about a week.
One release, six CVEs: privileged overwrites and deletions of host files, an authentication token visible to other users, loose temporary-directory permissions, unfiltered desktop and D-Bus files, and a signal that could kill the desktop environment.
A small release for the self-hosted Docker log viewer where most of the fixes share one theme: untrusted text — container names, log lines, image labels — now gets escaped or sanitized everywhere it could reach beyond plain display.
Selkies 2.0.0 rebuilt every LinuxServer.io desktop container on a new streaming stack: five codecs behind one fallback ladder, WebRTC as a first-class transport, zero-copy capture on X11, and an x86_64 GPU the container configures on its own. Here is the short list of things to change.
An MIT-licensed local AWS emulator that answers on port 4566, with real Docker engines behind the services where fidelity matters, and sibling emulators for Azure, GCP and OCI.
ThreatDown traced a botnet through its own unauthenticated registry, recovered the implants, and found an agent persona that ranks AI API keys above every other secret on the host.
The largest update in a decade replaces the navigation, redesigns Discover, and uses Android's pre-approval install API. The post is candid about what did not come back.
v16.0.5 and v15.0.9, both out 17 September, patch a critical RCE reached by applying a patch, plus a CSRF that could attach an unexpected OpenID identity to a logged-in account.
Four default settings in tigergraph/community:latest compose into command execution as the database's own service account, using no secret that is not already public.
New repositories will default to SHA-256, reftable and the branch name `main`, Rust becomes a required part of the build, and the last 2.x ships as a long-term support release.
Exception-only error monitoring over Postgres 16: change the DSN, get grouped issues, and watch transactions, replay and profiles get dropped at the door.
A 46-patch RFC keeps KVM guests executing on shielded physical CPUs through a host kexec, under a small privileged layer that services their exits while no host kernel and no VMM exist.
Homebrew 7.0.0 ships brew vulns for checking installed packages against an in-house advisory database, fixes eight advisories, sandboxes installs, and moves Intel Macs to Tier 3 with no new bottles.
Portainer 3.0 rebuilds the product around Kubernetes. Community Edition stays on 2.x, Docker environments keep working but stop growing, and the recommended path out is a Docker-to-Kubernetes translator.
Grafana's 15 September releases — 12.4.11, 13.0.9, 13.1.6 and 13.2.2, one per branch — fix a plugin-extraction path traversal that can run code as the Grafana server, plus a Geomap stored XSS.
