Securityzlib 1.4 fixes an 8 MB overwrite and a miniunz that could leave the extraction directory5 Novzlib 1.4, with notes dated 4 November 2026 and published the next day, carries a buffer overflow in non-blocking gzwrite() (CVE-2026-85091), an inflateGetDictionary() overwrite of up to 8 MB past a caller's 32K buffer affecting 1.3.1 and 1.3.2, and minizip fixes including a miniunz that could create directories outside the extraction directory. CVE-2026-4738 in contrib/infback9 comes with the project's own caveat that the critical rating overstates it, and builders face a CMake 3.15 minimum plus libz naming on MSVC and Cygwin. The project's notes are the only source collected here, so no CVSS score is quoted.
SecurityVaultwarden 1.37.5 fixes two private advisories, and its config check now refuses to start2 NovVaultwarden 1.37.5 carries fixes for two Medium advisories, website icons at 5.3 and emergency access at 4.3, both still private pending CVE assignment and publication. The upgrade note that matters most is configuration: invalid values now stop startup with an error rather than being tolerated, the bundled web vault moves to v2026.10.1, and self-served vaults older than v2026.7.1 may have compatibility problems.
Phorion reports a backdoor in the Claude Code for VS Code extension bundle distributed through the Cursor Marketplace, which planted an SSH key, opened a reverse tunnel and installed persistence on macOS, Linux and Windows. Cursor pulled version 2.1.313 from its marketplace and the NPM and VS Code registries. The advisory lists the bundle hash, two key fingerprints and the tunnel server, and a macOS bug blunts the inbound path without removing the persistence.
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, not a Node.js bug. Versions 1.0.3 through 1.2.0 are affected on all platforms, fixed in 1.2.1 or the 1.0.10 and 1.1.1 backports, and the flaw works in both directions. This desk's 22 October Node.js story framed the scope too narrowly, and this is the correction.
Eight eMudhra intermediate CA private keys were single-byte values recoverable from public certificates, so any trust store that still holds them can be forged against. Distributions have shipped ca-certificates updates, and eMudhra has announced it is withdrawing from the global SSL/TLS business.
Seven advisories in v1.37.4, topped by a High-severity organization revocation flaw; the upgrade notes change how proxy client IPs resolve and ask admins to rotate an API key.
Frank Wiles describes a targeted attack that arrived as a normal project inquiry and hid a .git repository whose post-checkout hook fetched and ran an OS-specific binary on branch switch.
The DINUM's SécurixOS is an alpha NixOS build for secure workstations: ANSSI hardening, a custom kernel, FIDO2 login and disk unlock, TPM2 and centralised Secure Boot, and age or Vault for secrets. It is MIT, it is not a fork, and it is not for everyone yet.
Self-managed Kiteworks systems were told to go offline for a window over the weekend after federal threat intelligence warned of an imminent attack. No compromise is known and there is no patch to apply; the customer email and the company's press release disagree on the window.
Aikido found a Go implant in two registry providers and two Go modules. It does nothing unless the SHA256 of two Terraform variables hits one value, then runs a remote-access tool with Slack and Ethereum command channels. Both providers were still listed on Wednesday night.
mathmain ships an encrypted implant that stays dormant until a caller passes one specific matrix to its solver, and the code is missing from the GitHub repository the package links to.
