Patches, advisories and flaws that matter to people running the service.
PyPI's redesigned project pages went live on 6 November with a Security tab that reports a release's provenance: full, none, incomplete, inconsistent, changed or lost. The post is explicit that no provenance does not mean malicious, that it means the file origin cannot be cryptographically verified, and that the states worth checking before you install are the warnings.
The researchers behind October's kernel bug have published the other half: using that host-memory primitive to find Firecracker in memory, take over a live vCPU thread and redirect its return from KVM to a call of their choosing, with the VM left running and reachable. Their test used Firecracker v1.16.1 with the VMM launched as root and no jailer, and they say a jailer-hardened deployment needs a separate assessment. No new CVE, no vendor advisory and no Firecracker fix appears in the source.
Alpine's advisory of 5 November describes a password authentication bypass in sshd built without PAM on musl: an attacker who can reach the SSH port logs in with a very long password as an account whose password field is *, provided another account on the machine has a $5$ or $6$ hash. Upstream OpenSSH 10.6p2 calls it a critical security workaround and puts the root cause outside sshd. Alpine's fixed packages run from edge 10.6_p2-r0 back to 3.16 9.0_p1-r6, the upgrade is not complete until sshd is restarted, and no CVE had been assigned.
meta.sr.ht before 0.89.0 still accepted POST /register/step2 on instances whose operator had disabled registration: the handler returned the closed message on every error path but did not check the setting on the success path, and a CSRF token lifted from /login made the request work. Email confirmation still applied where SMTP was configured. NVD scores it 5.3 Medium on its primary CVSS 3.1 metric and fixes 0.89.0, and nothing collected shows exploitation.
zlib 1.4, with notes dated 4 November 2026 and published the next day, carries a buffer overflow in non-blocking gzwrite() (CVE-2026-85091), an inflateGetDictionary() overwrite of up to 8 MB past a caller's 32K buffer affecting 1.3.1 and 1.3.2, and minizip fixes including a miniunz that could create directories outside the extraction directory. CVE-2026-4738 in contrib/infback9 comes with the project's own caveat that the critical rating overstates it, and builders face a CMake 3.15 minimum plus libz naming on MSVC and Cygwin. The project's notes are the only source collected here, so no CVSS score is quoted.
DSA-6607-1 fixes CVE-2026-109518, found by Max Justicz: an HTTP redirect can leave two package downloads sharing a URI, and resume handling then lets a man-in-the-middle replace a package after verification, running code as root. Debian's tracker lists trixie fixed at 3.0.4 and bookworm at 2.6.2, with forky and sid at 3.3.5 in the package table and 3.3.6 listed only in the fixed-versions table. The same update also addresses out-of-bounds access issues in apt, and neither document carries a severity score.
CVE-2026-115731 (CVSS 4.0 9.4) lets anyone holding a CA-signed agent certificate run code on the Puppet Server by submitting a crafted report, and autosign without strong verification turns that into an unauthenticated chain. CVE-2026-115732 (9.0) accepts a certificate whose name extends or shortens an authorised hostname as that host. OpenVox patched on 3 November with server 9.2.0 and 8.18.0 and agent 9.3.0 and 8.32.0; the NVD records carry Perforce's Puppet Enterprise ranges, and nothing collected shows exploitation in the wild.
Ubuntu's status post puts the CVE-2026-98432 kernel fixes in the -proposed pocket for 22.04, 24.04 and 26.04, with 26.10 already fixed in 7.3.0-10.10, 16.04 through 20.04 still pending, and 14.04 listed as not affected. The post also says plainly that mitigations disabling multipath TCP are not the fix, because the flaw is not specific to MPTCP, and it documents the opt-in install path with the warning that -proposed packages are not upgraded by default.
Vaultwarden 1.37.5 carries fixes for two Medium advisories, website icons at 5.3 and emergency access at 4.3, both still private pending CVE assignment and publication. The upgrade note that matters most is configuration: invalid values now stop startup with an error rather than being tolerated, the bundled web vault moves to v2026.10.1, and self-served vaults older than v2026.7.1 may have compatibility problems.
From 10 February 2027 Let's Encrypt issues 64-day certificates by default, with the last 90-day certificate expiring on 11 May 2027 and no revocation of what is already out there. Clients that follow ACME Renewal Info handle it; hard-coded offsets need to move to about two thirds of the lifetime, and a third-party test in October found one acme.sh version scheduling its renewal after the certificate had already expired.
Phorion reports a backdoor in the Claude Code for VS Code extension bundle distributed through the Cursor Marketplace, which planted an SSH key, opened a reverse tunnel and installed persistence on macOS, Linux and Windows. Cursor pulled version 2.1.313 from its marketplace and the NPM and VS Code registries. The advisory lists the bundle hash, two key fingerprints and the tunnel server, and a macOS bug blunts the inbound path without removing the persistence.
CVE-2026-98432 is a race in the Linux kernel's handling of IPv4 TCP options, where a retransmitted SYN can free a structure another thread is still reading. The record carries a 9.8 critical CVSS v3.1 vector and stable backports, and Anthropic's write-up names it as the kernel bug behind a zero-click chain that reached a root shell on servers with a multipath TCP listener.
Tailscale shipped v1.104.4 on 28 October with fixes for privilege-boundary bugs in Tailscale SSH and three Serve bugs. The flaws were about what a session could do after it was authorised, not who could connect, and Tailscale argues the 'Tailworm' framing overstates them: exploitation needs an existing foothold in the tailnet and SSH permitted by policy.
Grafana shipped 12.4.14, 13.2.5 and 13.3.0 on 27 October with security lists that do not match: ten CVEs in 13.3.0's security section plus an eleventh fixed in its changelog, four in 13.2.5, three in 12.4.14. The collected records score 4.3 to 6.5, all Medium, and none is Critical.
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, not a Node.js bug. Versions 1.0.3 through 1.2.0 are affected on all platforms, fixed in 1.2.1 or the 1.0.10 and 1.1.1 backports, and the flaw works in both directions. This desk's 22 October Node.js story framed the scope too narrowly, and this is the correction.
LiteLLM's 24 October releases sign every Docker image and Helm chart with a new cosign key, remove the eMudhra root CA from its trust bundles, and mark both changes as present in 1.105.4, 1.104.6 and 1.103.8. If you pin the old public key in CI or an admission policy, verification fails until you replace it.
Eight eMudhra intermediate CA private keys were single-byte values recoverable from public certificates, so any trust store that still holds them can be forged against. Distributions have shipped ca-certificates updates, and eMudhra has announced it is withdrawing from the global SSL/TLS business.
CVE-2026-110264 is an integer overflow in GitLab's regular expression compiler that could let an unauthenticated user run code on the server. Patches are out for every supported line, with backports to older branches and two threat detections for self-managed instances.
Node.js published v26.12.1, v24.22.1 and v22.23.4 on 21 October with four issues rated high, including a Brotli decoder out-of-bounds write that permits remote code execution and two certificate hostname bypasses. The same releases refresh bundled dependencies, including the eMudhra CA fix.
A critical IPv4 checksum bug in the Linux kernel lets a guest virtual machine, or any local sender of crafted packets, corrupt the host kernel's memory. The fix is upstream and backported, Red Hat tracks it as an active-exploit case, and there is no mitigation beyond a kernel update.
All seven 1.107.0 wheels installed a credential stealer and a remote-code loader that run on every Python start in that environment, not just when LiteLLM runs. PyPI has removed the release and the affected Docker tags are yanked; anyone who installed it needs to rotate credentials, not just uninstall.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical unauthenticated RCEs, CVE-2026-109618 and CVE-2026-109619, and the project's own advice is blunt: there are no complete mitigations, updating is the only safe choice.
The PHP security team will publish a security release on Wednesday 21 October at 14:00 UTC with fixes for two vulnerabilities rated CVSS v4.0 9.2. Affected versions, CVE ids and fixed builds come with the release, so the task now is to know which PHP your services run.
Four Plex Media Server bugs chain into unauthenticated remote code execution in builds before 1.43.3.10861. Plex announced the fix in September, a public proof of concept landed on 16 October, and one researcher's honeypot logged exploitation the next morning.
A high-severity advisory says an unauthenticated attacker could reach the dashboard, the service and bookmark APIs and the widget proxy on Homepage 2.0.0 through 2.5.0 by supplying a Next.js internal header; 2.6.0 fixes it, and a reverse-proxy rule is the stopgap while you update.
The security release fixes four high-severity advisories and one low, all paths that turn a foothold as the pihole service account or its configuration surfaces into root, and ships hardening that includes a gravity schema migration; every affected version is patched in 6.5.
DSA-6528-1 lands an enormous CVE list in Debian 13's stable kernel. The count is the story: triage, then the reboot.
Seven advisories in v1.37.4, topped by a High-severity organization revocation flaw; the upgrade notes change how proxy client IPs resolve and ask admins to rotate an API key.
The feed reader's security point release strips token access from disabled accounts, guards the updater with POST and CSRF, and bounds ZIP imports against decompression bombs.
Google hands the sandboxed container runtime to the foundation behind Kubernetes: Sandbox status first, the repository leaving the google org, and a maintainers model with Ant Group, Modal and Tines joining.
141 CVEs through September against 13 in 2023, and WebKitGTK at 305: a GNOME security lead argues scanning is now mandatory and that policies banning AI-generated reports will only hide the flaws.
An HTTP/2 proxy crash, streams cut off after a minute of quiet, empty cookie placeholders: the follow-up patch is out less than two days later, with the new Incremental header as the feature.
Frank Wiles describes a targeted attack that arrived as a normal project inquiry and hid a .git repository whose post-checkout hook fetched and ran an OS-specific binary on branch switch.
The first release since June carries fixes for a url_pattern authorization bypass, an HTTPoxy hole in FastCGI, slowloris exposure, a sticky-session timing side channel and a Windows path bypass, plus new matcher and header options.
The point release carries a low-severity fix for a password-policy lock that an empty Save could clear, moves the default hash from bcrypt to argon2id (optional, existing hashes keep working), and takes the outbound NAT page to the legacy plugin without breaking rules.
A rebuilt timeline with type-ahead date navigation, better visits from sparse tracker data, Panoramax street photos on your tracks, and the admin-rights setup bypass fixed in v5.3.2 that is worth confirming you have.
One release, six CVEs: privileged overwrites and deletions of host files, an authentication token visible to other users, loose temporary-directory permissions, unfiltered desktop and D-Bus files, and a signal that could kill the desktop environment.
The self-hosted ebook library turns four access-control problems into admin-only territory — a cross-user Kobo token flaw, unauthenticated service pages, spoofable internal endpoints and a guest-reachable EPUB fixer — and rewrites Kobo sync so large libraries stop spending up to 15 seconds per request.
A small release for the self-hosted Docker log viewer where most of the fixes share one theme: untrusted text — container names, log lines, image labels — now gets escaped or sanitized everywhere it could reach beyond plain display.
Seven days after the nine-fix 15.5 release, the follow-up patches a session-token prefix oracle that let a low-privilege user recover any active session's full token, a logs-view XSS, and a recursive-resolver regression that broke resolution for some domains.
Self-managed Kiteworks systems were told to go offline for a window over the weekend after federal threat intelligence warned of an imminent attack. No compromise is known and there is no patch to apply; the customer email and the company's press release disagree on the window.
ThreatDown traced a botnet through its own unauthenticated registry, recovered the implants, and found an agent persona that ranks AI API keys above every other secret on the host.
Aikido found a Go implant in two registry providers and two Go modules. It does nothing unless the SHA256 of two Terraform variables hits one value, then runs a remote-access tool with Slack and Ethereum command channels. Both providers were still listed on Wednesday night.
The DNS server's release notes read like an advisory first: nine vulnerability fixes, most credited to outside researchers, with LDAP logins and a zone file editor alongside.
A DNSKEY whose owner pointer compresses into its own RDATA overflows the digest buffer; the advisory rates it denial of service and possible remote code execution, and 1.26.1 fixes it.
v16.0.5 and v15.0.9, both out 17 September, patch a critical RCE reached by applying a patch, plus a CSRF that could attach an unexpected OpenID identity to a logged-in account.
Nine minutes of downloads in May, four months of quiet, and an incident report that names the kept-alive account and the compromised laptop behind it.
Four default settings in tigergraph/community:latest compose into command execution as the database's own service account, using no secret that is not already public.
The bug needs a theme with a top-level `page-` directory and a readable local `.php` file, and the official PHP Docker image supplies the second half.
A rootless sandbox shaped like a virtualenv: its own home, its own namespaces, no capabilities, built for coding agents run with `--dangerously-skip-permissions`.
mathmain ships an encrypted implant that stays dormant until a caller passes one specific matrix to its solver, and the code is missing from the GitHub repository the package links to.
Grafana's 15 September releases — 12.4.11, 13.0.9, 13.1.6 and 13.2.2, one per branch — fix a plugin-extraction path traversal that can run code as the Grafana server, plus a Geomap stored XSS.
