security

Rust 1.96.0, released May 28, resolves a decade-old ergonomics gap with Copy-implementing range types from RFC 3550, stabilizes assert_matches!, tightens WebAssembly linking, and patches medium and low Cargo vulnerabilities affecting third-party registry users.

RHEL 10.2 and 9.8, released May 20, add ML-KEM post-quantum SSH, kernel livepatching without reboots, the goose AI CLI tool, and extensive language stack updates.

The May 2026 major release hardens the BEAM runtime's security posture with quantum-resistant cryptography defaults and disabled SSH shell access, while adding experimental native records to the language for the first time.

OpenSSL 4.0.0 landed on April 14 as the library's first major version bump since 2018, adding ECH, post-quantum hybrid key exchange, and removing the legacy engine API and SSLv3.

PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 landed May 14, fixing 11 security flaws and over 60 bugs, with four CVEs rated 8.8.

CVE-2026-45185, found by XBOW's Federico Kirschbaum and patched in Exim 4.99.3, lets an unauthenticated SMTP client corrupt the heap via a TLS close_notify during a CHUNKING transfer.

Next.js 15.5.18 and 16.2.6 land with a 13-advisory bundle covering a React Server Components DoS (CVE-2026-23870), middleware-bypass routes, SSRF, and cache poisoning; Vercel says the WAF cannot reliably block them.

An integer overflow in PgBouncer's SCRAM packet parser lets unauthenticated attackers crash the pooler, and three more flaws ship in the same release. Debian stable, testing, and pre-release archives are all still vulnerable.

Israeli security firm RedAccess says vibe-coding platforms ship apps that default to public, exposing medical, financial and corporate data to anyone who can find them.

CVE-2026-43284 and CVE-2026-43500 chain two page-cache write primitives in IPsec ESP and rxrpc to give unprivileged users root on every major Linux distribution shipped in the last nine years.

Vim 9.2.0435 fixes an OS command injection in :find completion where backtick-enclosed shell commands inside the path option ran during Tab completion, with a modeline-set path enabling exploitation by simply opening a malicious file.

Apache HTTP Server 2.4.67 fixes CVE-2026-23918, a double-free in mod_http2 that triggers on early stream reset and may enable remote code execution on Debian-default builds.