Signal
41 articles covering "security"
Kyverno 1.18 patches two flaws in its HTTP-based policy execution, blocks loopback and metadata addresses by default, and flags ClusterPolicy for deprecation later this year.
Node.js shipped v22.23.0, v24.17.0 and v26.3.1 on June 18, fixing 12 CVEs including two high-severity WebCrypto and TLS flaws. Node 20, EOL since April, gets no patch.
The June 10 release adds gRPC server and client support, an InetAddressFilter to block SSRF, and a Kotlin 2.3.21 baseline.
GitHub is embedding permanent owner and repository IDs into Actions OIDC subject claims, with the new format becoming the default for repos created after July 15, 2026.
rsync 3.4.4, released June 8, repairs regressions introduced by the May 20 security update that patched six CVEs, after a debate over the maintainer's AI-assisted test-suite rewrite.
The maintenance release folds in fixes from Scala's first external security audit, which found no critical or major issues but flagged a stored XSS in Scaladoc and an infinite loop in TASTy parsing.
Rust 1.96.0, released May 28, resolves a decade-old ergonomics gap with Copy-implementing range types from RFC 3550, stabilizes assert_matches!, tightens WebAssembly linking, and patches medium and low Cargo vulnerabilities affecting third-party registry users.
RHEL 10.2 and 9.8, released May 20, add ML-KEM post-quantum SSH, kernel livepatching without reboots, the goose AI CLI tool, and extensive language stack updates.
The May 2026 major release hardens the BEAM runtime's security posture with quantum-resistant cryptography defaults and disabled SSH shell access, while adding experimental native records to the language for the first time.
OpenSSL 4.0.0 landed on April 14 as the library's first major version bump since 2018, adding ECH, post-quantum hybrid key exchange, and removing the legacy engine API and SSLv3.
PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 landed May 14, fixing 11 security flaws and over 60 bugs, with four CVEs rated 8.8.
CVE-2026-45185, found by XBOW's Federico Kirschbaum and patched in Exim 4.99.3, lets an unauthenticated SMTP client corrupt the heap via a TLS close_notify during a CHUNKING transfer.