security

Next.js 15.5.18 and 16.2.6 land with a 13-advisory bundle covering a React Server Components DoS (CVE-2026-23870), middleware-bypass routes, SSRF, and cache poisoning; Vercel says the WAF cannot reliably block them.

An integer overflow in PgBouncer's SCRAM packet parser lets unauthenticated attackers crash the pooler, and three more flaws ship in the same release. Debian stable, testing, and pre-release archives are all still vulnerable.

Israeli security firm RedAccess says vibe-coding platforms ship apps that default to public, exposing medical, financial and corporate data to anyone who can find them.

CVE-2026-43284 and CVE-2026-43500 chain two page-cache write primitives in IPsec ESP and rxrpc to give unprivileged users root on every major Linux distribution shipped in the last nine years.

Vim 9.2.0435 fixes an OS command injection in :find completion where backtick-enclosed shell commands inside the path option ran during Tab completion, with a modeline-set path enabling exploitation by simply opening a malicious file.

Apache HTTP Server 2.4.67 fixes CVE-2026-23918, a double-free in mod_http2 that triggers on early stream reset and may enable remote code execution on Debian-default builds.

CVE-2026-31431, discovered by Theori using its AI scanner Xint Code, lets unprivileged users root Ubuntu, Amazon Linux, RHEL, and SUSE through a logic flaw in the kernel's crypto subsystem.

GitLab's April 16 release graduates a security agent that opens ready-to-merge fixes for confirmed SAST findings, ships a beta CI pipeline agent and a generally available analytics agent, and gives administrators enforceable monthly caps on Duo Agent Platform credits.

GitLab's April release adds a CI Expert Agent that generates pipelines from repository analysis, moves Agentic SAST vulnerability resolution to GA, and delivers natural-language DevOps analytics.

pnpm 11's release candidate ships minimumReleaseAge=1 day, blockExoticSubdeps, and strictDepBuilds as defaults, baking lessons from the March 2026 Trivy and axios attacks into the package manager itself.

Kubernetes v1.36, releasing April 22, brings accelerated SELinux volume labelling to GA, expands Dynamic Resource Allocation for AI hardware, and permanently removes the insecure gitRepo volume driver.

A test aboard the research vessel Haiyang Dizhi 2 demonstrated a compact, self-contained actuator capable of cutting undersea structures more than two miles down, raising fresh concerns about the resilience of the cables that carry 95 percent of intercontinental internet traffic.