Cybersecurity
357 articles RSS
Ubuntu Plans Effectively Weekly Kernel Releases, Oracle Moves Toward Monthly Java Updates, and Four Debian Kernel Advisories Differ Widely in Size
Canonical and Oracle link shorter security-update intervals to AI-assisted bug discovery; Debian's four kernel advisories since September 29 list 3 to 1,313 CVE IDs, and one CVE reached Ubuntu 25 days after Debian's advisory (Herald counts).
MongoDB Fixes CVE-2026-118383, Which It Scored 9.5: Datadog Crashed a Lab Replica Set Primary With Unauthenticated Requests and a Forced Failover
MongoDB's CVE record lists seven fixed releases and says code execution may be possible under certain conditions. Datadog crashed a lab 8.0.34 primary with unauthenticated requests and a forced failover, without code execution.
Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a mod_http2 flaw rated critical; Red Hat cites public exploit research, Wiz said none was available
Apache's advisory credits Anthropic's OSS Scanner and two Google Cloud researchers for CVE-2026-119618 in HTTP Server 2.4.55 through 2.4.70; Red Hat and Wiz gave different accounts of whether an exploit was public.
Aikido and StepSecurity Say Stolen GitHub Credentials Have Been Used Since November 10 to Push the wfx CI Secret Stealer; Their Counts Differ
Aikido and StepSecurity say stolen GitHub credentials have pushed a CI secret stealer since November 10; their counts differ and no cited source says how the credentials were obtained.
Git 2.56.1 and Six Backport Releases Fix Six CVEs, Including CVE-2026-111760, Which Can Run Attacker Code During Recursive Clones
Git 2.56.1 and backports to the 2.50 through 2.55 series fix six CVEs announced November 10, 2026; Git for Windows 2.56.1 was published at 22:13 UTC that day.
Attackers Used Ethersphere's Release Automation to Publish bee-js 13.3.0 and Swarm Desktop 0.56.2, Which Fetch Code Built to Steal Swarm Wallet Keys
The Hacker News reports bee-js 13.3.0 (npm) and Swarm Desktop 0.56.2 (GitHub) were published via Ethersphere's own automation on Nov 9, 2026; both run a loader for code built to steal Swarm node wallet keys. 0.56.3 replaces 0.56.2.
VulnCheck Honeypots Saw CVE-2026-58115 Exploited via Node-RED on October 30; Siemens-Sourced NVD Record Now Names Four IoT2050 Models, Up From One
Honeypots run by VulnCheck logged exploitation of CVE-2026-58115 between October 30 and November 1. The Siemens-sourced CVSS 10.0 NVD record names four IoT2050 models; GitHub's August copy named one.
RunSybil Says a CPython Bug Lets Chat Templates Escape Jinja Sandboxes; Python Security Team Does Not Consider the Escape a CPython Vulnerability
RunSybil says a CPython memory bug lets model chat templates escape Jinja sandboxes; Python's security team does not consider the demonstrated escape a CPython vulnerability. The crash fix shipped in 3.13.16, 3.14.8 and 3.15.0 release candidate 2.
Where Coding Agents Leave Secrets: A CI Prompt Injection, Saved Claude Code Approvals and AI-Driven GitHub Searches, as Reported in 2026
Three 2026 reports describe secrets exposed by a CI coding agent, saved in Claude Code approval files in public repositories, and sought by an agentic framework on GitHub; the sources agree on rotation but differ in scope and evidence.
LXD and MicroCloud Fix CVE-2026-112816, Rated CVSS 10.0, Which Let a Client Pose as a Trusted Client Without Its Private Key; Incus Also Fixes It
Canonical's LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15 and MicroCloud 3.4.1 and 2.1.5 fix a TLS certificate-chain flaw; CISA's entry in the CVE record, dated October 30, lists exploitation as none. Incus fixed it in 7.6.0.
Glow Labs Says Coding Agents Appear to Pick Archived MCP Servers From Training Data; No Fix Is Coming for a Reported Puppeteer Flaw
Per Help Net Security, Glow Labs says agents appear to take the package name from training data in 98% of sessions where a deprecated MCP server was installed or suggested.
eMudhra CA Compromise: uv Shipped Fixes October 20 and 21, an AWS CLI Fix Merged October 21, Azure CLI's certifi Pin Changed in 2.92.0 on November 3
A comparison of how uv, pip, CPython, the AWS CLI and the Azure CLI handled the compromised eMudhra intermediate CAs, drawing on release notes, pull requests, Mozilla and Cloudflare.