Cybersecurity
357 articles RSS
OCaml 5.5.2 Fixes Six OSEC Advisories, Including Marshal Demarshaling and Windows Command Quoting; Each Advisory Credits Anthropic as Reporter
OCaml 5.5.2, tagged October 23, 2026, fixes six OSEC advisories in Str, Unix.map_file, Marshal, Windows command quoting and runtime_events, plus four other bugs including two miscompilations.
Cursor Says Malicious Anthropic.claude-code Versions 2.1.312 and 2.1.313 Were Offered in Its Marketplace and Tried to Install an SSH Backdoor
Cursor says modified Claude Code extension versions 2.1.312 and 2.1.313 were available in its VS Code extension marketplace on October 29 and tried to install an SSH backdoor; it says Anthropic did not develop them and reports it removed them and rotated keys.
psqlODBC 18.00.0006 Fixes Vulnerabilities Including an SQL Injection in SQLSpecialColumns and Several Buffer Overflows; All Earlier Releases Affected
The PostgreSQL ODBC project released psqlODBC 18.00.0006 on November 2; its changelog lists CVE-2026-120057 through CVE-2026-120067 and says all earlier releases are affected.
Hacktron Reports a GNU Savannah Flaw That Could Have Given Push Access to Bash, and Says the FSF Fixed 26 Vulnerabilities in the Forge
Hacktron's write-up says a shell injection in the Savane forge software behind GNU Savannah, reported to the FSF on May 11, 2026, could have been chained to push access to Bash; the firm says it did not touch the repository.
Pluto Security Says a Hugging Face Cryptomining Campaign Returned With 19 More Repositories, Its Flagship Model Scanning Clean
Pluto Security counts 31 malicious Hugging Face repositories in two waves that abuse trust_remote_code to run a miner; the second-wave flagship model scanned clean and reached 28,412 downloads.
.NET 8.0.33, 9.0.22 and 10.0.14 Ship Out-of-Band Fixes for a Brotli Buffer Overflow, CVE-2026-111497, Alongside .NET 11 Release Candidate 3
Microsoft's out-of-band .NET release fixes CVE-2026-111497 in Brotli decompression and a Linux tarball ownership flaw, and re-releases two advisories the October 13 release did not fully address.
Dependabot Reachability Analysis Enters Public Preview for JavaScript and TypeScript, Labeling Alerts With Four Verdicts
GitHub says Dependabot reachability analysis is in public preview on Enterprise Cloud for JavaScript and TypeScript, using CodeQL call graphs to give each open alert one of four verdicts.
Apache Kafka's CVE List Shows 12 Entries Announced October 28, Including a JWT Signature-Verification Skip and Broker Memory-Allocation Flaws
Apache Kafka's CVE page dates 12 entries to 28 Oct 2026, covering OAUTHBEARER validation, broker and Streams memory allocation, and Connect REST exposure; fixed-version lists differ by entry.
Next.js 16.4.1 and 15.5.28 Fix Two Critical RCE Advisories and a High-Severity DoS, Including Two Fixes Postponed From September
Next.js published an out-of-band update on October 14 for two critical unauthenticated RCE advisories and one high-severity DoS, and has announced a November 3 release of seven medium fixes.
Disclosure Rules Shift Around AI-Found Bugs: Kernel Docs Say Treat Them as Public, GNOME Ended Its Bounty, Google Paused OSS Rewards
Kernel docs, GNOME, Google, Go and PHP each handled AI-found vulnerabilities differently in October, from report volume to CVE assignment and embargo timing.
Erlang/OTP 29.1.2, 28.5.0.8 and 27.3.4.19 Fix TLS, X.509 and httpc CVEs, and 29.1.2 Also Fixes an erl_tar Infinite Loop
Three Erlang/OTP patch packages dated October 14, 2026 list four shared CVEs; 29.1.2 adds a fifth, a denial-of-service in erl_tar that also affects Hex and rebar3 copies.
Redis and Valkey Each Ship Security Releases for a Cluster PUBLISH Heap Buffer Overflow on Messages Over 4 GB; Valkey Scores Its Advisory 8.8
Redis released seven security patches and Valkey five on October 26; Valkey's advisory GHSA-f4q9-j22m-xqq9 names an integer truncation and lists a CVSS score of 8.8.