Cybersecurity
357 articles RSS
Wiz Says Gheist Campaign Uses Stolen GitHub Tokens to Print Repository Secrets Into Actions Logs, Succeeding in Private Repositories
Wiz Research says the Gheist campaign planted workflows from more than 850 compromised GitHub accounts; GitHub's approval hold covers only public repositories on github.com.
curl Moves Minor Vulnerability Reports Public and Gentoo Seeks Sponsors, Weeks After EU Cyber Resilience Act Reporting Duties Began
Comparing curl's switch to public handling of LOW and MEDIUM reports, Gentoo's sponsor search and the EU CRA reporting regime, using the Commission, The Register, FOSS Force and curl's maintainer.
LiteLLM Revises Its 1.107.0 Breach Account, Tracing Entry to a Master Key Committed in May; Socket Finds Secret-Stealing Workflows Ran October 10
LiteLLM's root-cause analysis says an Agent Platform master key committed on May 27 and never revoked led to the 1.107.0 compromise, replacing its earlier log-leak theory; GitHub commits show exfiltration workflows on October 10 and 12.
Go Blocks Trust in Compromised eMudhra Intermediate CAs Under CVE-2026-111943, and Cilium, Terraform and OpenTofu Ship Releases
Go 1.26.10 filters certificate chains through a set of eMudhra intermediates; Cilium, Terraform and OpenTofu have since released builds, and the Go thread debates the hardcoded approach.
Pillow 13.0.0 Fixes Two Maintainer-Rated Critical Flaws and an EPS Filename Bug, CVE-2026-112900, That Can Reach Ghostscript Command Execution
Pillow 13.0.0, released October 16, fixes 40 advisories published October 17, including two rated critical and an EPS filename argument injection in the Ghostscript call.
Sandboxes and Permission Modes Versus Repository-Borne Attacks: What Three Reports on AI Coding Agents Show About Where Defenses Apply
Reports on GitSpawn, Plugin4Shell and IssueTrojanBench place attacks before, outside or inside the boundaries that Copilot sandboxing and Claude Code permission modes describe.
Dependency Cooldowns Spread From pnpm and pip to Bundler, Dependabot and GitHub's Package Firewall While Critics Question the Approach
Sources describe package-install delays appearing in pnpm, pip, Bundler, Dependabot and GitHub's firewall with differing defaults, alongside an LWN-reported dispute over cooldowns versus upload queues.
Docker Updates PHP Official and Hardened Images After the PHP2Shell Flaws, Moving the Four Supported Branches to 8.2.35, 8.3.36, 8.4.27 and 8.5.12
Docker says its PHP Official Images and Hardened Images were updated after CVE-2026-109618 and CVE-2026-109619; the DHI refresh landed within 24 hours of the upstream patches.
Ruby 4.0.9, 3.4.12 and 3.3.13 Fix Regexp Compiler Bugs Behind Four GitLab CVEs, and the Ruby Project Has Not Requested CVE IDs of Its Own
Ruby's October 23 releases fix Onigmo regular expression bugs that GitLab found could lead to remote code execution; Ruby says it has not requested CVE identifiers for them.
LiteLLM Says Stolen GitHub CLI Tokens and a Lookalike Repository Were Used to Publish Malicious 1.107.0 Releases to PyPI and Docker
LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer and backdoor; the project says attackers used stolen GitHub CLI tokens and a lookalike repository to publish it.
OpenCode Says a Distillation Attack Exposed Stored Provider API Keys for 1.4% of Console Users
OpenCode told 1.4% of Console users to revoke OpenAI, Anthropic and Google keys saved there; the company has not said how the attack worked.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 Fix Two Critical Unauthenticated RCE Flaws, CVE-2026-109618 and CVE-2026-109619
PHP's security release names the two CVSS 9.2 flaws as CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state), fixed in four branches.