Cybersecurity
357 articles RSS
Node.js Security Releases 26.12.1, 24.22.1 and 22.23.4 Fix Ten CVEs, Four Rated High Including a Brotli Decoder Out-of-Bounds Write
Node.js published its October 21 security releases for the 26.x, 24.x and 22.x lines: ten CVEs, four rated High, plus c-ares, Undici and certificate updates.
Hijacked Maintainer Accounts and Reclaimed Repository Names: What October's GhostAction, OVHcloud and npm Cases Show About Release Controls
Comparing three October 2026 cases, GhostAction, the OVHcloud CLI release swap and npm's SlugFest trusted-publishing gap, on how accounts, names and release settings were exploited.
PHP Pre-Announces October 21 Security Release for Two Critical Vulnerabilities Rated CVSS v4.0 9.2
The PHP security team says a release due October 21 at 14:00 UTC fixes two critical vulnerabilities, both CVSS v4.0 9.2, and urges users to prepare to upgrade.
Istio 1.31.2, 1.30.6 and 1.29.9 Patch an AuthorizationPolicy Method-Case Bypass Over HTTP/2 and an Ambient-Mode istiod Crash
Istio's patch releases fix a High-severity AuthorizationPolicy bypass over HTTP/2 (CVSS 7.4) and a mesh-wide istiod crash in ambient mode (CVSS 7.7), per GitHub advisories.
GitHub Puts a Package Firewall in Public Preview for Enterprise Cloud, Screening npm Installs With a Default One-Day Cooldown
GitHub's package firewall, in public preview for Enterprise Cloud, checks npm downloads against malware advisories, attestation changes and a minimum package age; only npm is supported.
OVHcloud CLI Releases Hijacked Through a Contributor's GitHub Account, With Swapped Binaries Live for Up to 94 Minutes
An attacker replaced download archives on five OVHcloud CLI releases on October 19; a customer's pinned SHA-256 caught it, and OVHcloud had not enabled GitHub's release immutability.
Grafana 13.2.4, 13.1.8, 13.0.11 and 12.4.13 Fix Four Medium-Severity CVEs Covering Git Sync, Prometheus Rule Conversion and Azure Monitor
Grafana's October 13 patch releases fix four CVEs rated Medium (CVSS 5.3 to 6.5) in Git Sync, the Prometheus rule conversion API and the Azure Monitor data source.
Bloom Security's SlugFest Research Says Over 1,500 npm Packages Were Open to Hijacking via Trusted Publishing; GitHub Now Expires Unvalidated Configs
Bloom Security says SlugFest let attackers claim freed GitHub slugs to publish to over 1,500 npm packages; GitHub now expires unvalidated trusted publishing configurations after 48 hours.
Go 1.27.2 and 1.26.9 Ship Security Fixes Including an HTTP/2 Server Crash and a CONNECT Response-Poisoning Bug in net/http
Go's October 8 point releases include security fixes to the go command, crypto/tls, html/template, net/http, net/textproto and os; Go's vulnerability database details four of the CVEs.
Node.js Pre-Announces October 21 Security Releases for 26.x, 24.x and 22.x With a Highest Severity of High, as 26.12.0 and 24.22.0 Ship
Node.js says new 26.x, 24.x and 22.x releases will land on or shortly after October 21 to fix vulnerabilities, highest severity High; 26.12.0 and 24.22.0 shipped October 14.
Malicious AUR Packages Impersonating yay and paru Run a Remote Script as Root, Raising a Fresh Alarm Over the Arch User Repository
An account named marchos1as uploaded typosquatted yay and paru lookalikes to the AUR; their install scriptlets ran a downloaded script as root before maintainers banned the account.
npm Trusted Publishing Configurations Now Expire After 48 Hours Unless Validated, and issue_comment Tokens Are Rejected
GitHub says unvalidated npm trusted publishing configurations now expire 48 hours after creation, and npm now rejects trusted publishing tokens from GitHub Actions issue_comment events.