Cybersecurity
357 articles RSS
Argo CD 3.5.4, 3.4.10 and 3.3.15 Fix Eight Advisories, Four Rated Critical at CVSS 9.9, Including Repo-Server Command Execution and File Reads
The Argo CD project released patched versions on October 6, 2026 covering eight security advisories; GitHub lists four as Critical with a 9.9 CVSS score. Older minor lines get no patch.
StepSecurity Says GhostAction Pushed Credential-Stealing Workflows to 345 Repositories via Two Hijacked Maintainer Accounts on October 8
StepSecurity says two hijacked maintainer accounts, including Uber athenadriver's author, pushed a credential-stealing workflow to 345 repositories on October 8; Socket counts 500+ accounts.
Checkmarx and CloudSEK Detail MALFEX, an npm Campaign With Eight Malicious Packages and 40,767 Downloads, Three of Them Still Live
Researchers say a lone operator published 12 npm packages since August 2023, eight malicious; Checkmarx found three still installable on September 29 with incomplete advisory coverage.
Django 6.1.2, 6.0.9 and 5.2.18 Patch Four CVEs, Including a Header-Parsing Denial of Service and Formset Privilege Abuse
The Django project's October 6 security releases fix one low and three moderate issues, plus a bypass of an earlier nested-geometry mitigation; the post lists severity but no CVSS scores.
Gradle 9.8.1 Patches Three High-Rated Vulnerabilities, Two Involving Unsafe Java Deserialization in Its Build Daemon Channels
Gradle 9.8.1 fixes three high-rated flaws: two Java deserialization bugs in daemon communication and an SSL-failure repository fallback, plus three 9.8.0 regressions.
Tensorlake npm Package Compromised With a Shai-Hulud Worm That Targets AI Tool Configs and Wipes Home Directories If Stolen Tokens Are Revoked
StepSecurity and Socket report that tensorlake@0.5.144 on npm steals credentials and AI-tool configs, and installs a monitor that deletes files if a stolen GitHub token is revoked.
Google Pauses Product Vulnerability Rewards in Its Open-Source Bug Bounty, Citing a Rise in Automated Submissions
Google's Open Source Software Vulnerability Reward Program stopped accepting product vulnerability reports as of October 1, 2026, with an update promised in Q1 2027.
OpenSSH 10.6 Disables LZ77 Compression Over a Plaintext-Recovery Attack, Enables Hybrid Post-Quantum Signatures and Deprecates scp -R
OpenSSH 10.6 disables the LZ77 coder in ssh and sshd to mitigate a CCS 2026 compression side channel, enables ssh-mldsa44-ed25519 signatures, and starts deprecating scp -R.
Socket Links Two Malicious VS Code Themes With Thousands of Installs to the GlassWorm Campaign
Socket reports two malicious VS Code themes in a GlassWorm-linked cluster, one hiding a Windows downloader and one a Solana-resolving loader, months after a coordinated takedown.
Atlassian Patches Critical CVE-2026-21589 File-Read Flaw Across Bitbucket, Jira, Bamboo and Five Other Data Center Products
Atlassian disclosed CVE-2026-21589, a 9.3-rated path traversal letting unauthenticated attackers read known files in eight self-hosted products, with fixes listed for each.
Wasmtime 49.0.2 and 48.0.4 Fix Eight Advisories, Led by a Critical Stack Overflow in Async Component Callbacks
The Bytecode Alliance patched eight Wasmtime advisories on October 2, including a critical 9.3 CVSS stack buffer overflow that lets a guest write about 16KB to the host's native stack.
pgvector 0.8.7 Fixes an IVFFlat Index-Build Buffer Overflow, CVE-2026-103484, That Can Lead to Arbitrary Code Execution
pgvector 0.8.7 fixes CVE-2026-103484, a buffer overflow in IVFFlat index builds affecting 0.8.6 and earlier; users are urged to upgrade.