Cybersecurity
357 articles RSS
Angular Patches Four Server-Side Rendering Advisories in Eight Days, Three Rated High, Across Versions 20, 21 and 22
Angular's maintainers published four GitHub advisories between September 23 and October 1 covering router and platform-server flaws in server-side rendering, three rated High.
Truffle Security Finds 543,699 Credentials Still Valid in Public GitHub Repositories, With a Median Exposure of 784 Days
A scan of 224 million public repositories found 543,699 working credentials; GitHub push protection cut protected-type leaks by 53 percent but 51.8 percent of live secrets fall outside it.
Redis Patches ACL Transaction Bypass and Unauthenticated Cluster Bus Across Five Release Branches
Redis 8.10.2, 8.8.3, 8.6.7, 8.4.7 and 8.2.10 ship security fixes; four close an ACL key-check gap at EXEC, and all add an opt-in refusal for unauthenticated cluster buses.
GitLab Patches Critical Self-Hosted AI Gateway Flaw CVE-2026-90970, a CVSS 9.9 Prompt-Template Sandbox Escape
GitLab fixed CVE-2026-90970, a CVSS 9.9 flaw that let authenticated Duo Agent Platform users escape a prompt template sandbox on self-hosted AI Gateways.
Dutch Vulnerability Disclosure Nonprofit DIVD Says Two Zammad Zero-Days Enabled an AI-Agent-Driven Breach
DIVD says attackers chained two Zammad zero-days (CVE-2026-102489, CVE-2026-102490) and used an automated AI agent; volunteer data was exposed.
OpenSSL Patches 14 Vulnerabilities in 4.0.3 and Backports, Led by a High-Severity DTLS Heap Disclosure Flaw
OpenSSL's 29 September 2026 advisory covers 14 CVEs, one High-severity DTLS flaw that can leak heap memory, one Moderate and 12 Low; fixes ship in 4.0.3, 3.6.5, 3.5.9 and 3.4.8.
Next.js 16.3.8 and 15.5.27 Patch Seven Vulnerabilities, Including a High-Severity Image Optimizer SSRF, While Two Others Slip
Vercel's Next.js team released 16.3.8 and 15.5.27 fixing one high, five medium and one low severity flaw; a critical and a high fix were postponed over upstream delays.
Official MCP Python SDK OAuth Flaw Lets Malicious Servers Steal Client Secrets, Fixed in 1.30.0 and 2.2.0
A high-severity flaw in the official MCP Python SDK let a malicious server redirect OAuth credentials to an attacker's endpoint; fixes ship in 1.30.0 and 2.2.0, with extra steps needed.
Citrix Confirms Exploitation of Two Critical NetScaler RCE Flaws, CVE-2026-88771 and CVE-2026-88772, as CISA Adds Both to KEV Catalog
Citrix confirmed exploitation of two critical NetScaler ADC and Gateway flaws, both CVSS v4 9.5, and shipped fixes; CISA added both to its KEV catalog as of September 27, 2026.
Two GitHub Actions Disabled Since May's Mini Shai-Hulud Compromise Came Back Online in September, Reactivating Malware With No New Attack
Socket found that actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled since May 2026, became reachable again on September 16 with their malicious tags intact, silently re-running the payload.
Vercel Patches Critical Next.js ImageResponse RCE Traced to a Satori SVG-Escaping Flaw
Vercel shipped Next.js 16.3.6 to fix a critical, 9.5-rated remote code execution flaw in ImageResponse rooted in a Satori SVG-escaping bug, CVE-2026-94545.
Cloudflare Discloses Cross-Tenant Disk Data Leak in Containers and Sandboxes, Finds No Evidence of Exploitation
A bug-bounty researcher showed a paying Cloudflare Containers customer could recover up to 60 KB of leftover disk data from other customers' deleted containers; Cloudflare says it found no evidence of exploitation.