Astro 5.x has no patched release for GHSA-26w7, a critical AVIF image RCE. The fix starts at 7.2.8; the upgrade PR moves 5.18.1 to 7.4.2 and picks up the @astrojs/node SSRF fix.
Railway’s October build-system intrusion reached encrypted environment variables, potentially exposing AI provider API keys for about 100,000 workspaces.
Cloudflare shipped emergency WAF rules all October, then put its Brotli and Next.js CVE detections in Log mode. The timeline shows why.
A lab report found root-level lateral movement in Tailscale SSH; the chain needs an approved device and forwarding. Updated Oct 28: fixed in 1.104.4+.
A practical CASB deployment guide covering proxy versus API modes, framework mapping, and audit evidence for securing SaaS applications.
Two CVSS 9.0 KSMBD RCE reports and three other kernel bugs were Cc’d to public lists before fixes, with reproducers. Here is what is exposed.
Node.js’s bundled Brotli decoder can write out of bounds on malformed input. Imperva demonstrated code execution; patch 22.23.4, 24.22.1, or 26.12.1.
Seven HTTP/3 stacks mishandled QPACK decoded-header limits, letting a small request exhaust server memory. Here is what to patch and how to check exposure.
LiteLLM 1.107.0 shipped a credential stealer and hourly backdoor to PyPI. Here is what was in the wheels, how the build was hijacked, and what to do now.
A New Mexico judge ordered Meta to pay $25 billion over the Cambridge Analytica scandal, the largest state verdict yet against the company.
PHP shipped emergency fixes for two critical RCE flaws rated CVSS 9.2. Details leaked early, so patch supported 8.x branches and inventory runtimes now.
eMudhra’s intermediate CA revocation left a trust-store gap: browsers blocked the keys fast, but runtimes and API clients lagged behind. Here’s the audit.