6 stories
incident · vulnerabilities External source
GeoNode’s maintainer reports command execution through crafted vector-upload layer names. Its advisory lists versions through 5.0.1 as affected. GitHub’s reviewed database lists 5.1.0 as fixed, while the maintainer’s patched-version field remains unset.
incident · vulnerabilities External source
The Chainguard kaniko fork’s advisory describes Azure access-token exposure when untrusted Dockerfiles or build arguments reference lookalike registry hosts and an Azure identity is available. Its bundled credential helper can send a token to an attacker-controlled registry.
incident · vulnerabilities External source
Rails’ November 4 advisory describes arbitrary file writes during attachment analysis when Active Storage uses ImageMagick, accepts untrusted uploads, and lacks a restrictive coder policy. Disk-backed storage can also expose files readable by the app.
incident · vulnerabilities External source
CVE-2026-98432 affects Linux IPv4 TCP connection handling. Aikido reports a demonstrated remote-root exploit against an MPTCP listener; that condition should guide urgent exposure checks without being treated as the full boundary of the flaw.
incident · vulnerabilities
The PHP project released security updates for two engine flaws tracked as CVE-2026-109618 and CVE-2026-109619. Under the conditions described by the PHP Foundation, an unauthenticated request can reach code execution. This is a major runtime vulnerability, not a compromise of PHP packages or its release process.
incident · vulnerabilities
The Node.js project rates CVE-2026-111497 high severity. Malformed Brotli data can drive an out-of-bounds write when an application decompresses attacker-supplied input through node:zlib. The affected supported release lines are 22.x, 24.x and 26.x. This is a runtime vulnerability, not evidence that Node.js distribution was compromised.