Latest security news

A More Reliable Compilation Scheme for Kotlin Multiplatform Modules

The current compilation approach to Kotlin Multiplatform projects works, but sometimes can lead to unexpected or hard-to-predict behavior. For example: With Kotlin 2.5.0-Beta1, we introduced an optional “separate compilation” approach to KMP that solves both problems: make the compilation results consistent with IDE analysis, and point more consistently to problematic calls of library code from […]

8.12-m02-int: Explain a test [TIMEOUT] instead of killing it silently (#15879)

A hung test run tells us almost nothing today. When no client has made progress for --timeout seconds, test_server_cron prints the clients' last reported state, SIGKILLs every server via force_kill_all_servers and exits; --dump-logs only fires for a failed or excepted test, never for a timeout. So a 20-minute hang costs a whole CI run and produces a few lines. Collect the evidence before tearing the run down: Crash-report the surviving servers. SIGSEGV makes redis log a stack trace of every one of its threads plus INFO, the client list and the config (printCrashReport) and then die. The handl…

The Python documentation is now available in German

You can now read the Python documentation online in German!

runc v1.5.2 -- "Всё сбудется, стоит только расхотеть!"

This is the second patch release in the 1.5.z release series of runc, which primarily includes a workaround for a Linux kernel bug causing random runc crashes when using cgroup v2, and other fixes. Fixed runc exec -p with a process.json lacking env now sets HOME again (a regression in runc 1.3.0). ( #5265 , #5266 , #5459 ) Worked around a Linux kernel bug (present since kernel v6.17, fixed in v7.2) which caused the kernel to write past the end of the structure provided by userspace (runc). This resulted in memory corruption inside runc (manifesting as random crashes) when configuring device r…

AG-UI Protocol now has a first-class .NET SDK

The new AG-UI .NET SDK enables .NET services to expose and consume interoperable agent endpoints using Microsoft.Extensions.AI. The post AG-UI Protocol now has a first-class .NET SDK appeared first on .NET Blog .

See you in Lisbon!

Hi, it’s Claudio Baccigalupo with your updates on the Rails codebase.

containerd 1.7.36

Welcome to the v1.7.36 release of containerd! The thirty-sixth patch release for containerd 1.7 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14142 ) Runtime Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ( #14184 ) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues . Contributors Samuel Karp Chris Henzie Derek McGow…

containerd 2.4.1

Welcome to the v2.4.1 release of containerd! The first patch release for containerd 2.4 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Container Runtime Interface (CRI) Fix bug where failed container start cleanup leaked tasks and prevented container removal ( #14223 ) Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ( #14212 ) Image Distribution Fix content upload failures when retrying fetch content after reaching EOF ( #14197 ) Snapshotters Apply hardening to filter ID-map…

containerd 2.2.9

Welcome to the v2.2.9 release of containerd! The ninth patch release for containerd 2.2 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Container Runtime Interface (CRI) Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ( #14210 ) Enable mount manager for image mounts in CRI ( #14148 ) Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14140 ) Runtime Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux co…

containerd 2.3.6

Welcome to the v2.3.6 release of containerd! The sixth patch release for containerd 2.3 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Container Runtime Interface (CRI) Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ( #14211 ) Enable mount manager for image mounts in CRI ( #14147 ) Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14139 ) Runtime Avoid unexpected mutation of mount options in mount helpers ( #14192 )…

containerd 2.0.13

Welcome to the v2.0.13 release of containerd! The thirteenth patch release for containerd 2.0 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14141 ) Runtime Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ( #14183 ) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues . Contributors Samuel Karp Chris Henzie Maksym Pavlen…

Rails Version 7.2.4 has been released!

Hi everyone,

PHP 8.4.26 Released!

The PHP development team announces the immediate availability of PHP 8.4.26. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.26 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog

Rails Version 8.1.4 has been released!

Hi everyone,

DSF member of the month - Ken Whitesell

For September 2026, we welcome Ken Whitesell as our DSF member of the month! ⭐ Ken has long been part of the Django community, serving for many years as an helper in the Django forum and recipient of the Malcolm Tredinnick Memorial award. He has been a volunteer for DjangoCon US for over ten years. He is a DSF member since September 2017! You can learn more about Ken by visiting Ken's blog and his GitHub Profile . Let’s spend some time getting to know Ken better! Can you tell us a little about yourself? (hobbies, education, etc) Hi everyone! I've been retired for a little more than a year now…

PHP 8.2.34 Released!

The PHP development team announces the immediate availability of PHP 8.2.34. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.34 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog

PHP 8.5.11 Released!

The PHP development team announces the immediate availability of PHP 8.5.11. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.11 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog

PHP 8.3.35 Released!

The PHP development team announces the immediate availability of PHP 8.3.35. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.35 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog

PHP 8.6.0 RC2 available for testing

The PHP team is pleased to announce the first release candidate of PHP 8.6.0, RC2. It is not a typo: a mistake was made while packaging RC1, so RC2 was released instead. For a full explanation, please see this . This continues the PHP 8.6 release cycle, whose rough outline is specified in the . blog post PHP Wiki Source downloads of PHP 8.6.0 RC2 are available on the . download page Please carefully test this version and report any issues found in the . GitHub Issues Please DO NOT use this version in production, it is an early test version. For more information on the new features and other c…

Platform-independent SIMD in Go

Go 1.27 adds an experimental platform-agnostic SIMD API

Node.js 22.23.3 (LTS)

Upcoming Next.js September Security Release

Next.js is preparing a scheduled September security release for September 30, 2026.

Introducing Laravel AI SDK v1.0

Laravel AI SDK v1.0 is here: one Laravel-native API for every provider, with conversation storage, streaming chat, agents, tool approvals, and Jev classification.

Ruby 3.4.11 Released

Ruby 3.4.11 has been released. This is a regular scheduled update release includes bugfixes. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.gz SIZE: 22492449 SHA1: ed687c91e79b20a755666adbc290695accd49d79 SHA256: 5c22be44524312b3d433d68739bcc530633b1da5ef8ba0afa0a37680da17d3de SHA512: cb951af61fb237ddf3213f5efec893a50524216800359514baded26189a5aa1640cc83e344aedd001cc57c4479cfabcf20033be77c28401333f57f2ac13c6640 https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.xz SIZE: 16712500 SHA1: c36b1142f3d45441edbe0bb9146ddda3…

The Python documentation is now available in Persian

Spotlight on SIG Apps

As Kubernetes adoption has grown, the conversation has shifted beyond running containers to managing increasingly complex application lifecycles. Modern platforms support stateless web services, stateful databases, batch processing, AI workloads, and platform services. At the same time, they must remain reliable during upgrades, scaling events, and infrastructure failures. Every Kubernetes user relies on SIG Apps, whether they realize it or not. Deployments, StatefulSets, DaemonSets, Jobs, and CronJobs form the foundation of how applications are deployed, updated, scaled, and operated across…

PowerDNS DNSdist 2.0.10 Released

Today we released DNSdist 2.0.10, fixing a regression that was introduced in DNSdist 2.0.9 and was preventing dynamically blocking a suffix via the FFI interface, as done for example by DNSdist Defender.

New Technical Governance Approved

Both the Steering Council and DSF Board have approved DEP 19, which implements our new technical governance. Thank you to everyone who read the document and participated in the process! This was the effort of two different DSF boards and dozens of community members. These changes were a revisitation of Django’s technical governance in which a simplification and reduction was made to make it more approachable to more people. The most exciting change (in my opinion), is the new Steering Council Eligibility criteria . We defined a set of wide range qualities that members of the Steering Council…

Node.js 26.10.0 (Current)

Announcing a Maintainer in Residence: Scott Schafer for the Cargo team

At the end of August, we announced our first Maintainers in Residence, Rust Project contributors who are funded for their upstream contributions and maintenance work from the Rust Foundation Maintainers Fund (RFMF). Since then, the Rust Leadership Council has dedicated more funds from its Project Priorities budget to RFMF, and together with AWS also providing additional funds, this allowed us to open a new full-time Maintainer in Residence (MiR) position to support the Cargo team. We would like to thank the Rust Leadership Council, AWS, and also the Rust Foundation for providing us with this…

Kubernetes v1.37: Tracking When a PersistentVolumeClaim Was Last Used (Beta)

Kubernetes v1.37 promotes the PersistentVolumeClaimUnusedSinceTime feature gate to Beta (enabled by default). With this feature, the PersistentVolumeClaim (PVC) protection controller adds an Unused condition to each PVC, telling you whether any running pod currently references it — no custom tooling or cross-referencing required. For the API definition of PVC conditions, see the PersistentVolumeClaim API reference . Read on to learn how the Unused condition works and how to use it. Why track PVC usage? In large-scale Kubernetes clusters, it is common for users to create PVCs and then delete t…

GitHub Actions leaking secrets when Miri output is cached

The Rust Security Response Team was notified that Miri stores all environment variables to target/ , allowing secrets to persist in caches. While not necessary a vulnerability in and of itself, when paired with GitHub Actions caching behavior, it is possible for this to expose secrets to PRs. Overview GitHub Actions makes it possible to cache directories between runs. Typical setups allow CI runs on main (and other branches) to write to cache, and PRs can only read from cache (preventing cache poisoning). Rust projects tend to speed up CI by caching binaries built by cargo install and sometim…

Agents on Rails: Maximum effort and DeepSeek 4.1 Flash

In the Stage 2 report we shipped 20 feature tickets on Fizzy and promised to explore benchmarking the agents all on max-effort. Now we have run it: every model on the board, same tickets, reasoning turned all the way up. We also tested a new model: DeepSeek 4.1 Flash.

Proposed change to DSF voting membership

We're proposing a new voting membership status to help us track active members. If you've voted in a Board election in the last two years, you're active, and you count toward quorum. If you haven't, you're still a member, but you won't count toward quorum until you tell us you want to vote. Why make this change? Quorum today is measured against every member on the rolls, including members who no longer take part in elections. As membership grows, quorum becomes harder to reach and puts our elections' validity at risk. Defining a quorum around active members is standard practice for nonprofits…

Rails World 2026 Update: Livestream & Sponsors

As we gear up for Rails World 2026 next week, we’re so grateful to the companies showing up to make the first Rails World in the US a great one.

WordPress 7.1.1 Maintenance and Security Release

This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update […]

8.10.2

Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…

8.8.3

Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…

8.6.7

Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…

8.4.7

Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…

8.2.10

Update urgency: SECURITY : There are security fixes in the release. Security fixes #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus TimeSeries: Prevented Redis from crashing when adding samp…

v2.9.7

2.9.7 / 2026.09.16 fix(audit): honor configured CA stores ( #36728 ) fix(cache): make HTTP authority paths unambiguous ( #36356 ) fix(cli): accept all valid sys permission descriptors ( #36753 ) fix(cli): don't duplicate passthrough args for deno deploy/sandbox ( #36722 ) fix(cli): generate valid bash completions ( #36736 ) fix(cli): preserve double dash before the entrypoint ( #36835 ) fix(cli): restore optional-value semantics for deno bundle --sourcemap ( #36723 ) fix(completions): keep the dash on short flags in zsh completions ( #36720 ) fix(desktop): complete deferred window close and f…

Be alert: targeted attacks on prominent Rustaceans

We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware. What we've seen A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard). These attackers are setting up new but leg…

containerd 2.4.0

Welcome to the v2.4.0 release of containerd! containerd 2.4 is a regular (non-LTS) release with a shorter support window, intended for users who want to adopt new features sooner. As the release following the 2.3 LTS, it is the point in the release cycle where previously deprecated features may be removed, so this release may include breaking changes; check the notes below and clear any deprecation warnings from your current version before upgrading. Users prioritizing stability and a longer support lifecycle should stay on the 2.3 LTS release. Highlights Container Runtime Interface (CRI) Ena…

Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions

Kubernetes v1.37 brings important storage security features: emptyDir permission modes and bind mount options. They help application programmers and security professionals implement rigorous security policies, for example, prohibiting deletion of files across containers or execution of arbitrary binaries from writable volumes, directly in Kubernetes without any complicated circumvention. Linux storage and permission fundamentals Before diving into the new Kubernetes features, let us briefly review the low-level Linux security mechanisms that make them possible. Bind mount flags When Linux mou…