Latest security news
Fri, October 23Today
Ruby 3.3.13 Released
Ruby 3.3.13 has been released. This release includes security fixes. Please check the topics below for details. Security advisories: CVE-2026-80212 and CVE-2026-80213 Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 This release updates the default gem resolv to 0.3.2, which fixes CVE-2026-80212 and CVE-2026-80213. Ruby 3.3 is in the security maintenance phase. As an exception, this release also includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on. P…
Ruby 3.4.12 Released
Ruby 3.4.12 has been released. This release includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on. Please see the topic below for details. Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 This release also includes other bugfixes. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.12.tar.gz SIZE: 22498017 SHA1: 8ead0b008d7cdeb543282489e7574324ab62939f SHA256: 5e5d85ad93b0adcccbad47733680f4892…
Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. GitLab published four CVEs for these issues, and the Ruby releases contain the fixes for the underlying bugs in Ruby. Background GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with Regexp.new . GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them, and that this could be turned into remote code execution on GitLab serv…
Ruby 4.0.9 Released
Ruby 4.0.9 has been released. This release includes a fix for a bug in Regexp compilation that GitLab’s CVE-2026-110264 relies on. Please see the topic below for details. Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.9.tar.gz SIZE: 23946524 SHA1: 39f31360bc0c03bde9eec4177e443f6298481e2e SHA256: c35350682ff050b79702d57ade4516e7336063f510155d19fb2fb5b3f3909511 SHA512: 9adb0069a07ee1348a04b627d8af1c9f2b6537bdea5dce0b57423…
Thu, October 22Yesterday
Security advisory: update your JDK (CVE-2026-91403)
On 2026-10-21, OpenJDK published a vulnerability advisory for CVE-2026-91403 (CVSS 9.1), which concerns eight compromised intermediate CA certificates shipped with the JDK. It affects all supported JDK lines: 8, 11, 17, 21, 25 and 27. This is not a Scala issue, but it affects every application running on the JVM, including Scala ones, as well as Scala build tools that use the JDK’s certificates to download dependencies. Am I affected? You are affected if you use JDK 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512, or earlier . To check if your JDK is vulnerable, checkout eed3si9n/emudhra-ems…
Wed, October 21
Critical PHP Security Release
The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place […]
PHP critical vulnerability response updates
At 13:40 UTC two critical security vulnerabilities were disclosed and patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Action may be required, read below.
PowerDNS Security Advisory 2026-13 for PowerDNS Authoritative Server
Today, we are releasing three new versions of the PowerDNS Authoritative Server. These 4.9.18, 5.0.8 and 5.1.5 versions provide fixes for the following PowerDNS Security Advisory:
PowerDNS Security Advisory 2026-12 for PowerDNS Recursor
Today we have released PowerDNS Recursor 5.3.12 and 5.4.8. These releases provide fixes for PowerDNS Security Advisory 2026-12 for PowerDNS Recursor: Multiple issues There are several CVEs associated with this advisory, three with severity High and the remaining with severity Medium or Low .
Security advisory: Critical remote code execution vulnerabilities, update now
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. Who is at risk: The vulnerabilities: , CVE-2026-109618 (): out-of-memory handling can interrupt PHP while internal request data is onl…
PHP 8.5.12 Released!
The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.5.12 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.27 Released!
The PHP development team announces the immediate availability of PHP 8.4.27. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.4 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.4.27 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.36 Released!
The PHP development team announces the immediate availability of PHP 8.3.36. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.3.36 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.2.35 Released!
The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version. For source downloads of PHP 8.2.35 pleas…
GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
On October 21, 2026, we released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There ar…
Python 3.15.1, 3.14.9 and 3.13.17 are out
Three certified security releases for 3.15, 3.14 and 3.13.
Upcoming Critical PHP Security Release
The PHP security team would like to give advance notice of an . upcoming security release It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild. Full details, affected versions, and the fixed versions will be published with the release. Thank you for helping us keep…
Tue, October 20
Announcing rustup 1.29.2
The rustup team is happy to announce the release of rustup version 1.29.2. Rustup is the recommended tool to install Rust , a programming language that empowers everyone to build reliable and efficient software. What's new in rustup 1.29.2 This is a small release which only updates the rustls-webpki and webpki-root-certs dependencies to address the problematic eMudhra intermediate certificates issue described in CVE-2026-111943 . See also RUSTSEC-2026-0382 . Further details are available in the changelog ! How to update If you have a previous version of rustup installed, getting the new one i…
Sun, October 18
pg_utl_smtp v2.0 released
Antananarivo, Madagascar - October 06, 2026 PostgreSQL UTL_SMTP compatibility extension pg_utl_smtp is a PostgreSQL extension to create, manage and use Oracle-style UTL_SMTP package. The use and behavior is just like with the UTL_SMTP Oracle package. This work is released from the HexaRocket project. This extension allows email notifications to be sent from triggers or stored procedures. By integrating the extension directly into the database, you can trigger data-driven actions without waiting for application intervention. Examples include security alerts or notifications when certain minimu…
Thu, October 15
Next.js Security Update for Upstream Vulnerabilities
The October 14, 2026 out-of-band security update for Next.js is now available
Wed, October 14
containerd 2.3.7
Welcome to the v2.3.7 release of containerd! The seventh patch release for containerd 2.3 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-5p7c-hggf-c748 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14301 ) Image Distribution Apply hardening to reject image references with ".." path components ( #14281 ) Runtime Apply hardening to allowlist socket domains in the default seccomp profile ( #14248 ) Snapshotters Apply hardening to…
containerd 2.2.10
Welcome to the v2.2.10 release of containerd! The tenth patch release for containerd 2.2 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-5p7c-hggf-c748 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14300 ) Image Distribution Avoid hang and data corruption during multipart image fetch ( #14316 ) Apply hardening to reject image references with ".." path components ( #14280 ) Runtime Apply hardening to allowlist socket domains in…
containerd 2.4.2
Welcome to the v2.4.2 release of containerd! The second patch release for containerd 2.4 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14302 ) Image Distribution Fix excessive memory usage during image pulls when registry downloads outpace content writes ( #14342 ) Apply hardening to reject image references with ".." path components ( #14282 ) Runtime Apply hardening to allowlist socke…
containerd 2.0.14
Welcome to the v2.0.14 release of containerd! The fourteenth patch release for containerd 2.0 contains various fixes and updates including a security patch. Security Updates containerd GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14299 ) Runtime Apply hardening to allowlist socket domains in the default seccomp profile ( #14251 ) Snapshotters Apply hardening to filter ID-mapping labels from image annotations during unpack ( #14270 ) Please try out the release binaries and report any issues at https://github.…
nginx-1.30.6 stable and nginx-1.31.7 mainline versions have been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).
2026-10-14 nginx-1.30.6 stable and nginx-1.31.7 mainline versions have been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).
Mon, October 12
PowerDNS DNSdist 2.1.3 and 2.0.11 Released
Today we released DNSdist 2.1.3 and 2.0.11, fixing several issues. The notable one fixes an issue where incoming DNS over TLS and DNS over HTTPS connections could have been wrongly terminated early, when the OpenSSL provider is in use. We advise all users providing DNS over TLS or DNS over HTTPS to upgrade, but to be clear this is NOT a security issue.
GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5. These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. All GitLab Dedicated tenants were patched using an internal release before this patch release was published. GitLab releases fixes…
Fri, October 9
Upcoming Next.js Security Update for Upstream Vulnerabilities
Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.
Thu, October 8
Django security reporting update
We are no longer accepting new security reports for the Django project through HackerOne. Existing reports submitted through HackerOne will remain open and continue to be handled by the Django Security Team. If you discover a security issue in Django, please follow the reporting process described in the Django security policies . Security issues should be reported by emailing security@djangoproject.com
Wed, October 7
WordPress 7.1.3 Maintenance and Security Release
This security and maintenance release features 7 security fixes and 4 bug fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background […]
Tue, October 6
Django security releases issued: 6.1.2, 6.0.9, and 5.2.18
In accordance with our security release policy , the Django team is issuing releases for Django 6.1.2 , Django 6.0.9 , and Django 5.2.18 . These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant() django.utils.translation.get_supported_language_variant() was subject to a potential denial-of-service attack when processing many distinct, very long language codes. Language codes were used as keys in an in-memory cache before their length…
Fri, October 2
GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1
We have released versions 19.2.4, 19.3.2, and 19.4.1 of the GitLab AI Gateway. These versions contain a critical security fix for GitLab Self-Hosted AI Gateway, and we strongly recommend that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately. We have conducted targeted outreach to Self-Hosted AI Gateway customers prior to this release post with this guidance. A fix has already been deployed for GitLab-hosted AI Gateways. Customers using GitLab.com, GitLab Dedicated, and GitLab Self-Managed instances using a GitLab-ho…
Thu, October 1
Python 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8 are now available!
Security updates across Python 3.10–3.14, the final maintenance release of 3.13, and a farewell to Python 3.10.
September 2026 Security Release
The September 2026 security release for Next.js is now available
Fri, September 25
containerd 1.7.36
Welcome to the v1.7.36 release of containerd! The thirty-sixth patch release for containerd 1.7 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14142 ) Runtime Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ( #14184 ) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues . Contributors Samuel Karp Chris Henzie Derek McGow…
containerd 2.4.1
Welcome to the v2.4.1 release of containerd! The first patch release for containerd 2.4 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Container Runtime Interface (CRI) Fix bug where failed container start cleanup leaked tasks and prevented container removal ( #14223 ) Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ( #14212 ) Image Distribution Fix content upload failures when retrying fetch content after reaching EOF ( #14197 ) Snapshotters Apply hardening to filter ID-map…
containerd 2.2.9
Welcome to the v2.2.9 release of containerd! The ninth patch release for containerd 2.2 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Container Runtime Interface (CRI) Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ( #14210 ) Enable mount manager for image mounts in CRI ( #14148 ) Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14140 ) Runtime Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux co…
containerd 2.3.6
Welcome to the v2.3.6 release of containerd! The sixth patch release for containerd 2.3 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Container Runtime Interface (CRI) Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ( #14211 ) Enable mount manager for image mounts in CRI ( #14147 ) Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14139 ) Runtime Avoid unexpected mutation of mount options in mount helpers ( #14192 )…
containerd 2.0.13
Welcome to the v2.0.13 release of containerd! The thirteenth patch release for containerd 2.0 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14141 ) Runtime Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ( #14183 ) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues . Contributors Samuel Karp Chris Henzie Maksym Pavlen…
PHP 8.4.26 Released!
The PHP development team announces the immediate availability of PHP 8.4.26. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.26 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Thu, September 24
PHP 8.2.34 Released!
The PHP development team announces the immediate availability of PHP 8.2.34. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.34 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.5.11 Released!
The PHP development team announces the immediate availability of PHP 8.5.11. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.11 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.35 Released!
The PHP development team announces the immediate availability of PHP 8.3.35. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.35 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Upcoming Next.js September Security Release
Next.js is preparing a scheduled September security release for September 30, 2026.
Wed, September 23
GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7
On September 23, 2026, we released versions 19.4.1, 19.3.3, 19.2.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Sched…
GitLab Critical Patch Release: 19.0.9, 18.11.12
On September 23, 2026, we released versions 19.0.9 and 18.11.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions backport the fixes for two critical vulnerabilities, CVE-2026-85706 and CVE-2026-87719, that were originally patched in 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026. These backports were made available outside of our standard maintenance policy so that self-managed administrators running 18.11 and 19.0 can apply the fixes without first completing a version upgrade. These versions contain no other changes. We strongly recommend that all self-managed…
Next.js Security Update for a Critical Upstream Issue
The September 22, 2026 out-of-band security update for Next.js is now available
Upcoming Next.js Security Update for a Critical Upstream Issue
Next.js 16.3.6 and 15.5.26 are planned for a critical out-of-band security update on September 22, 2026.
Tue, September 22
WordPress 7.1.2 Release
This security release features a fix for a critical severity security vulnerability. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, […]