Latest security news
Sat, October 24
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1 ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) remove their private .filelock- link directories with shutil.rmtree (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable /proc/self/fd (a Linux path that names the process's own open f…
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1 When a soft-lock stale break finds that the marker (the lock file at ) it renamed aside was a live one recreated by a successor, the restore branch of break_lock_file() checks the break name with lstat (a check that reads a name without following a symbolic link) and then calls os.link(break_path, lock_file) by name. On CPython 3.12 and later on Linux (and on macOS) that call follows a symbolic link (a file that redirects to another path). A local user (the other user below) who can write a sha…
Fri, October 23
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe. The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek .
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
影響: npm:electron < 42.11.6 → 42.11.6, npm:electron >= 43.0.0-alpha.1, < 43.7.3 → 43.7.3, npm:electron >= 44.0.0-alpha.1, < 44.4.3 → 44.4.3, npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.9 → 45.0.0-alpha.9 In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths. Apps are only affected if they use offscreen rendering (webPreferences.offscreen) on macOS and an attacker has separately gained code execution in…
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
影響: pip:djangorestframework < 3.18.2 → 3.18.2 DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a single GET with a 780KB Accept header made of 96 such tokens kept one gunicorn worker busy for 18.87 seconds (Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0, Python 3.13, Docker on macOS). The heade…
Mon, October 19
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
Fri, October 16
Introducing dotnetup: A toolchain manager for .NET
Learn how the new dotnetup tool helps macOS and Linux developers install, manage, and update user-local .NET SDKs and runtimes. The post Introducing dotnetup: A toolchain manager for .NET appeared first on .NET Blog .
Wed, September 30
macOS and Python (Python Language Summit 2026)
Ned Deily weighs whether Python should continue shipping macOS installers
Tue, September 29
[悪用確認] CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability
Apple Multiple Products Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-13)
Tue, September 15
Swift 6.4 Released
Swift 6.4 is now available. Swift aims to be a great choice across the stack, from apps and servers to systems code, embedded devices, and the browser. This release deepens that support, and makes everyday code easier to write. Highlights include: Swift Build is now the default in Swift Package Manager , so your projects build the same way on Linux, macOS, and Windows. Subprocess reaches 1.0 , a stable, cross-platform way to run and interact with other programs from Swift, from command-line tools to streaming processes. Interoperability reaches further , with Swift’s Span now bridging directl…
Wed, May 13
Bun v1.3.14
Fixes 92 issues (addressing 380 👍). Bun.Image — a built-in image processing API, 7x faster warm installs with the isolated linker's global store, experimental HTTP/2 and HTTP/3 clients for fetch(), HTTP/3 (QUIC) in Bun.serve(), rewritten fs.watch() on Linux and macOS, --no-orphans CLI flag, process.execve(), Bun.Terminal on Windows via ConPTY, FreeBSD and Android builds, shared SSL_CTX cache, smaller binaries, and many bugfixes and Node.js compatibility improvements.
Wed, March 18
Bun v1.3.11
Fixes 105 issues (addressing 307 👍). 4 MB smaller on Linux. x64 Bun.cron for OS-level cron jobs and expression parsing, Bun.sliceAnsi for ANSI/grapheme-aware string slicing, richer Bun.markdown list metadata; bun test --path-ignore-patterns; native Windows ARM64 .bin shim; dgram UDP fixed on macOS, fs.openSync numeric flags fixed on Windows (unbreaks tar@7), http2 WINDOW_UPDATE fix; bundler --bytecode/barrel/import-attribute fixes; CSS unicode-range/mask/border-radius fixes; Proxy-array crash fixes, CRLF injection fix, bun install hang fixes, and many Node.js compatibility improvements.
Fri, February 20
Announcing Swift System Metrics 1.0: Process-Level Monitoring
We are excited to announce the 1.0 release of Swift System Metrics , a Swift package that collects process-level system metrics like CPU utilization time and memory usage. Swift System Metrics runs on both Linux and macOS, providing a common API across platforms. Swift System Metrics visualized in Grafana, demonstrating what's possible with real-time monitoring. Monitoring process metrics enables you to detect performance issues, optimize resource usage, and ensure your service remains reliable and cost-effective under varying loads. You can integrate Swift System Metrics into your service in…
Wed, October 22
Bun v1.3.1
Fixes 103 issues (addressing 172 👍). 2× faster bun build on macOS for symlink-heavy projects, source maps preserve legal comments, and --format=cjs now inlines import.meta; bun test adds global vi, --pass-with-no-tests, and --only-failures; .npmrc :email auth support, faster installs when no peer deps, selective hoisting for isolated installs (publicHoistPattern/hoistPattern), and fs/promises FileHandle.readLines(); numerous bundler/transpiler fixes (external sourcemaps in Bun.build({ compile:true }), --bytecode with import.meta, Windows react-jsxdev); reliability fixes across install/pm/pac…
Wed, February 26
Bun v1.2.4
Up to 60% faster Bun.build on macOS, codesigning support for single-file executables on macOS, dev server stability improvements, fixes a regression from v1.2.3 affecting Hono, fixes up/down buttons in `bun init` on Windows, and improves Node.js compatibility
Fri, September 13
Herd 1.11 Now Available
We're thrilled to announce the next big step for Laravel Herd, making the best development environment for macOS and Windows users even better. This update ships an integration with Laravel Forge, a profiler, a way to store your project configuration in your repository, and massive improvements for the dump debugger.
Tue, June 25
Bun v1.1.17
Fixes 4 bugs. Fixes a crash in bun repl. Makes fs.readdirSync 5% faster on macOS in small directories. Fixes "ws" module not calling the callback in "send" method. Fixes a crash when reading a corrupted lockfile in bun install. Makes macOS event loop a smidge faster.
Sat, June 1
Bun v1.1.11
Fixes 36 bugs (addressing 362 👍). bun update saves dependency updates to package.json. A peer dependencies resolution bug in bun install is fixed. setTimeout gets 5x faster throughput on Linux. Node.js compatibility improvements to fs, zlib, timers, http, dgram and module. Event loop improvements on macOS. Windows reliability improvements.
Fri, March 15
Bun v1.0.31
Fixes 54 bugs (addresses 113 👍 reactions), introduces `bun --print`, ` | bun run -`, `bun add --trust`, `fetch()` with Unix sockets, fixes macOS binary size regression, fixes high CPU usage bug in spawn() on older linux, adds `util.styleText`, Node.js compatibiltiy improvements, bun install bugfixes, and bunx bugfixes
Tue, December 8
DNSSEC trigger 0.13 for OS X 10.11 released
Update and correct install on Mac OS X 10.11 (El Capitan) systems.