Latest security news
Sat, October 24
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
影響: pip:filelock >= 3.20.4, <= 4.2.0 → 4.2.1 On Windows, ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal (pages saved to undo an interrupted write); -wal, the write-ahead log (changes kept outside the main file); and -shm, the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the database before the lock runs any statement. Another lo…
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
影響: pip:filelock >= 3.22.0, <= 4.2.0 → 4.2.1 On Windows the soft locks (SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock) read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire() attempt that finds a marker opens it with os.open to read the holder's process id, and the lock renames and deletes a marker it judges stale, by path. On Windows each of these calls waits for an oplock. An oplock (opportunistic lock) is a req…
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
影響: pip:setuptools >= 38.2.2, < 84.1.0 → 84.1.0 On Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path, but not the contents of the created file. Details Tested setuptools commit: 6ead555c5fb29bc57fe6105b1bffc163f56fd558 Relevant source: setuptools/wheel.py SHA-256: 359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd The relevant ca…
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
Fri, October 23
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
影響: pip:Pillow < 13.0.0 → 13.0.0 On Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native drawwmf handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensions. A crafted metafile that is wide and short passes the decompression-bomb pixel check yet causes a heap over-read. Details The EMF branch computes the size straight from signed 32-bit header fields and stores it with no positivity…
Thu, October 22
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September
Bun v1.4.4
To install Bun v1.4.4 curl -fsSL https://bun.com/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.com/install.ps1|iex " To upgrade to Bun v1.4.4: bun upgrade Read Bun v1.4.4's release notes on Bun's blog Thanks to 39 contributors! @0xh3x @1cedsoda @alex-mextner @alii @Artoria2e5 @bompus @C0casio45 @cirospaciari @davidhevn @deepshekhardas @Dex4Sure @dylan-conway @EffortlessSteven @eriklangille @filipesarturi @fredluz @gerardp @gohryt @himself65 @hughescr @Jarred-Sumner @jdjkelly @jecquas @jobansd @kernoeb @KilianB @MarshallOfSound @Neekoras @nikeee @nik…
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
影響: pip:virtualenv < 21.14.9 → 21.14.9 A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper. Windows executable launchers are not affected by this path. Attacker-controlled i…
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
影響: npm:@vitest/mocker >= 4.1.11, < 4.1.12 → 4.1.12, npm:@vitest/mocker >= 5.0.0-rc.2, < 5.0.3 → 5.0.3 The path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9) can be bypassed on Windows by using a backslash in the redirect URL pathname. The fixed code joins an attacker-controlled URL pathname with the Vite root using node:path/posix, then passes that string to Vite's file allowlist check. On Windows, a value such as C:/project/root/..\secret.txt retains ..\ during the POSIX join and begins with the allowed ro…
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0 The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references /etc/hosts, the content of /etc/hosts was possible to be returned. The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing /etc/hosts could make Vite return the h…
Wed, October 21
PHP 8.5.12 Released!
The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.5.12 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.27 Released!
The PHP development team announces the immediate availability of PHP 8.4.27. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.4 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.4.27 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.36 Released!
The PHP development team announces the immediate availability of PHP 8.3.36. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.3.36 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
影響: npm:launch-editor <= 2.14.1 → 2.14.2, npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0 launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename. Combined with the % escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection whe…
launch-editor: escapeCmdArgs() omits % escaping on Windows
影響: npm:launch-editor <= 2.14.1 → 2.14.2, npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0 launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An attacker can place a file with the malicious filename containing & or % - Either of - An attacker can inject an environment variable with a malicious value - An attacker can add a NTFS alternate data strea…
Mon, October 19
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
Sat, October 17
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis
Fri, October 16
Wed, October 14
Announcing .NET 11 Release Candidate 2
.NET 11 Release Candidate 2 is available with improvements across libraries, runtime, SDK, MSBuild, NuGet, F#, ASP.NET Core, .NET MAUI, and Windows Forms. The post Announcing .NET 11 Release Candidate 2 appeared first on .NET Blog .
Tue, October 13
[悪用確認] CVE-2026-96951: Microsoft Windows Command Injection Vulnerability
Microsoft Windows Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-16)
Mon, October 12
Ruby 4.1.0-preview1 Released
We are pleased to announce the release of Ruby 4.1.0-preview1. Ruby 4.1 introduces Ractor local GC, Windows support of YJIT, autoload_relative, and adds many improvements. Ractor improvements A lot of work has gone into making Ractors more stable, performant, and usable. These improvements bring Ractor implementation closer to leaving experimental status. The default GC now runs per Ractor : each Ractor collects its own heap on its own thread without stopping the others, and a stop-the-world collection only runs when it is really needed (explicit full GC.start , shareable-object growth, recla…
Sat, October 10
Bun v1.4.3
To install Bun v1.4.3 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.3: bun upgrade Read Bun v1.4.3's release notes on Bun's blog Thanks to 8 contributors! @alii @cirospaciari @dylan-conway @eastlondoner @jarred-sumner @robobun @sosukesuzuki @steipete
Wed, October 7
Elastic Agent / Endpoint 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-194)
Uncaught Exception in Elastic Endpoint Leading to Denial of Service Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabil…
Fri, October 2
Demoting i686 Windows targets to std-only
With Rust 1.100.0, the following changes to 32-bit Windows targets will happen: i686-pc-windows-msvc Tier 1 with host tools target will be demoted to Tier 1 without host tools. i686-pc-windows-gnu Tier 2 with host tools target will be demoted to Tier 2 without host tools. Builds of the standard library will continue to be distributed, but host tools such as the compiler will be no longer available. i686-pc-windows-msvc as a Tier 1 target still undergoes CI testing. To build 32-bit Windows binaries, cross-compiling from a still-supported host toolchain (such as a 64-bit Windows ones) will be r…
Fri, September 25
PHP 8.4.26 Released!
The PHP development team announces the immediate availability of PHP 8.4.26. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.26 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Thu, September 24
PHP 8.2.34 Released!
The PHP development team announces the immediate availability of PHP 8.2.34. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.34 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.5.11 Released!
The PHP development team announces the immediate availability of PHP 8.5.11. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.11 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.35 Released!
The PHP development team announces the immediate availability of PHP 8.3.35. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.35 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Tue, September 15
Swift 6.4 Released
Swift 6.4 is now available. Swift aims to be a great choice across the stack, from apps and servers to systems code, embedded devices, and the browser. This release deepens that support, and makes everyday code easier to write. Highlights include: Swift Build is now the default in Swift Package Manager , so your projects build the same way on Linux, macOS, and Windows. Subprocess reaches 1.0 , a stable, cross-platform way to run and interact with other programs from Swift, from command-line tools to streaming processes. Interoperability reaches further , with Swift’s Span now bridging directl…
Tue, September 8
[悪用確認] CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Microsoft Windows Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-09-22)
[悪用確認] CVE-2026-81963: Microsoft Windows Link Following Vulnerability
Microsoft Windows Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-09-22)
Sat, September 5
Bun v1.4.2
To install Bun v1.4.2 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.2: bun upgrade Read Bun v1.4.2's release notes on Bun's blog Thanks to 3 contributors! @dylan-conway @jarred-sumner @robobun
Fri, September 4
Bun v1.4.1
To install Bun v1.4.1 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.1: bun upgrade Read Bun v1.4.1's release notes on Bun's blog Thanks to 7 contributors! @alii @dylan-conway @jarred-sumner @jvitormelo @marshallofsound @robobun @sosukesuzuki
Fri, August 28
PHP 8.5.10 Released!
The PHP development team announces the immediate availability of PHP 8.5.10. This is a bug fix release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.10 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Thu, August 27
PHP 8.4.25 Released!
The PHP development team announces the immediate availability of PHP 8.4.25. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.25 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Thu, August 20
Bun v1.4
To install Bun v1.4 curl -fsSL https://bun.com/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.com/install.ps1|iex " To upgrade to Bun v1.4.0: bun upgrade Read the blog post : Thank you Bun is free, open source, and MIT-licensed. We receive a lot of contributions from the community, and we'd like to thank everyone who fixed a bug or contributed since Bun v1.3. @190n @alanstott @alii @alinalihassan @amdad121 @ant-kurt @anthonybaldwin @avarayr @baboon-king @billywhizz @bmwalters @Boshen @braden-w @c-stoeckl @carlsmedstad @chrislloyd @cirospaciari @colel…
Bun 1.4
Bun 1.4 rewrites Bun in Rust, ships built-in headless browser automation (Bun.WebView), Bun.Image, Bun.markdown, JSON5, JSONL, Terminal and cron APIs, Node.js 26.3.0 compatibility with 1,517 newly passing tests, parallel test and run, Windows ARM64, and an opt-in global virtual store for up to 7× faster installs.
Thu, July 30
PHP 8.4.24 Released!
The PHP development team announces the immediate availability of PHP 8.4.24. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.24 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.33 Released!
The PHP development team announces the immediate availability of PHP 8.3.33. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.33 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.5.9 Released!
The PHP development team announces the immediate availability of PHP 8.5.9. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.9 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.2.33 Released!
The PHP development team announces the immediate availability of PHP 8.2.33. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.33 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Fri, July 3
PHP 8.5.8 Released!
The PHP development team announces the immediate availability of PHP 8.5.8. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.8 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.23 Released!
The PHP development team announces the immediate availability of PHP 8.4.23. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.23 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.32 Released!
The PHP development team announces the immediate availability of PHP 8.3.32. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.32 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Thu, July 2
PHP 8.2.32 Released!
The PHP development team announces the immediate availability of PHP 8.2.32. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.32 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Fri, June 26
Fri, June 5
PHP 8.4.22 Released!
The PHP development team announces the immediate availability of PHP 8.4.22. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.22 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Thu, June 4
PHP 8.5.7 Released!
The PHP development team announces the immediate availability of PHP 8.5.7. This is a bug fix release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.7 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Wed, May 13
Bun v1.3.14
Fixes 92 issues (addressing 380 👍). Bun.Image — a built-in image processing API, 7x faster warm installs with the isolated linker's global store, experimental HTTP/2 and HTTP/3 clients for fetch(), HTTP/3 (QUIC) in Bun.serve(), rewritten fs.watch() on Linux and macOS, --no-orphans CLI flag, process.execve(), Bun.Terminal on Windows via ConPTY, FreeBSD and Android builds, shared SSL_CTX cache, smaller binaries, and many bugfixes and Node.js compatibility improvements.