Vulnerabilities & updates
Page 10
Mon, October 12
PowerDNS DNSdist 2.1.3 and 2.0.11 Released
Today we released DNSdist 2.1.3 and 2.0.11, fixing several issues. The notable one fixes an issue where incoming DNS over TLS and DNS over HTTPS connections could have been wrongly terminated early, when the OpenSSL provider is in use. We advise all users providing DNS over TLS or DNS over HTTPS to upgrade, but to be clear this is NOT a security issue.
GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5. These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. All GitLab Dedicated tenants were patched using an internal release before this patch release was published. GitLab releases fixes…
Ruby 4.1.0-preview1 Released
We are pleased to announce the release of Ruby 4.1.0-preview1. Ruby 4.1 introduces Ractor local GC, Windows support of YJIT, autoload_relative, and adds many improvements. Ractor improvements A lot of work has gone into making Ractors more stable, performant, and usable. These improvements bring Ractor implementation closer to leaving experimental status. The default GC now runs per Ractor : each Ractor collects its own heap on its own thread without stopping the others, and a stop-the-world collection only runs when it is really needed (explicit full GC.start , shareable-object growth, recla…
Scala 3.10 released!
Scala 3.10 released! We are happy to announce Scala 3.10.0 , the first release of the new Scala Next series. This release stabilizes SIP-67 , moves three SIPs into preview, and starts dropping legacy language features that have been deprecated for several minor releases. Scala 3.3 LTS and Scala 3.9 LTS put compatibility with Scala 2.13 first. Now, nearly five years after Scala 3.0, Scala 3.10 starts removing legacy syntax and features that have been deprecated for several minor releases. The standard library also starts using more Scala 3 features, such as inline and extension methods. Binary…
Sat, October 10
Bun v1.4.3
To install Bun v1.4.3 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.3: bun upgrade Read Bun v1.4.3's release notes on Bun's blog Thanks to 8 contributors! @alii @cirospaciari @dylan-conway @eastlondoner @jarred-sumner @robobun @sosukesuzuki @steipete
Bun v1.4.3
Fixes 166 issues, addressing 122 👍. bun check, a TypeScript type checker built into Bun that is 3x to 6.4x faster than tsc 7, --check for bun run, bun build and bun test, 67–89% less idle CPU, Bun.FetchSession, experimental Bun.ModuleGraph, --disallow-code-generation-from-strings, up to 2.7x faster large node:http responses, a JavaScriptCore upgrade with faster JSON.parse, faster rejected-promise handling, CompressionStream compression levels, If-Range support in Bun.serve, bun install skips tarballs it won't install, lower bun build memory with many entry points, [hashN] output names, profi…
Deno is joining Cloudflare
Putting ourselves in the best place to build the future of the web
Fri, October 9
Better ACL S3 control and more
Hi, Wojtek here. Let’s explore this week’s changes in the Rails codebase.
Python 3.15.0 (final) is here!
A brand new Python here for you to enjoy!
Upcoming Next.js Security Update for Upstream Vulnerabilities
Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.
What's new in Swift: September 2026 Edition
Welcome to “What’s new in Swift,” a curated digest of releases, videos, and discussions in the Swift project and community. The Vapor web framework recently turned ten and celebrated with Vapor Week! We’ve invited one of the authors of Vapor as this month’s guest contributor: Hi, I’m Tim from the Vapor Core Team! 10 years ago, in September, Vapor 1.0 was released, and over the years Vapor has matured into a comprehensive framework for building backends and APIs in Swift. On the anniversary we released the first beta of Vapor 5 , the next major version of Vapor, which is a complete rewrite, re…
PHP 8.6.0 RC3 available for testing
The PHP team is pleased to announce the first release candidate of PHP 8.6.0, RC3. This continues the PHP 8.6 release cycle, whose rough outline is specified in the . PHP Wiki Source downloads of PHP 8.6.0 RC3 are available on the . download page Please carefully test this version and report any issues found in the . GitHub Issues Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NE…
Thu, October 8
Building a Public Performance Change Detection Library for MariaDB
Performance engineering inside a database project is usually private. Teams run internal workloads, investigate changes, fix issues, and move on. The knowledge stays inside the company, and the outside world only sees a benchmark graph or a release note. I know this pattern well — I spent more than twenty‑six years doing this work for […] Building a Public Performance Change Detection Library for MariaDB appeared first on MariaDB.org
Django security reporting update
We are no longer accepting new security reports for the Django project through HackerOne. Existing reports submitted through HackerOne will remain open and continue to be handled by the Django Security Team. If you discover a security issue in Django, please follow the reporting process described in the Django security policies . Security issues should be reported by emailing security@djangoproject.com
Open Source milestone – MariaDB’sEcosystem hub hits 200 solutions
New ‘App store of open source’ is one stop shop serving the fast-growing MariaDB community’s needs for applications, developer tools, cloud platforms and projects. The MariaDB Foundation today announces the MariaDB Server Ecosystem Hub has exceeded 200 entries, just six months after launch. The Hub is a curated, open directory of MariaDB Server approved products, […] Open Source milestone – MariaDB’sEcosystem hub hits 200 solutions appeared first on MariaDB.org
[悪用確認] CVE-2015-3306: ProFTPD Improper Access Control Vulnerability
ProFTPD ProFTPD ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-11)
[悪用確認] CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE Docs ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-11)
[悪用確認] CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi Strapi Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-11)
[悪用確認] CVE-2016-3081: Apache Struts Command Injection Vulnerability
Apache Struts Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-11)
[悪用確認] CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability
ISC BIND ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-11)
Wed, October 7
Start Your Next KMP App With Kotlin Toolchain 0.13
The Kotlin Toolchain is a unified entry point into Kotlin. It lets you build JVM, Android, iOS, multiplatform, and server-side applications with a simple declarative configuration. With the release of v0.13, we now recommend the Kotlin Toolchain for most new Kotlin Multiplatform (KMP) projects. Earlier this year, we promoted the Kotlin Toolchain to Alpha. Since […]
Laravel 13 now supports MariaDB Vector natively
If your Laravel application runs on MariaDB, you can add semantic search to it without a second database, an external vector service or an extra package. Since Laravel 13.28, vector columns, vector indexes and similarity queries work on MariaDB out of the box. A large part of that work came from community contributors, including Mohamed […] Laravel 13 now supports MariaDB Vector natively appeared first on MariaDB.org
VirtusLab assumes responsibility for Scala 2 maintenance
We are happy to announce that VirtusLab has assumed responsibility for maintenance of Scala 2 . This means that VirtusLab, in coordination with the Scala Center and the Scala Core Team, now manages the development of both Scala 2 and Scala 3. Former members of the Scala 2 team at Akka have joined the VirtusLab OSS team, so there will be no impact on Scala 2 maintenance or Scala 2’s future. Our plans for Scala 2 maintenance have long been documented at https://www.scala-lang.org/development/#scala-2-maintenance and the wordings there have not changed. VirtusLab will maintain Scala 2.12 and 2.1…
runc v1.6.0-rc.1 -- "Lo bueno, si breve, dos veces bueno."
This is the first release candidate of the upcoming runc 1.6.0 release. It contains a couple of new features, but is mostly made up of various cleanups (such as the removal of many deprecated APIs) and improvements. This version includes all of the patches backported to runc v1.5.2. Users are strongly encouraged to test our release candidates so we can fix issues before the general release. libcontainer API configs.ToCPUSet now returns a unix.CPUSetDynamic instead of a *unix.CPUSet , and the Initial / Final fields of configs.CPUAffinity and the Nodes field of configs.LinuxMemoryPolicy have ch…
Next.js 16.4
Next.js 16.4 introduces lazy compilation, smaller Turbopack output, React 19.3 features, Cache Components improvements, and new developer tooling.
Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-199)
Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, indepe…
Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-198)
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as text, which is subject to a nesting-depth limit, geometry constructed from a script's output is not bounded. An authenticated user wit…
Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-197)
Incorrect Authorization in Elasticsearch Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expan…
Elasticsearch 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-196)
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process's availab…
Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-195)
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large description field are created and subsequently accessed, exhausting available heap memory and crashing the affected node. Affected Versions: 8.x: All versions from 8.12.0 up to and including…
Elastic Agent / Endpoint 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-194)
Uncaught Exception in Elastic Endpoint Leading to Denial of Service Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabil…
Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193)
Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersona…
Elasticsearch 9.4.7, 9.5.3, 8.19.23 Security Update (ESA-2026-192)
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the manage_index_templates cluster privilege can register multiple resources each within the individual limit. Retrieving them toget…
Kibana 9.4.0 Security Update (ESA-2026-191)
Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorize…
Elasticsearch 9.4.8, 9.5.5 Security Update (ESA-2026-190)
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130). Affected Versions: 9.x: All versions from 9.2.0 up to and including 9.2.8 All versions from 9.3.0 up to and including 9.3.8 All versions from 9.4.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 No fix is available for the 9.2.x or 9.3.x release lines. Users should upgrade to a supported rele…
Elasticsearch 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-189)
Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers cat…
Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-188)
Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data str…
Kibana 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-187)
Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Bec…
Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-185)
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly, including by queries embedded in shared resources, causing persistent cluster unavailability. Affected Versions: 8.x: All v…
The Shift to cgroup v2 in Kubernetes: What You Need to Know
In Linux, cgroups (control groups) are a kernel feature used for managing system resources. Kubernetes uses cgroups to allocate resources like CPU and memory to containers, ensuring that applications run smoothly without interfering with each other. With the release of Kubernetes v1.31, support for v1 cgroup management moved into maintenance mode . Support for v2 cgroup management has been stable since Kubernetes v1.25. Compared with cgroup v1, cgroup v2 provides a single unified hierarchy, a more consistent interface, and a stronger foundation for resource isolation and modern resource-manag…
A faster, lighter C# Dev Kit
C# Dev Kit has been rebuilt to open solutions in about a second and run on a fraction of the memory, and this post walks through what changed for you. The post A faster, lighter C# Dev Kit appeared first on .NET Blog .
WordPress 7.1.3 Maintenance and Security Release
This security and maintenance release features 7 security fixes and 4 bug fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background […]
Tue, October 6
Django security releases issued: 6.1.2, 6.0.9, and 5.2.18
In accordance with our security release policy , the Django team is issuing releases for Django 6.1.2 , Django 6.0.9 , and Django 5.2.18 . These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant() django.utils.translation.get_supported_language_variant() was subject to a potential denial-of-service attack when processing many distinct, very long language codes. Language codes were used as keys in an in-memory cache before their length…
Preparing for Post Quantum DNSSEC with PowerDNS
Today’s widely used DNSSEC signatures rely on mathematics that a sufficiently capable quantum computer could break. The timing of that capability remains uncertain, but changing
Let's meet in October
Scala Days 2026 is just around the corner! Next week, on 12 and 13 October , the Scala community will come together at Kulturbrauerei in Berlin for two days of learning, sharing experiences, and catching up with friends and colleagues. The program opens with a keynote by Martin Odersky. There will also be interactive labs, giving you time to explore tools and ideas with their maintainers. Whether you use Scala every day or are getting to know the ecosystem, we look forward to welcoming you. If you’d like to stay a little longer, two-day workshops follow on 14 and 15 October at Hotel Oderberge…