Vulnerabilities & updates
Page 11
Tue, October 6
Scaling Kubernetes Workloads with Node Swap
Memory is often the first hard limit a Kubernetes cluster hits. Nodes run out of RAM long before they run out of CPU, and the new wave of agentic AI workloads makes this worse. These workloads demand large memory footprints to start up and run untrusted code, then sit idle waiting for the next prompt. That idle but resident memory is expensive, and it caps how many pods a node can hold. This is where swap helps. Kubernetes support for running nodes with swap enabled reached General Availability in v1.34, and by backing that swap with fast NVMe solid state drives (SSDs), a node can page out do…
UWP and WinUI 3 apps: UI testing with MSTest
Learn how to test UWP and WinUI 3 apps with MSTest and Microsoft.Testing.Platform across packaged, unpackaged, and AppContainer hosts. The post UWP and WinUI 3 apps: UI testing with MSTest appeared first on .NET Blog .
Mon, October 5
Discontinuing Swift Language IDE Support in the Kotlin Multiplatform Plugin
Starting with IntelliJ IDEA 2026.3 and Android Studio Rabbit 2 | 2026.2.2, we’re discontinuing Swift language IDE features in the Kotlin Multiplatform (KMP) plugin. This includes editing, syntax highlighting, and navigation within Swift files and between Swift and Kotlin. Running iOS applications and debugging Kotlin code on iOS will remain fully supported. Kotlin/Native functionality, such […]
Sun, October 4
[悪用確認] CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-07)
Fri, October 2
Laravel September product updates
Laravel Cloud added isolated preview environments and request metrics. The framework added per-tenant AI keys and semantic search. See what's new in September.
GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1
We have released versions 19.2.4, 19.3.2, and 19.4.1 of the GitLab AI Gateway. These versions contain a critical security fix for GitLab Self-Hosted AI Gateway, and we strongly recommend that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately. We have conducted targeted outreach to Self-Hosted AI Gateway customers prior to this release post with this guidance. A fix has already been deployed for GitLab-hosted AI Gateways. Customers using GitLab.com, GitLab Dedicated, and GitLab Self-Managed instances using a GitLab-ho…
Arch-specific SIMD in Go
Go 1.27 introduces experimental arch-specific SIMD vector APIs
Demoting i686 Windows targets to std-only
With Rust 1.100.0, the following changes to 32-bit Windows targets will happen: i686-pc-windows-msvc Tier 1 with host tools target will be demoted to Tier 1 without host tools. i686-pc-windows-gnu Tier 2 with host tools target will be demoted to Tier 2 without host tools. Builds of the standard library will continue to be distributed, but host tools such as the compiler will be no longer available. i686-pc-windows-msvc as a Tier 1 target still undergoes CI testing. To build 32-bit Windows binaries, cross-compiling from a still-supported host toolchain (such as a 64-bit Windows ones) will be r…
Rails World recordings are online, new minimum Ruby version and more!
Hi, it’s Greg. Let’s explore this week’s changes in the Rails codebase.
Python 3.15.0 candidate 3 is here!
Following tradition, a surprise rc3!
[悪用確認] CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH Zammad Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-05)
[悪用確認] CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability
Zammad GmbH Zammad Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-05)
Thu, October 1
Nominate Someone for the 2026 Malcolm Tredinnick Memorial Prize
Hello Everyone 👋 It is that time of year again when we recognize someone from our community in memory of our friend Malcolm. Malcolm was an early core contributor to Django and had a huge influence on the Django we know today. Besides being knowledgeable, he was also especially friendly to new users and contributors. He exemplified what it means to be an amazing Open Source contributor. We still miss him to this day. The prize Our prizes page summarizes it nicely: The Malcolm Tredinnick Memorial Prize is a monetary prize, awarded annually, to the person who best exemplifies the spirit of Mal…
PowerDNS Recursor 5.3.11 and 5.4.7 Released
Today we have released PowerDNS Recursor 5.3.11 and 5.4.7. These are maintenance releases that fix bugs and include a few improvements. The most important ones are:
Announcing Rust 1.99.0
The Rust team is happy to announce a new version of Rust, 1.99.0. Rust is a programming language empowering everyone to build reliable and efficient software. If you have a previous version of Rust installed via rustup , you can get 1.99.0 with: $ rustup update stable If you don't have it already, you can get rustup from the appropriate page on our website, and check out the detailed release notes for 1.99.0 . If you'd like to help us out by testing future releases, you might consider updating locally to use the beta channel ( rustup default beta ) or the nightly channel ( rustup default nigh…
Rails World 2026 recap: All talks online
Happy to report that in record time, all Rails World 2026 talks are now online.
Python 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8 are now available!
Security updates across Python 3.10–3.14, the final maintenance release of 3.13, and a farewell to Python 3.10.
[悪用確認] CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability
Fortinet FortiMail Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-04)
September 2026 Security Release
The September 2026 security release for Next.js is now available
Migrating Pinkary from Laravel Forge to Laravel Cloud: An engineering playbook
Pinkary's move from Laravel Forge to Laravel Cloud exposed SQLite and MySQL differences, query assumptions, and local-storage coupling. Here is the code-backed migration playbook.
Wed, September 30
Python Language Summit 2026
The 2026 Python Language Summit was hosted in Kraków, Poland as part of EuroPython 2026. There were 15 talks covering free-threading, Rust, garbage collection, type annotations, and more.
Lightning Talks (Python Language Summit 2026)
Lightning talks on a one-time ABI break, safer interruptions, EktuPy (Scratch but Python), an AGENTS.md file for CPython, and a call to read PEP 836.
PEP 827: Type Manipulation (Python Language Summit 2026)
Michael J. Sullivan presents PEP 827 and discusses a key design decision: how to store type annotations?
Free-Threaded Python Post-Era (Python Language Summit 2026)
Tobias Wrigstad, Fridtjof Stoldt, and Donghee Na propose a safe and performant, high-level concurrency model for free-threaded Python
Developer-in-Residence Update & Future (Python Language Summit 2026)
Petr Viktorin gives an update on the Developer-in-Residence role and asks Python core developers for projects to prioritize
Spicycrab (Python Language Summit 2026)
Kushal Das shows off Spicycrab, a Python-to-Rust transpiler for Python users who need performance without learning Rust or leaving Python
Rust for CPython (Python Language Summit 2026)
David Hewitt shares a status update, first module, and potential acceptance criteria for the Rust for CPython project
Memory Snapshots for CPython (Python Language Summit 2026)
Hood Chatham proposes memory snapshots and an initialization phase for speedier Python startups
Memory Buffer Protocol (Python Language Summit 2026)
Nathan Goldbaum proposes safe concurrent access through buffer leases and custom data types for the Python Buffer Protocol.
Garbage Collection: Generational? Incremental? Both! (Python Language Summit 2026)
Mark Shannon proposes a future garbage collection strategy for Python following the revert of the incremental garbage collector in Python 3.14
macOS and Python (Python Language Summit 2026)
Ned Deily weighs whether Python should continue shipping macOS installers
One namespace to namespace them all (Python Language Summit 2026)
Pablo Galindo Salgado proposes a top-level `std` namespace for the Python standard library to prevent module shadowing and free up module names.
The Companions to Come
We are working on extensions to our companions mechanism to unlock new code patterns and improve interoperability across different platforms. This post outlines these new features and provides preliminary guidance on migration. Companion blocks and extensions Many programming languages provide a notion of class or type members – functionality that does not belong to each […]
[悪用確認] CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-03)
Tue, September 29
End of Life Announcement: Debian 11
On the 31st of August of this year (2026) Debian 11 "Bullseye" reached the end of its Long Term Support period, at which point we consider Bullseye to be End of Life. As we do not want to support our software running in unpatched environments, we have stopped building for Debian Bullseye. After the 1st of January 2027, we will start removing all repositories for this unsupported distribution from https://repo.powerdns.com/ . Users are recommended to upgrade their systems to supported operating system versions, such as Debian 12 or 13, or RHEL 9, 10, or any of the popular derivatives of RHEL.
The State of Kotlin in 2026 Report
In 2026, Kotlin turned fifteen. Over those fifteen years, Kotlin has built a mature ecosystem, been adopted by companies around the world, and established a large and active developer community. Fifteen years is long enough to understand which technology trends lasted and which didn’t. This report looks back at Kotlin’s first fifteen years to see […]
[悪用確認] CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability
Apple Multiple Products Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-13)
Build Agentic UI with the new Blazor AI components
Build Agentic UI with the new Blazor AI components for streamed content, tools, approvals, shared state, and generative experiences. The post Build Agentic UI with the new Blazor AI components appeared first on .NET Blog .
Mon, September 28
Preview environments and scale to zero: Better together
Give every pull request its own preview environment on Laravel Cloud. Share a link, test the full stack, and let idle previews scale to zero.
A More Reliable Compilation Scheme for Kotlin Multiplatform Modules
The current compilation approach to Kotlin Multiplatform projects works, but sometimes can lead to unexpected or hard-to-predict behavior. For example: With Kotlin 2.5.0-Beta1, we introduced an optional “separate compilation” approach to KMP that solves both problems: make the compilation results consistent with IDE analysis, and point more consistently to problematic calls of library code from […]
8.12-m02-int: Explain a test [TIMEOUT] instead of killing it silently (#15879)
A hung test run tells us almost nothing today. When no client has made progress for --timeout seconds, test_server_cron prints the clients' last reported state, SIGKILLs every server via force_kill_all_servers and exits; --dump-logs only fires for a failed or excepted test, never for a timeout. So a 20-minute hang costs a whole CI run and produces a few lines. Collect the evidence before tearing the run down: Crash-report the surviving servers. SIGSEGV makes redis log a stack trace of every one of its threads plus INFO, the client list and the config (printCrashReport) and then die. The handl…
Sun, September 27
[悪用確認] CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability
Citrix NetScaler Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-09-30)
[悪用確認] CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-09-30)
Sat, September 26
The Python documentation is now available in German
You can now read the Python documentation online in German!
runc v1.5.2 -- "Всё сбудется, стоит только расхотеть!"
This is the second patch release in the 1.5.z release series of runc, which primarily includes a workaround for a Linux kernel bug causing random runc crashes when using cgroup v2, and other fixes. Fixed runc exec -p with a process.json lacking env now sets HOME again (a regression in runc 1.3.0). ( #5265 , #5266 , #5459 ) Worked around a Linux kernel bug (present since kernel v6.17, fixed in v7.2) which caused the kernel to write past the end of the structure provided by userspace (runc). This resulted in memory corruption inside runc (manifesting as random crashes) when configuring device r…
AG-UI Protocol now has a first-class .NET SDK
The new AG-UI .NET SDK enables .NET services to expose and consume interoperable agent endpoints using Microsoft.Extensions.AI. The post AG-UI Protocol now has a first-class .NET SDK appeared first on .NET Blog .
Fri, September 25
Elasticsearch 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-184)
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.2 Affected Configurations: All configurations Solutions and Mitigations: The issue is resolved in version 8.19.22, 9.4.7, 9.5.3. The versions above are the first releases that contain the fix where later releases al…
Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-183)
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.3 Affected Configurations: All configurations Solutions and Mitigations: The issue is resolved in version 8.19.22, 9.4.7, 9.5.4. The versions above are the first releases that contain the fix where later releases al…