Vulnerabilities & updates
Page 4
Thu, October 22
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
影響: go:github.com/openchoreo/openchoreo >= 1.0.0, < 1.0.6 → 1.0.6, go:github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.7 → 1.1.7, go:github.com/openchoreo/openchoreo >= 1.2.0, < 1.2.5 → 1.2.5 The OpenChoreo API server authorized PUT .../workflowruns/{runName} against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A WorkflowRun's membership in a project and component is carried entirely by its openchoreo.dev/project and openchoreo.dev/component labels. Because the workflowrun:update check read those labels from the submitted object rather than the stored one, a caller holding…
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
影響: go:github.com/moov-io/signedxml <= 1.4.0 → 1.4.1 Exclusive XML canonicalization (http://www.w3.org/2001/10/xml-exc-c14n#) in github.com/moov-io/signedxml copied the entire accumulated namespace map at every node during ValidateReferences(), before any reference digest or signature check. For a chain of nested elements that each declare many unused namespace prefixes, that produced O(m × depth²) time and peak memory (m = prefixes per level). beevik/etree caps tree depth (~1024), but m is unbounded, so a small attacker-controlled document (on t…
PHP 8.6.0 RC4 available for testing
The PHP team is pleased to announce the third release candidate of PHP 8.6.0, RC4. This continues the PHP 8.6 release cycle, whose rough outline is specified in the . PHP Wiki Source downloads of PHP 8.6.0 RC4 are available on the . download page Please carefully test this version and report any issues found in the . GitHub Issues This version also contains the fixes for two critical vulnerabilities that can allow unauthenticated remote code execution. Everyone running earlier builds of PHP 8.6.0 is strongly encouraged to update immediately. Please DO NOT use this version in production, it is…
v2.9.8
2.9.8 / 2026.10.21 fix(compile): check read permission for dynamically imported local files ( #36925 ) fix(completions): complete script paths for bare deno run in zsh ( #36976 ) fix(core): keep op contexts alive until the isolate is disposed ( #37026 ) fix(coverage): skip the V8 code cache while collecting coverage ( #36901 ) fix(ext/fetch): bump hyper-util to 0.1.21 and hyper to 1.11.1 to cancel idle interval when pool empties ( #36968 ) fix(ext/napi): check napi_create_dataview bounds for overflow ( #36962 ) fix(ext/napi): ignore the callback return value while an exception is pending ( #3…
Wed, October 21
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
影響: npm:apostrophe < 4.33.0 → 4.33.0, npm:@apostrophecms/import-export < 3.7.0 → 3.7.0 A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware() before the actual import handler performs its authentication check. Because no authorize callback is supplied to bigUploadMiddleware(), unauthenticated requests can reach the aposBigUpload start, chunk, and end operations before the later req.user check rejects the import. As…
Critical PHP Security Release
The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place […]
PowerDNS Recursor 5.3.13 Released
Today we have released PowerDNS Recursor 5.3.13. This release is a maintenance release that includes a single improvement:
PHP critical vulnerability response updates
At 13:40 UTC two critical security vulnerabilities were disclosed and patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Action may be required, read below.
PowerDNS Security Advisory 2026-13 for PowerDNS Authoritative Server
Today, we are releasing three new versions of the PowerDNS Authoritative Server. These 4.9.18, 5.0.8 and 5.1.5 versions provide fixes for the following PowerDNS Security Advisory:
PowerDNS Security Advisory 2026-12 for PowerDNS Recursor
Today we have released PowerDNS Recursor 5.3.12 and 5.4.8. These releases provide fixes for PowerDNS Security Advisory 2026-12 for PowerDNS Recursor: Multiple issues There are several CVEs associated with this advisory, three with severity High and the remaining with severity Medium or Low .
Security advisory: Critical remote code execution vulnerabilities, update now
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. Who is at risk: The vulnerabilities: , CVE-2026-109618 (): out-of-memory handling can interrupt PHP while internal request data is onl…
PHP 8.5.12 Released!
The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.5.12 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.27 Released!
The PHP development team announces the immediate availability of PHP 8.4.27. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.4 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.4.27 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.36 Released!
The PHP development team announces the immediate availability of PHP 8.3.36. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.3.36 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Weekly Report: 複数のマイクロソフト製品に脆弱性
複数のマイクロソフト製品に脆弱性
Weekly Report: SiteGuard Server EditionにOSコマンドインジェクションの脆弱性
SiteGuard Server EditionにOSコマンドインジェクションの脆弱性
Weekly Report: JPCERT/CCが「連続不正アクセス事案の攻撃手法に関する調査」を公開
JPCERT/CCが「連続不正アクセス事案の攻撃手法に関する調査」を公開
Weekly Report: GitLabに複数の脆弱性
GitLabに複数の脆弱性
Weekly Report: ProgressのMarkLogic Serverに複数の脆弱性
ProgressのMarkLogic Serverに複数の脆弱性
Weekly Report: ((OTRS)) Community Editionに認証回避の脆弱性
((OTRS)) Community Editionに認証回避の脆弱性
Weekly Report: AssetViewに重要なリソースに対する不適切なアクセス権の割り当ての脆弱性
AssetViewに重要なリソースに対する不適切なアクセス権の割り当ての脆弱性
Weekly Report: Ivanti Connect Secureに認証回避の脆弱性
Ivanti Connect Secureに認証回避の脆弱性
Weekly Report: 複数のFortinet製品に脆弱性
複数のFortinet製品に脆弱性
Weekly Report: 複数のSAP製品に脆弱性
複数のSAP製品に脆弱性
Weekly Report: 複数のMozilla製品に脆弱性
複数のMozilla製品に脆弱性
Weekly Report: 複数のZoom製品に脆弱性
複数のZoom製品に脆弱性
Weekly Report: Cisco Secure Email Gatewayに任意のファイル書き込みの脆弱性
Cisco Secure Email Gatewayに任意のファイル書き込みの脆弱性
Weekly Report: 複数のPalo Alto Networks製品に脆弱性
複数のPalo Alto Networks製品に脆弱性
Weekly Report: NextcloudのCollabora Online - Built-in CODE Serverに脆弱性
NextcloudのCollabora Online - Built-in CODE Serverに脆弱性
Weekly Report: EC-CUBE4系用プラグイン「AmazonPayプラグイン」に不変と想定しているWebパラメータの外部制御の脆弱性
EC-CUBE4系用プラグイン「AmazonPayプラグイン」に不変と想定しているWebパラメータの外部制御の脆弱性
Weekly Report: Next.jsに複数の脆弱性
Next.jsに複数の脆弱性
Weekly Report: Google Chromeに複数の脆弱性
Google Chromeに複数の脆弱性
Weekly Report: 複数のAdobe製品に脆弱性
複数のAdobe製品に脆弱性
Weekly Report: Drupal coreおよび複数のモジュールに脆弱性
Drupal coreおよび複数のモジュールに脆弱性
Weekly Report: 複数のNGINX製品に脆弱性
複数のNGINX製品に脆弱性
Weekly Report: BeyondTrust Remote Supportになりすましによる認証回避の脆弱性
BeyondTrust Remote Supportになりすましによる認証回避の脆弱性
Weekly Report: 複数のJuniper Networks製品に脆弱性
複数のJuniper Networks製品に脆弱性
Weekly Report: Microsoft Edgeに複数の脆弱性
Microsoft Edgeに複数の脆弱性
PHP 8.2.35 Released!
The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version. For source downloads of PHP 8.2.35 pleas…
GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
On October 21, 2026, we released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There ar…
Python 3.15.1, 3.14.9 and 3.13.17 are out
Three certified security releases for 3.15, 3.14 and 3.13.
Help set Go's priorities for next year
Share your experience with Go in the 2026 Go Developer Survey, open through November 3.
PHP 8.2.35 released!
There is a new PHP release in town!
PHP 8.3.36 released!
There is a new PHP release in town!
PHP 8.4.27 released!
There is a new PHP release in town!