Skip to content
chornous.dev

Type two or more letters. Esc closes.

Index of sheets
Theme

Sheet 03 · Tags / Security

All topics

#Security

15 posts · 0 projects

AWriting

  1. Apache httpd 2.4.71 fixes a critical mod_http2 race that leads to RCE: CVE-2026-119618The Apache HTTP Server Project released 2.4.71 on November 11, 2026. It fixes CVE-2026-119618, a critical race condition in mod_http2's assign_headers() that can lead to remote code execution in httpd 2.4.55 through 2.4.70, plus a mod_md crash and a mod_vhost_alias overflow.
  2. PostgreSQL 18.7 and friends fix 52 CVEs, end PostgreSQL 14, and ask you to reindexThe PostgreSQL Global Development Group released 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, 2026, with 52 security fixes and over 140 bug fixes. PostgreSQL 14 is now end-of-life, and several fixes need a reindex or a new full backup after you upgrade.
  3. Rust 1.100: the never type is stable, Infallible becomes !, and Cargo can hold back fresh cratesThe Rust Release Team shipped Rust 1.100.0 on November 12, 2026. The never type is stable after 10 years, older editions now fall back to ! instead of (), the core Allocator API works with Vec and Box, and Cargo gains a min-publish-age setting for dependency cooldowns.
  4. Next.js 16.4.5 and 15.5.29: seven fixes, four of them in Cache Components cachingVercel shipped the November 2026 Next.js security release on November 3 in v16.4.5 and v15.5.29. It fixes one high and six medium issues, including cross-tenant cache disclosure when unstable_cache wraps a use cache function and HttpOnly cookies leaking through x-middleware-set-cookie on Edge routes.
  5. OpenSSH 10.6p2: sshd on musl without PAM accepted any 257 to 1024 byte password for accounts marked *Portable OpenSSH 10.6p2 shipped on November 5, 2026 with a workaround for a password authentication bypass on Linux systems that use musl libc with PAM disabled. Alpine published fixed packages for 3.16 through edge the same day.
  6. Postman desktop 12.33.4 installed plugins and a SessionStart hook into Claude Code and Codex without asking, then revertedA Postman user reported on October 25, 2026 that the desktop app auto-installed its agent plugins into Claude Code and Codex, added a startup hook, and wrote a hook trust record into ~/.codex/config.toml. On November 5 a Postman team member said the company was reverting the change.
  7. LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for two hours: what to delete and what to rotateAttackers published a malicious litellm 1.107.0 on October 21, 2026, through LiteLLM's own release workflow pointed at a lookalike fork. The wheels drop cook.pth, cook.py and sitecustomize.py into site-packages, which run on every Python start. The last clean version is 1.106.2.
  8. Node.js 22.23.4, 24.22.1 and 26.12.1: a Brotli out-of-bounds write, three TLS hostname bypasses and repeated random UUIDsThe Node.js project shipped security releases for 22.x, 24.x and 26.x on October 21, 2026. They fix ten CVEs, four rated high, including an out-of-bounds write in the bundled Brotli decoder (CVE-2026-111497) and TLS hostname checks that non-canonical IPv4 spellings could fool.
  9. PHP2Shell: two critical PHP RCEs in OOM handling and stale worker state, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35The PHP team published GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) on October 21, 2026. Both score 9.2 on CVSS v4 and allow unauthenticated remote code execution as the web worker account. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  10. GitHub Actions gets lockfiles: gh actions-lock pins every action, including transitive ones, to a commitGitHub put workflow dependency lockfiles into public preview on October 14, 2026. The gh actions-lock CLI extension writes .github/workflows/actions.lock, runners re-check each pin at job start, and a Require lockfile policy lets admins enforce it.
  11. Next.js 16.4.1 and 15.5.28: two critical RCEs in use cache and SVG image optimization, plus a Server Actions DoSVercel published three Next.js advisories on October 14, 2026. A use cache function that returns typed arrays and the Image Optimization API on glibc Linux both allow unauthenticated remote code execution, rated CVSS 9.5. A Server Actions bug can pin the CPU. Upgrade to 16.4.1 or 15.5.28.
  12. GitHub drops SHA-1 RSA signatures over SSH and adds a post-quantum key exchangeGitHub's September 22, 2026 changelog removes the ssh-rsa signature type and diffie-hellman-group-exchange-sha256, requires 3072-bit RSA keys from October 14, and turns on mlkem768x25519-sha256. Brownouts land on November 4 and December 9.
  13. A web page could run code through OpenCode's local server: GHSA-632h-h47v-g4x4Datadog Security Labs disclosed a remote code execution bug in OpenCode 1.14.30 to 1.18.21 on September 24, 2026. A text/plain form post to the local /global/upgrade endpoint made npm install an attacker's tarball. OpenCode 1.18.22 fixes it.
  14. The next/og advisory, and another Next.js patch on September 30A critical advisory on September 22, 2026 covers Next.js 16.2.0 to 16.3.5 through the Node.js ImageResponse in next/og, and a scheduled release on September 30 will fix nine more issues. Triage steps for sites that render OG images.
  15. React Server Components advisories: build a patch laneCVE-2025-55182 let an unauthenticated request run code on any server that supports React Server Components, with a CVSS of 10.0. Researchers probing the fix found three denial-of-service bugs and a source leak over the next eight weeks. This post covers the timeline and a response plan that holds up when the next patch is also incomplete.