vm2 Node.js Sandbox Escape: 13 Critical CVEs, Two Unpatched
vm2 — the Node.js library with 1.5 million weekly downloads used to run untrusted JavaScript safely — just had 13 critical vulnerabilities disclosed. ...
Exchange Zero-Day CVE-2026-42897: One Email Owns Your OWA
An attacker sends one email. The victim opens it in Outlook Web Access. No attachment, ...
Laravel-Lang Supply Chain Attack: 700 Repos Poisoned — Rotate Now
A supply chain attack rewrote 233 Laravel-Lang Composer package versions via Git tag manipulation. If ...
Quasar Linux RAT Targets Developer Credentials: Check Now
The QLNX Linux RAT targets developer dotfiles — npm tokens, AWS keys, kubeconfig — with ...
Cloudflare Flagship: Feature Flags Without Latency
Cloudflare Flagship evaluates feature flags inside your Worker via a native binding—no HTTP round-trip, no ...
GitHub Actions 2026 Security Roadmap: Lock Your Pipeline
GitHub's 2026 Actions security roadmap ships dependency locking, a native Layer 7 egress firewall, and scoped secrets. Here's what's coming and what to ...
OpenTofu 1.12: Dynamic prevent_destroy, the Feature Terraform Never Shipped
OpenTofu 1.12 shipped May 14 with the feature Terraform users have been requesting since 2016: ...
Linux 7.0 io_uring: BPF Filtering Ends the Security Debate
Linux 7.0 adds BPF filtering to io_uring, closing the security gap that forced teams to ...
Ingress NGINX Is Dead — Migrate to Kubernetes Gateway API Now
kubernetes/ingress-nginx reached EOL on March 24, 2026. No more CVE patches. Use ingress2gateway 1.0 to ...
70% of Dev Teams Run AI Agents on the Wrong Infrastructure
Coder Agents launches in beta — a self-hosted, model-agnostic AI coding platform where source code, ...