GitLab CVE-2026-110264: CVSS 10.0 RCE Hits Every Version Since 2014 — Patch Now
GitLab shipped an emergency patch on October 21 for CVE-2026-110264, a CVSS 10.0 unauthenticated remote code execution flaw that reaches every self-managed Community ...
eMudhra CA Compromise: A Private Key Was Just the Integer 4
Eight eMudhra CA private keys were cracked in under a second — one was the ...
LiteLLM PyPI Supply Chain Attack: Rotate Your Keys Now
LiteLLM 1.107.0 shipped a credential stealer to PyPI today. Every Python process on your machine ...
Lightwell Clearinghouse Is GA: 400 Java CVEs Fixed
Lightwell Clearinghouse is GA. IBM and Red Hat fixed 400 Java CVEs. What AI agent ...
Node.js October 2026 Security Patch: Three HIGH CVEs — Upgrade Now
Node.js shipped HIGH-severity patches for 22.x, 24.x, and 26.x today. CVE-2026-21710 crashes any HTTP server ...
PHP Core RCE: Patch CVE-2026-109618 Before Exploitation Hits
PHP patches two CVSS 9.2 RCE flaws today — fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and older get no official patch. ...
GitHub Package Firewall: npm Gets a Supply Chain Safety Net
GitHub Package Firewall blocks malicious npm before install. Here’s what the four controls do, who ...
Go 1.27.3: Eight CA Keys Blocked — Rebuild Now
Go shipped an emergency security update today. Go 1.27.3 and Go 1.26.10 hardcode a block ...
Aoki Infostealer Targets AI Coding Credentials
The Aoki infostealer now harvests Claude, Cursor, Copilot, and Codex credentials from local files. Here ...
GhostAction Hits 30,000 GitHub Repos: Rotate Your Secrets Now
GhostAction compromised 1,900 GitHub accounts and targeted 30,000 repositories on October 8–9. Check if your ...