Caddy 2.11.9 fixes PHP directory regressions and FastCGI security bypasses
The immediate follow-up to 2.11.8 restores trailing-slash PHP directory indexes and hardens FastCGI script selection and authentication boundaries.
Search
Search results for “WordPress Core security”
Find published research by company, product, platform or technology.
Showing 41–60 of 279 dossiers
Nuxt 4.6.4 fixes eleven Nuxt and Nitro security advisories after the 4.6 overhaul
The November 2 follow-up supersedes 4.6.3 as the security upgrade target, with behaviour changes affecting custom dev hostnames, cached responses and route rules.
Woodpecker CI 3.20.1 tightens runner credentials and tenant isolation — avoid the 3.20.0 regression
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
PostgreSQL Anonymizer 3.3 patches 12 masking bypasses — upgrades require more than a version bump
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Artificial IntelligenceWeb DevelopmentJavaScriptAI CodingBrowsers & Web StandardsDeveloper ToolsActive dossier
Google's AI bug hunter finds different V8 flaws from fuzzing — Project Zero says keep both
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
Umami 3.4.1 urges self-hosters to patch Next.js RCE and MCP OAuth leakage
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
Railway warns of possible decrypted customer secrets as builds recover in stages after security incident
Railway has not confirmed every customer was breached. Precautionary all-customer rotation guidance, revoked API tokens and deployment disruption make this actionable for builders.
PHP2Shell actively exploited before disclosure, as emergency PHP fixes race into production
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
Cloudflare Gateway can now run Workers inside web-security traffic — without a separate proxy
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
Neon opens live SQL subscriptions in Realtime beta — but row-level security is not ready
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.
Pgpool-II patches seven watchdog and certificate-authentication vulnerabilities
Pgpool-II operators should upgrade to the October 1 security releases and review watchdog network exposure and certificate-authentication configuration.
Cloudflare gives Free and Pro sites a full month of traffic and security analytics
Small sites can now compare a full month of HTTP, security and DNS activity without upgrading Cloudflare plans. The October 2 change applies to adaptive analytics, not every dataset.
PostgreSQL JDBC 42.7.14 closes authentication and SQL-data leakage flaws
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
Fastly puts model routing, AI budgets and prompt-injection controls into the edge request path
The interesting part of Fastly’s AI launch is consolidation: model gateway economics, LLM security and agent-to-API authorization now sit in the same request path as the CDN/WAF infrastructure many applications already use.
npm v12 makes install scripts opt-in — while publishing automation gets a stage-only trust boundary
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
Gemini CLI 0.60 hardens the boundaries around extensions, sandboxes and MCP OAuth
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
Postmark can now restrict API email sending to trusted IP ranges
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
Next.js patches two unauthenticated critical RCEs in 16.3.3 and 15.5.24
The previously pre-announced Next.js security release is now available. Teams on affected versions should upgrade to 16.3.3 or 15.5.24; the disclosed flaws can lead to unauthenticated remote code execution under specific image-optimization or Windows-hosting conditions.
Adobe Commerce’s August patch fixes an unauthenticated account-takeover flaw already seeing exploitation attempts
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
PostgreSQL retires RHEL 9.6 and 10.0 RPM repositories, ending package updates on those minor releases
PGDG's 20 October repository retirement requires RHEL, Rocky and AlmaLinux 9.6/10.0 operators to update their OS minor release or deliberately switch to the frozen archive. Rolling EL9 and EL10 repository packages are unaffected.