E-Maj 5.0.1 closes a PostgreSQL superuser escalation path for extension administrators
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
Search
Search results for “multi-tenant sandbox security”
Find published research by company, product, platform or technology.
Showing 81–100 of 385 dossiers
Go servers inherit Linux TCP kernel risk through default MPTCP listeners — patch the kernel, not just Go
A Linux IPv4 TCP use-after-free can be exploitable through network-facing Go services even when their own dependencies are current. Check the running kernel and vendor patch status; a GODEBUG setting does not remove the kernel flaw.
DeadTag turns abandoned website scripts into an iPhone spyware delivery network
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
eMudhra weak CA keys were used to forge certificates within hours — Cloudflare finds many clients still accept them
Cloudflare saw roughly 22,000 weak-chain TLS handshakes, about 160 unusual forged certificates and 50 million skewed challenge-page probes. The data indicate continuing exposure, not 22,000 successful attacks.
Rust 1.98.1 and 1.99.1 fix separate compiler miscompilations — rebuild affected binaries
The October 15 Rust 1.99.1 release fixes a separate FFI bool miscompilation after September's 1.98.1 vtable bug. Check toolchain pins and rebuild artifacts produced by either affected compiler.
PingCAP confirms TiDB Cloud customer records exposed through internal credentials — rotate management keys
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
Six of eight SVG sanitizers failed PortSwigger's tests — browser parsing makes upload safety harder
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
Tailscale 1.104.4 fixes Tailworm SSH root-escalation path — headscale needs separate review
Tailscale 1.104.4 is now tagged as a stable release after Tailworm's SSH and Serve findings. Audit SSH forwarding, update clients and assess headscale separately.
Artificial IntelligenceWeb DevelopmentSaaSCloud & InfrastructureAI AgentsSaaS OperationsDeveloper ToolsObservabilityActive dossier
MLflow CrewAI tracing leaked API keys into telemetry — upgrading does not remove old secrets
MLflow CrewAI autologging silently logged API keys; 3.17.0 patches it, but previously exported traces and keys still need remediation.
HTTP/3 QPACK amplification can exhaust servers: patched quiche and quic-go, exposed Bun and h3
HTTP/3 isn't automatically safe from compressed-header denial of service. Check the exact QUIC/QPACK library and version behind your proxy or app, upgrade fixed stacks and limit or disable vulnerable HTTP/3 endpoints.
Cloudflare WAF can now correlate malicious requests with origin responses and block the reply
Request-only WAF rules cannot always tell whether an exploit succeeded. Cloudflare now correlates requests with origin responses, adds managed response blocking and permits three custom response rules.
WordPress 7.2 Beta 1 adds a Secrets API so plugins can stop storing API keys as plaintext options
WordPress 7.2 Beta 1 landed October 20 with wp_set_secret and wp_get_secret, encrypted storage, current/previous versions and pluggable back ends. Existing plugin credentials do not migrate automatically; the final release is scheduled for December 8.
Google Ads will require financial-service credentials in the US and Canada from early 2027
Financial advertisers in the US and Canada face a new Google Ads verification gate in 2027. Google will announce accepted registries and onboarding details before enforcement; it is not a current blanket ad ban.
Laravel discloses critical TokenGuard account takeover flaw and a separate data-loss bug
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
PHPUnit hardens agent-read test output and repairs machine-readable XML reports
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
PgBouncer 1.26.1 closes a SCRAM authentication bypass that can reach database superusers
PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.
WordPress rewrites wp_kses around the HTML API — plugin sanitisation output can change
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
Inertia.js 3.9 fixes cached protected pages resurfacing after logout
Inertia.js 3.9 flushes prefetch entries when history is cleared, preventing a previously visited protected page from reappearing from client cache after logout.
pgvector 0.8.7 patches an IVFFlat index-build overflow with potential code execution
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
Laravel AI SDK patches an SSRF path in its Vercel and AG-UI file adapters
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.