openssh 10.6 notes, paraphrased: AI-found bugs keep getting rediscovered by a second researcher, so assume attackers have them too. they're done batching fixes, releases come more often now. same drop: LZ77 off in ssh compression (one channel could leak plaintext from another through the shared dictionary), and `$` / `\` refused in command-line usernames because ProxyCommand and Match exec could turn them into shell.

your gitea runner said `privileged: false`. the workflow still got `--pid=host`. act_runner only forced `Privileged=false`. `container.options` from the YAML kept PidMode / IpcMode / CapAdd / SecurityOpt. shared Docker runner + anyone who can open a PR → root on the host via `nsenter`. CVE-2026-73802 / GHSA-x4q3-gcj3-m6cf. Critical. bump gitea runner ≥3.0.0 (strips those options unless an admin actually enables privileged).

apache httpd 2.4.69 is out. not a "unauth RCE for everyone" drop — read the ratings. the one that matters for most installs: mod_http2 use-after-free / wild write via shared `session->bbtmp` re-entrancy. moderate. 2.4.0–2.4.68. there's also a "limited RCE" if a CGI internal-redirects to a no-extension file already inside a CGI directory. apache rated that low. don't inflate it. bump 2.4.69.

sveltekit (and nuxt) will happily put another user's `Authorization` header in your HTML. devalue's `stringify`/`uneval` serialized a Node `Buffer` by dumping its whole shared pool — up to 64 KB of unrelated process memory. public `load()` returns a 2-byte Buffer → cross-request leak. no auth. every render. CVE-2026-92708 / GHSA-j22f-vq7h-c4qm. High. ≥5.1.0 ≤5.9.2. bump devalue ≥5.9.3 (or `new Uint8Array(buf)` until then). ~18M weekly.

python's documented SNI path could free the `SSLContext` under you. `sni_callback` swaps `SSLSocket.context` to pick a cert per name. if nothing else keeps the old context alive, an unauth TLS client can crash the server or call through a freed pointer. clients: fine. one long-lived context on the listening socket: not this. CVE-2026-19445. Critical. bump 3.10.22 / 3.11.17 / 3.12.15 / 3.13.16 / 3.14.8. until then keep a ref to every `SSLContext` that sets `sni_callback` for the life of the server. 3.10's last release.

the official MCP Python SDK would send your OAuth `client_secret` to whatever token endpoint the MCP server named. return 404 on protected-resource metadata → fallback discovery skips the issuer check → attacker sets `issuer` to your real IdP so credential binding still passes → `client_secret` + auth code + PKCE verifier land on their endpoint. real login page. looks like a flaky server after. GHSA-qx49-fqc8-xw99. 1.9.1–1.29.1 and 2.0.0–2.1.1. bump 1.30.0 / 2.2.0. ClientCredentials / PrivateKeyJWT: also pass `issuer=`. stdio + MCP servers: not this.

shell-quote "fixed" newlines inside `#` comments. a newline in the token *after* `{ comment }` still ends the comment. rest of that string runs as shell. `quote(['echo','ok',{comment:'x'},'a\nid;#'])` → `id` incomplete fix of CVE-2026-9277. now CVE-2026-102422. ≥1.8.4 <1.11.0. bump to 1.11.0.

froxlor fixed the export-cron symlink once. the second fix still skipped the first path segment. customer schedules DataDump into a real subdir, swaps an intermediate component for a symlink before root cron, `chown -R` follows it. advisory example: `/etc`. deterministic, no race. incomplete fix of GHSA-75h4. CVE-2026-100716 / GHSA-2wjc-6mgx-hq42. needs export enabled. advisories say ≤2.3.10 / patch 2.3.12; security lines shipped in 2.3.11 notes — prefer ≥2.3.12 (or 2.3.14).

opencode's /global/upgrade took text/plain like it was JSON. visit a page → browser POSTs a "version" that's actually an attacker tarball URL → npm install -g runs the preinstall. needs `opencode serve`/`web` + npm/pnpm/bun install. curl/brew path skips this. fix 1.18.22+. no CVE (Anomaly skipped).

next/og ImageResponse on Node just turned a bad SVG escape into RCE. satori put attacker-controlled values into the SVG raw. next/og rendered that through other deps. a query param in is the advisory's example. CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j. 16.2.0–16.3.5. fix 16.3.6. Edge ImageResponse and Next 15: not this RCE. 15.5.26 is hardening only.

memtensor's MemOS just shipped a Go worm as "latest" on npm and PyPI. @memtensor/memos-cloud-openclaw-plugin 0.1.21/23/25 + MemoryOS 2.0.34. start OpenClaw / import memos → sckit stage0. scrapes $HOME for npm, PyPI, GitHub, AWS tokens. looks built to republish. pin npm 0.1.20 / PyPI 2.0.33. rotate if you loaded it.

mina said the Proxy allow-list bypass was "fully addressed" in 2.0.29 and 2.1.13. resolveProxyClass only shipped on 2.2.x. those "fixed" jars — and 2.0.30 / 2.1.14 after them — still take the same java.lang.reflect.Proxy bypass. CVE-2026-94301. real fix: 2.0.31 / 2.1.15 (or stay on 2.2.8+).

npm provenance attested the malicious @dforge-core/[email protected] build. OIDC trusted publishing. attacker's commit in the sigstore log. nothing forged — provenance says where it was built, not whether the source was honest. 35 minutes as latest. implant deletes itself on run. no OSV / GHSA / maintainer advisory for anyone still holding 0.2.21. CloudSEK (GHAPPIER). pin ≥0.2.22.

Fragnesia got patched. Open vSwitch just reopened the same page-cache write. OVS strips SKBFL_SHARED_FRAG on a still-forwarded skb → ESP decrypts in place → deterministic unprivileged LPE on default Arch/Fedora/Debian/Amazon Linux/RHEL (userns + ovs autoload). CVE-2026-90049 / 89487 / 80977. Ubuntu AppArmor userns default: not hit. Check your distro kernel. blog.doyensec.com/2026/09/17…

Docker Sandboxes on Mac just ate a Critical guest→host escape. virtio-fs host server follows a symlink after delete/reopen. Guest gets arbitrary host FS R/W as the VMM user. CVE-2026-77179. Fix: Sandboxes 0.42.0+. docs.docker.com/security/sec…

four local roots just dropped with working PoCs: DirtyAH6, TUNderflow, PPPoEject, DiagSpill. bugs were 10–21 years old. first three want unprivileged userns (or CAP_NET_*). DiagSpill doesn't — SCTP + sctp_diag is enough. upstream with all four: 5.10.270 / 5.15.221 / 6.1.188 / 6.6.157 / 6.12.109 / 6.18.50 / 7.2.4 heyitsas.im/posts/lpe-quarte…

vite --host is still a credential printer. ?raw / ?import&raw / ?import&url&inline skips server.fs.deny. .env and certs come back 200. CVE-2026-39364. fix 7.3.2 / 8.0.5 (vite-plus 0.1.16). CSA just pinged active exploitation (AL-2026-124). F5 saw ~32k Aug scan events for exposed @fs.