News
GitLab Vulnerability Roundup: Self-Managed Servers Should Be on 19.1.2 or Later
SecurityDevelopmentInfrastructure
On June 24, 2026, GitLab fixed 14 more vulnerabilities at once, including a flaw that lets a developer run malicious code in another user's screen and one that leaks information from its AI feature. Companies running GitLab on their own servers should update now to the latest releases (19.1.1 / 19.0.3 / 18.11.6). GitLab.com users are already covered.
2026.06.1152 views
Lab
npm v12 shipped: install scripts off by default, Node still on 11.x
DevelopmentSecurity
With npm v12 (July 2026), npm install stops auto-running dependency install scripts. We reproduce a postinstall running on its own, explain what changes, the benefits you never noticed, and how to prepare today.
2026.06.11117 views
News
Ghidra 12.1.2 Still Has an Unpatched Hole: CVE-2026-18718
SecurityDevelopment
Four serious flaws in NSA's free analysis tool Ghidra (CVE-2026-52751/49498/52754/52758, all CVSS 8.8). The worst, CVE-2026-52751, needs no auth: opening a crafted project file runs arbitrary code. The other three hit Ghidra Server with DB takeover and impersonation. Update to 12.1.2 now.
2026.06.1176 views
Column
Rebuilding Kakaku.com's 30-Year-Old Code With 71 AI Agents
AIJapanese CompaniesDevelopment
Kakaku.com is rebuilding its 30-year-old, 9.6M-line system with 71 AI agents on Python and FastAPI. I agree with the stack, but ask why the tied candidates lost, and the cost of over-trusting AI.
2026.06.1065 views
News
LiteLLM CVE-2026-42271: 1.83.7 isn't enough, upgrade to 1.84.0+
AISecurityDevelopment
LiteLLM, the popular gateway fronting 100+ AI services, has a server-takeover flaw (CVE-2026-42271). Chained with a Starlette bug it enables unauthenticated remote code execution, exposing every stored API key. Patch to 1.83.7 now.
2026.06.09105 views
News
Markdown Preview Enhanced Vulnerabilities: All Fixed as of 0.8.30, Update If Older
SecurityDevelopment
In Markdown Preview Enhanced, the popular VS Code extension, opening and previewing a malicious Markdown file can run code on your PC (CVE-2026-49492/49493/50733). Update to 0.8.28.
2026.06.0698 views
News
7-Zip Take-Over Flaws Fixed in 26.02: Affected Versions and How to Update
SecurityDevelopment
A flaw in the free 7-Zip compressor lets a crafted file take over a PC just by being opened. Tracked as CVE-2026-48095 (CVSS 8.8), it affects version 26.00 and earlier and can trigger even from files disguised as .zip or .rar. 7-Zip has no auto-update and PoC code is public. Here are the affected versions, update steps, and what to do now.
2026.06.0669 views
News
Tautulli Vulnerabilities: v2.17.2 Is the Minimum Safe Version
InfrastructureDevelopmentSecurity
Tautulli, the popular dashboard that tracks viewing on the Plex media server, has five vulnerabilities including a 9.9-severity flaw. Some paths work without logging in, and chained together they lead to admin-panel takeover or code execution on your server. Update to v2.17.1.
2026.06.0584 views
News
Critical Takeover Flaw in OpenStack Mistral: CVE-2026-41283 Lets Any Logged-In User Run Code
DevelopmentSecurityInfrastructure
CVE-2026-41283: a 9.9-severity flaw in OpenStack Mistral lets any logged-in user run arbitrary code and steal cloud-wide service credentials. Patch now.
2026.06.0479 views
News
Magento Mirasvit Cache Warmer Takeover Flaw, Fixed in 1.11.12+
DevelopmentInfrastructureSecurity
A Magento extension used by online stores worldwide has a critical flaw (CVE-2026-45247, CVSS 9.8) that lets attackers take over servers without logging in. Real attacks have already begun, risking theft of shoppers' credit card data. Affected stores must update to 1.11.12 now.
2026.06.0426 views
News
Apache MINA Takeover Flaw: The Safe Versions Are 2.2.8, 2.1.15, and 2.0.31
SecurityDevelopmentInfrastructure
Apache MINA, the Java networking library behind many server apps, has a critical flaw (CVE-2026-47065, CVSS 9.8) that lets attackers take over servers without logging in. It is the third bypass of earlier fixes—update to 2.2.8, 2.1.13, or 2.0.29 now.
2026.06.0369 views
News
Flaw in Amazon's AI dev tool Kiro, CVE-2026-10591: open a folder, run code
SecurityDevelopmentAI
Amazon Kiro flaw CVE-2026-10591 (CVSS 8.8): the AI's file-write tool can write to .vscode/tasks.json, auto-running an attacker's command when the folder opens. Prompt injection is the trigger. Update to Kiro 0.11 or later.
2026.06.0362 views
