New CVEs fixed in Node.js new releases: (Wednesday, 21 oct)

CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (medium, patch commit)

CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (high, blog)

CVE-2026-105482: dns.resolve truncates names containing NUL char (high)

CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (high)

CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (high)

low-severity CVEs:

CVE-2026-106070: Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation

CVE-2026-106071: Permission Model filesystem over-grant via wildcard radix lookup

CVE-2026-106073: Permission Model bypass with fs.realpathSync

Patched versions:
- v22.23.4
- v24.22.1
- v26.12.1

These vulnerabilities are so bad that even prime minister of Japan had to post about it. many sites are still down or "under maintenance". specially bank infrastructures

This is an urgent request that requires your immediate attention tonight.
 
The PHP security team has issued an alert regarding two critical vulnerabilities in PHP, a language used by many websites.
 
Please verify whether your public-facing websites utilize PHP, and prepare to apply the security patches—scheduled for release tonight, October 21, at 11:00 PM (JST)—as soon as possible.
 
If applying the patches promptly proves difficult, temporarily taking your website offline is one effective measure to mitigate the risks.
 
Relevant information is also being shared via the X (formerly Twitter) account of the National Cyber ​​Coordination Office; please refer to that as well.
National Cyber ​​Coordination Office (Alerts & Warnings) (@cyber_forecast) / X

Posted by 高市早苗, 5 hours ago

New GitLab vulnerabilities (patches):

CVE-2026-110264: pre-auth RCE in GitLab: Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

In addition to our standard patch releases, we have backported this fix to GitLab CE/EE versions 18.11.13, 19.0.10, 19.1.9, and 19.2.9.

CVE-2026-15723: Account takeover: Improper Authentication issue in OmniAuth-to-LDAP auto-linking email lookup impacts GitLab CE/EE

GitLab has remediated an issue that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
Impacted Versions: GitLab CE/EE: all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1

CVE-2026-112212: Cache Poisoning issue in OAuth/OIDC discovery endpoints impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have poisoned a shared cache’s OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.
Impacted Versions: GitLab CE/EE: all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1

CVE-2026-13319: Project permission-check bypass Through User-Controlled Key issue in group milestones API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.
Impacted Versions: GitLab CE/EE: all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1

Railway Security (Compromise) Disclosure
Article, Comments

from comments:
Seen multiple folks in the Railway Discord confirming that their secrets stored in Railway have been used by third parties, so it definitely sounds like the attackers were able to read decrypted environment variables.

Re: Today's PHP security release, and how we're strengthening security

You may never hear me say this again because I am a gruff cynic who is not sure that hanging out here is good for his psyche, but thank goodness for HN.

While I have been chasing around today, trying to resolve this on different servers, it turns out a three line nginx mitigation (blocking multipart uploads) I wrote in the wee small hours GMT has been quietly protecting a vulnerable machine I could not shut down (from attacks powered by every single mainstream agentic AI tool — Anthropic, OpenAI, Qwen cloud, Baidu, seemingly also AWS, Meta)

Including an hour before the PHP patch actually shipped.

So without the HN discussion I wouldn't have found enough people pointing at possible mitigations and I would have lost a server to this, and I thank everyone who pointed out that second mitigation in particular.

dofm, 3 hours ago

CVE-2026-107891: RCE in musl libc due to multiple integer overflow in regcomp (patch)

The regcomp function in musl libc is affected by multiple integer
overflow issues which can lead to incorrectly-sized allocations and
possibly out-of-bounds heap writes. The conditions for overflow are
triggered by the size and complexity of the regular expression passed
to regcomp, not the data to be matched. In order to be vulnerable, an
application must be processing regular expressions from an untrusted
source using the libc regcomp function.

Affected versions:
The vulnerable code has been present since version 0.5.0.
All subsequent versions up through 1.2.6 are affected.

Mitigation:
All users should apply the attached patch, or upgrade to 1.2.7 once it
becomes available.
In contexts where patching is not an option, measures should be taken
to prevent the processing of regular expressions from untrusted
sources.

CVE-2026-91403: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition (score: 9.1 critical)

Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.

Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs.
This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.

Oracle Security Alert Advisory

note: there is no reliable article relating this to the eMudhra ca leak. if you ask LLMs and they start talking about that, it's because their search tool is hitting the other (unrelated?) articles in Oracle's sites and just picking that up as the direct cause without verifying their connection properly.

Another vulnerability few are talking about: I found my Claude Code exposing personal data in http headers because the sites it curled politely asked agents to identify their users 😊
Epistemic cybersecurity is the hot new category for 2027.

Posted by Steven Liss, 2 hours ago

I read this and I'm terrified, the situation seems intractable.

In the python ecosystem alone every cpython install, venv, UV is at risk.

Don't get my started on npm, pnpm, yarn, go, rust.

My current 2026 security posture: stay home and only connect to the internet from a trusted ISP.

The winter is coming.

https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

Posted by Samuel Colvin, 3 hours ago

Denial-of-Service vulnerabilities in some of the http3/QUIC implementations (blog):

A remote, unauthenticated client can force an HTTP/3 server to allocate tens to thousands of times more memory than it sends. One connection is enough to OOM or pin a default-configured server. Seven of the ten implementations tested are vulnerable; several are already fixed.

- CVE-2025-64702: quic-go (repo)
- CVE-2026-12523: Cloudflare quiche (repo)
- CVE-2025-13945: wireshark (github / gitlab)

Re: The recently proposed o(n log n) integer multiplication algorithm [pdf]

> It would be good to have a formalised proof of the o(n log n) result, for example in Lean. As far as I can tell, one does not yet exist.

The result is fully formalized in Lean by @platypii and myself (on Mathlib's TM2 machine), with ongoing improvements to the exponent (currently at 1-2^-14.38): https://github.com/platypii/integer-mult-bounds-lean

Contributions are welcome!

jdb1729, 4 hours ago

The Finals' gameplay programmer and game designer explaining how they implemented destruction and environment dynamism in their game (these all are server-side events, so all players will see the same effects/destructions arounds themselves)

source

Faster than earcut: triangulating 3.7M map polygons in 489 ms
Article, Comments

github repo

Two 0day (unpatched) RCE vulnerabilities were mistakenly posted to the Linux Kernel's public mailing list (instead of the private one)

Article, Comments

Among these newly-disclosed vulnerabilities include:

ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

If you’re interested in this sort of thing, FEX is doing the best (public) job in this space. Paulo Matos has an excellent blogpost discussing how to handle x87 code on ARM with a virtual stack pass, and how those speedups look for Half-Life and other games:

https://p.ocmatos.com/blog/fex-x87-stack-optimization.html

Posted by LaurieWired, 1 hour ago

UUIDv7 doesn't have the properties you think it does
Article, Comments

Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.

On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.

While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.

After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.

https://openai.com/index/securing-our-frontier-model-training-environment/

Posted by OpenAI, 20 minutes ago

Important note:
CVE-2026-111497 (“Node2Shell”) is a vulnerability in Google’s Brotli C decoder, not in Node.js. So any project using its affected versions are effected as well.

this RCE affects pypi's brotli package as well (GitHub Advisory)

so if you are using this package (directly or indirectly, check pip freeze output) make sure to upgrade to v1.2.1+

blog