Security

On 19–20 October 2026 the Go team released Go 1.27.3 and 1.26.10. They contain one security fix, CVE-2026-111943 (Go issue 82345): crypto/x509 now rejects chains that contain a small set of intermediate certificates from the CA eMudhra (emSign), because their private keys are compromised. The advisory doesn’t say which certificates, so I looked. If you ship Go binaries, updating Go on your machine is not enough. Every binary has to be rebuilt with a fixed toolchain. ...

On 21 October 2026 GitLab released a critical patch release that includes CVE-2026-110264, scored CVSS 10.0, the maximum. The flaw is in GitLab CE and EE and, under certain conditions, lets an unauthenticated user run arbitrary code on the GitLab server. The Hacker News has covered it too. If you run a self-managed GitLab, update first and read the rest later. Summary ID CVE-2026-110264 Score 10.0 (Critical) Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Weakness Integer overflow in the regular expression compiler Reporter joaxcar, via GitLab’s HackerOne bug bounty The vector means: reachable over the network, low complexity, no login, no user interaction, with full impact on confidentiality, integrity and availability. ...

On 21 October 2026 the UK National Cyber Security Centre (NCSC) published an alert titled “Critical security issue affecting PHP”. Two vulnerabilities in PHP itself may let an unauthenticated attacker achieve remote code execution (RCE) on a web server running PHP. Both are fixed in new releases. If you run PHP, update first and read the rest later. Summary CVE-2026-109618 CVE-2026-109619 Title RCE via OOM corruption RCE via stale global state CVSS v4.0 9.2 (Critical) 9.2 (Critical) Vector AV:N/AC:H/AT:P/PR:N/UI:N AV:N/AC:H/AT:P/PR:N/UI:N Weakness use-after-free, improper error handling use-after-free, stale global state Both are reachable over the network with no login and no user interaction. ...