bibibi.ccLoading…
Connect scattered updates into a story you can understand.
PANews reports that OpenAI said its red-team exercises discovered that a Brotli compression library has an unauthenticated remote code execution vulnerability, and software embedding the library, including Node.js, Bun, and Envoy, may need updates to remediate it.
MIIT NVDB warns that PHP two critical remote code execution vulnerabilities can be exploited by unauthenticated attackers, and recommends that affected organizations investigate, upgrade, or implement temporary protections as soon as possible.
PANews cited SlowMist as disclosing that LiteLLM’s malicious version 1.107.0 affected PyPI packages and some Docker floating tags, could steal sensitive credentials when Python starts, and supported remote code execution. The relevant versions were reportedly removed or replaced.
BlockBeats reports that PHP, Node.js, and Go-related projects released security updates involving remote code execution,TLS certificate validation bypasses, and certificate trust risks.
Node.js on October 21 released 26.x、24.x and 22.x security updates, fixing a total of 10 vulnerabilities, including 4 high-severity issues. Users are officially advised to upgrade to the latest supported version.
BlockBeats, citing Huntress, stated that PHP has been found to contain highest-severity remote code execution vulnerabilities, and officials moved up the security patch release because the information was leaked in advance. The affected versions, exploitation conditions, and whether the vulnerabilities have been exploited remain to be confirmed by officials.