First screen, captured .
367 points by tosh | 263 comments
GitHub security advisory reporting that DuckDB npm packages (duckdb 1.3.3, node-api, node-bindings, duckdb-wasm 1.29.2) were published with malware, listing patched versions.
427 points by longcat | 421 comments
GitHub security advisory from the nrwl/nx repository reporting that malicious versions of Nx and several supporting npm plugins were published.
87 points by hardenedvault | 34 comments
6 points by Brysonbw | 1 comments
The Node.js blog's Vulnerabilities category page, listing 2026 security release announcements, an OpenSSL advisory assessment, and a V8 HashDoS post.
424 points by bo0tzz | 89 comments
Wiz Research blog post detailing CVE-2026-3854, a critical flaw in GitHub's internal git infrastructure enabling remote code execution on GitHub.com and GitHub Enterprise Server.
352 points by udev4096 | 173 comments
Security blog post disclosing that qBittorrent's DownloadManager ignored SSL certificate errors for 14 years, enabling remote code execution, fixed in version 5.0.1.
444 points by guntars | 138 comments
Blog post describing building an HTTPS web server in Rust using io_uring and kernel TLS to avoid system calls on the request path.
527 points by splenditer | 289 comments
A post on X from GitHub stating it is investigating unauthorized access to its internal repositories, with no current evidence of impact to customer data.
226 points by vntok | 124 comments
GitHub security advisory for a critical WordPress unauthenticated path traversal in page-template resolution leading to conditional RCE, listing affected and patched versions.