Cybersecurity Knowledge Everyone Can Use

Amazon Linux's ECS Extra advisory lists Docker-related fixes covering risks in archive paths, networking and build components. It was first published on 24 October and updated on 26 October.

Microsoft says an earlier update did not include the fix for CVE-2026-70197 and released a corrected package on 25 October. Development and operations teams using Windows .NET need to check again.

PHP has released fixes for two major vulnerabilities and warns that certain Session settings still need attention. Unit 42 subsequently withdrew its attribution of a government organisation's compromise to PHP2Shell. Read patch requirements separately from evidence about the cause of that incident.

Railway confirmed unauthorised access to some internal systems, potentially affecting sensitive data stored in environment variables. Core build and deployment services have been restored. Customers should still follow official guidance to revoke old keys, rotate credentials and check for unusual activity.

LiteLLM confirmed that malicious code had been added to version 1.107.0 packages and some container images. Its investigation found that previously exposed keys that had not been revoked gave attackers publishing access. Environments that used affected versions should assess rebuilding and rotating secrets.

CSIRT.SK issued an advisory on two Linux KSMBD issues, reminding administrators to restrict service access and track updates. The risks concern systems with the relevant file-sharing components enabled; they do not imply that all Linux hosts are affected.

Oracle issued a Java and GraalVM security advisory for CVE-2026-114820, providing updates that remove affected eMudhra root certificates and advising users to check their installed versions.

Ruby released 4.0.9, 3.4.12 and 3.3.13, fixing underlying issues related to a recent GitLab vulnerability. The risks concern applications that compile untrusted text into regular expressions. Programs that use only fixed developer-defined patterns are not affected by these issues.

CISA has added a vulnerability in Collabora's built-in CODE Server to its known exploited list. It affects a specific Nextcloud add-on App and is fixed in version 26.4.303. The vendor warns that disabling the App alone is insufficient. Standalone Collabora servers are not affected by this issue.

A Node.js security update patches a Brotli decompression vulnerability; subsequent research demonstrated code execution in specific builds. Other software also uses the component, so related dependencies still need checking after Node.js is updated.

OpenAI describes isolation improvements in its internal frontier-model training and evaluation environments, including no internet connection, a smaller available attack surface and continuous testing of security boundaries. The article concerns research environments and should not be treated as the configuration of all customer products.

Samba 4.25.1 includes a fix for CVE-2026-109411. Official guidance says the issue affects only the vfs_ceph_rgw module introduced in 4.25.0. Organisations should check actual usage rather than treating all SMB shares as equally exposed.