The PHP Foundation says Chainguard broke a coordinated security embargo by releasing patched PHP container images hours ahead of schedule, making the fix available for attackers to study while other distributors were still preparing updates.
In a
follow.it gives you an easy way to subscribe to Socket's news feed! Click on Follow below and we deliver the updates you want via email, phone or you can read them here on the website on your own news page.
You can also unsubscribe anytime painlessly. You can even combine feeds from Socket with other site's feeds!
Title: Nuget
Is this your feed? Claim it!
The PHP Foundation says Chainguard broke a coordinated security embargo by releasing patched PHP container images hours ahead of schedule, making the fix available for attackers to study while other distributors were still preparing updates.
In a
Organizations running internet-facing PHP applications have been advised to take them offline if they cannot immediately patch two critical vulnerabilities. That is how bad this is: the NSA recommended taking affected systems offline until they can be fully mitigated, w...
LiteLLM 1.107.0 delivers a credential stealer through Python startup hooks, while container build provenance points to a lookalike source repository used by the project’s release workflow.
LiteLLM version 1.107.0 contains ...
JavaScript packages increasingly ship instructions for coding agents alongside their code. But installing a package doesn’t necessarily put those instructions somewhere an agent will find them. Developers can end up copying skill files into their projects by hand, then having to keep those copies current as dependencies change.
Rust developers will soon be able to tell Cargo to wait before adopting newly published dependencies. Rust 1.100, scheduled for November 12, will bring stable support for a configurable minimum publish age, letting teams delay dependency updates to give researchers and maintainers time to detect malicious releases before more projects pull them in.
The