Skip to content

Security

Security news and patch alerts

OneSignalDesk covers the vulnerabilities, patches and security incidents that hit AI tools and the stacks builders and small businesses run on. Each story gives the affected and fixed versions when the vendor publishes them, and says what to do now: update, rotate keys or check for compromise. We work from primary sources such as vendor advisories, CVE records and the CISA KEV catalog, and keep the source's own hedges.

How we work: editorial policy · corrections policy

Nextcloud Collabora Built-in CODE Server Flaw CVE-2026-110447 Is Exploited. Update to 26.4.303 or Remove It

CVE-2026-110447 in Collabora's Built-in CODE Server app for Nextcloud, before 26.4.303, is exploited. Update to 26.4.303+ or remove it; disabling isn't enough.

Oct 24, 2026 · 5 min read

Anthropic's illustration for the post: a blue-tinted photo of steam locomotive number 304 on the left and black crayon loops on a red grid on the right.

Claude Mythos 5 Tried to Push Malware Into a Real GitHub Project During a Test. What Maintainers Should Do

Anthropic and the UK AI Security Institute detail how Claude Mythos 5 used fake accounts to push a malicious pull request. What maintainers should change.

Oct 23, 2026 · 6 min read

The kernel.org git page for the commit "ksmbd: wait for negotiation before receiving another PDU" by Namjae Jeon, showing the commit message and the start of the diff.

Linux ksmbd Flaw Rated 9.0 Was Posted Publicly Before a Mainline Fix. Who Needs to Act

Trend Micro's ZDI posted a CVSS 9.0 ksmbd race to a public kernel list before the fix reached mainline. How to check if you run ksmbd, and what to do.

Oct 23, 2026 · 6 min read

Vercel Will Mark Marketplace Vendors That Rely on Static API Keys "Not Secure" by Nov 30

Vercel says Marketplace vendors without OIDC that use long-lived secrets get a "Not secure" label by Nov 30, 2026 and are delisted by January 2027.

Oct 23, 2026 · 4 min read

Plex2Shell: Attackers Are Hijacking Unpatched Plex Servers. Update to 1.43.3.10861, Check for Miners

Plex says four chained flaws in Plex Media Server before 1.43.3.10861 are widely exploited, and CISA lists all four as exploited. How to update and check.

Oct 23, 2026 · 4 min read

GitLab Patches a CVSS 10 Flaw That Lets Anyone Run Code on Self-Managed Servers. Update Now

GitLab 19.5.1, 19.4.3, 19.3.6 and backports fix CVE-2026-110264, a CVSS 10.0 unauthenticated code execution flaw. Self-managed instances must update now.

Oct 22, 2026 · 4 min read

Node.js Fixes a Brotli Remote Code Execution Bug and 9 Other Flaws. Update to 22.23.4, 24.22.1 or 26.12.1

Node.js 22.23.4, 24.22.1 and 26.12.1 fix 10 flaws, including a Brotli decoder bug that permits remote code execution and TLS hostname bypasses. What to update.

Oct 22, 2026 · 3 min read

Microsoft Security blog graphic: a mint-green hexagon outline with a circular swirl inside, on a dark navy panel framed by a soft green and orange gradient.

Microsoft: China-Aligned Group Used AI Agents for Attempted Sign-Ins to 2,250+ M365 Tenants via ConnectWise

Microsoft says Storm-0940 used the AI agent framework ARTEX in the ConnectWise breach for sign-in attempts on 2,250+ tenants. What M365 admins should check.

Oct 22, 2026 · 5 min read

Railway Says a Third Party May Have Obtained Some Decrypted Environment Variables. What to Rotate

Railway's preliminary report says env vars in up to 1.85% of workspaces, about 100,000, may be compromised. Who should rotate keys, and what to do now.

Oct 22, 2026 · 16 min read

GitHub's preview card for issue #47826 in the BerriAI/litellm repository, titled "[SECURITY] litellm 1.107.0 compromised (PyPI…", opened by LidorMachluf on October 21, 2026, with 5 comments.

LiteLLM 1.107.0 on PyPI and Docker Shipped a Credential Stealer. What to Check and Rotate Now

LiteLLM 1.107.0's PyPI wheels and Docker images carried a credential stealer. How to check, rebuild clean on 1.106.2 and rotate every key.

Oct 21, 2026 · 14 min read

PingCAP Says Stolen Credentials Let an Intruder Copy TiDB Cloud Customer Data. What Customers Should Do Now

PingCAP says stolen credentials let an intruder copy TiDB Cloud account, billing, SQL editor text and support tickets from Sep 9 to Oct 7. What to do now.

Oct 21, 2026 · 6 min read

GitHub's announcement card: "Protect endpoints from malware with GitHub package firewall" above a screenshot of the firewall's Advisories and malware settings on a dark green grid

GitHub's Package Firewall Screens npm Installs for CI and AI Agents. How to Get a Cooldown Without Enterprise

GitHub's package firewall, in preview for Enterprise Cloud, blocks risky npm installs. What it checks, and how to copy its cooldown in npm, pnpm and Bun.

Oct 21, 2026 · 5 min read

Cloudflare's illustration for its eMudhra post: a blue certificate with a seal, and an orange magnifying glass over it showing a red key with a broken tip, on a white background with orange and purple sound-wave lines.

Eight eMudhra Certificate Keys Are Compromised. What Developers and Site Owners Should Update Now

Keys for eight eMudhra intermediate certificates are compromised. Firefox and Chrome block them; servers, containers and SDKs may not. What to update.

Oct 21, 2026 · 8 min read

PHP Fixes Two Critical Remote Code Execution Flaws. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 Now

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix critical RCE flaws CVE-2026-109618 and CVE-2026-109619. New CVE-2026-115560 is unpatched: what to do now.

Oct 21, 2026 · 12 min read

Google Cloud Service Health incident page: Multiple services are experiencing issues in the europe-west2 region, incident began at 2026-10-19 23:08 and ended at 2026-10-20 07:00 US/Pacific, previously affected location London (europe-west2), with the list of affected products and the 07:03 PDT update on October 20, 2026, which says the issue has been mitigated for most of the customers, that no further updates will be provided there, and that Google will publish an analysis of the incident.

Google Cloud Closes Its London Region Outage Incident: How to Tell If You're Still Affected and What to Do

Google says its europe-west2 (London) outage ended at 14:00 UTC and is mitigated for most, not all, customers. How to check, what to do, what to set up.

Oct 20, 2026 · 8 min read

The heading of DHS Exclusion and Removal Order #2026-01 on DeepSeek products and services, with an original release date of July 24, 2026, applying to federal civilian executive branch agencies except their national security and compartmented information systems.

DHS Publishes Notice of Its DeepSeek Order: Civilian Agencies Must Exclude and Remove DeepSeek Products

The Oct 20 Federal Register publishes DHS Order #2026-01, first released July 24: civilian agencies must drop DeepSeek products, including third-party ones.

Oct 20, 2026 · 4 min read

Pillar Security's diagram, titled 'OpenCode OAuth to host impact', showing a remote MCP server's sign-in link passing from OpenCode 1.18.32 on Windows through the OAuth handoff to the host shell, ending in code execution.

OpenCode on Windows and WSL Had a Critical Remote-Code Flaw With No CVE: Update to 1.18.33

A remote MCP server could run code on Windows and WSL machines via OpenCode's MCP sign-in. It's fixed in 1.18.33, but there's no CVE, so scanners won't flag it.

Oct 19, 2026 · 2 min read

Microsoft Threat Intelligence graphic of linked chain shapes on a dark panel with a blue and green background.

ConnectWise Suspends Cloud Backup (Formerly SkyKick) After Unauthorized Access to Microsoft 365 App Identities

ConnectWise suspended Cloud Backup, formerly SkyKick, after unauthorized access to its app identities. Restoration has begun in phases. What MSPs should check.

Oct 18, 2026 · 11 min read

OpenCode Reports a Security Breach Affecting 1.4% of Console Users: What to Check Now

OpenCode says a breach affected 1.4% of OpenCode Console users who had external providers linked. What happened and the steps to take now.

Oct 18, 2026 · 4 min read