Technical updates
Security advisories written for builders
We translate complex security bulletins into plain language so you know which updates matter for your application.
CriticalCritical remote code execution vulnerabilities in PHP require immediate updatesPHP released security updates to fix vulnerabilities that allow remote code execution, so developers using affected versions should update their environments immediately.Read the advisory HighNode.js security releases for October 2026Node.js fixed ten vulnerabilities, rated up to High, across versions 22, 24 and 26, so anyone running Node.js should update.Read the advisory MediumSecurity updates for nginx stable and mainline versionsNginx released fixes for five vulnerabilities and anyone running their own web servers should update to the latest stable or mainline versions.Read the advisory CriticalCritical file read and code execution flaw in Rails Active StorageA vulnerability in Rails Active Storage using libvips allows attackers to read files or execute code, so developers using these tools must update their systems.Read the advisory CriticalRemote code execution vulnerability in React Server ComponentsA critical flaw allows attackers to run code on servers using React Server Components. Developers using Next.js or React 19 must upgrade their packages immediately.Read the advisory HighShai-Hulud 2.0: the npm worm returns and spreads through GitHubA supply chain attack used malicious scripts to steal credentials from hundreds of npm packages and you should act if you use external dependencies.Read the advisory HighBetter Auth API key plugin allows unauthorised access to user keysA flaw in the Better Auth API key plugin allows attackers to create or modify keys without authentication, so developers using this plugin must upgrade.Read the advisory HighSelf-replicating worm compromises hundreds of npm packagesA malicious worm is stealing developer credentials from npm packages to infect more libraries, so you must rotate your keys and pin your dependencies.Read the advisory HighMalicious versions of chalk, debug and other popular npm packagesAttackers compromised several widely used npm packages to steal crypto-wallet data and builders should check their lockfiles for specific malicious versions.Read the advisory CriticalNext.js authorisation bypass in middleware subrequestsA flaw in Next.js middleware allows attackers to bypass security checks, so developers using middleware for authorisation must update their packages immediately.Read the advisory