Executive Summary

FoxTerm Security Intel

October 23, 2026

Network Security (4)

Show HN: Replacing CAPTCHAs with adaptive proof-of-work in WordPress

Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing — ## Summary When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concate

Pillow: MSP RLE decoder expands a tiny file into unbounded memory — ### Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames — ## Summary When a user exports content through `@apostrophecms/import-export`, the module copies the generated archive into uploadfs at `/exports/` an

Vulnerability (69)

Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

Patch the Planet: global response coordination as agents uncover vulnerabilities

GitLab critical patch release

There isn't an easy exploit for this PHP vulnerability

Cloudflare deploys protections against php2shell vulnerability

Potential third critical PHP CVE

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

virtualenv: Generated files can follow existing destination links — ## Summary Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() — ### Summary Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow write that is fixed upstream on master bu

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive — ## Impact With the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so `/Admin` renders the same page

Nuxt server islands render `useHeadSafe` input without sanitisation — ## Impact `useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`,

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from ` ` when `pages` is disabled — ## Impact An application that renders ` ` with a value it does not control can be made to render an anchor whose `href` executes script in the applica

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes — ### Summary Nuxt compared `routeRules` keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when

pypdf: Possible long runtimes/large memory usage when retrieving form fields — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving th

pypdf: Possible large memory usage when parsing arrays and dictionaries — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries

pypdf: Possible large memory usage when parsing content streams — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many

Electron: Frame subscription trusts GPU-supplied frame geometry — ### Impact Frame data received from the GPU process for `webContents.beginFrameSubscription` was not fully validated by the main process. A compromise

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry — ### Impact In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised G

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays — ## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `us

fastify is vulnerable to header validation bypass via case-sensitive propertyNames — ### Impact Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This no

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype — ### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path boo

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() — ## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables (`[[name]]`) headers. `addTableAr

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() — ## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted key, table header, or inline-tabl

Storybook dev server vulnerable to code injection from the local network — Summary: The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can ope

Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering — ## Summary Astro's JSX and MDX rendering pipeline treated string children of ` ` and ` ` elements as trusted HTML. When a dynamic value was passed thr

Astro: Arbitrary CSS injection in Astro View Transitions — ### Summary Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments — ## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql-tools`) | | Repository | https

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit — ### Summary The parser's `max_tokens` limit — the documented defence against oversized GraphQL documents — did not count comment tokens. A document pa

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule — ### Summary The `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and in the worst case `O(n²·m²)` — running time by a sma

DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes — ## Summary When DOMPurify is configured with `SAFE_FOR_TEMPLATES: true` together with a DOM-returning mode (`RETURN_DOM: true`, `RETURN_DOM_FRAGMENT:

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml — ### Summary DOMPurify drops `attributeName` attributes whose value contains `href`, so an allowed ` ` or ` ` can't rewrite a link's href after sanitiz

nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc — ### Summary nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api — ## Summary `TraceState.from_header` splits the inbound W3C `tracestate` header with a regular expression that starts with an unbounded optional-whites

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process — ### Summary `new Address6()` and `Address6.isValid()` strip a zone identifier with the pattern `/%.*$/` before they apply the 45-character length limi

Black: GitHub Action installs unvalidated required-version from pyproject.toml — ### Summary The GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This versi

Django REST framework: TokenProxy.delete() reports success and revokes nothing — ### Summary Deleting an authentication token through `TokenProxy` silently deletes nothing. The call raises no exception and reports success, the data

Django REST framework: JSONParser applies an attacker-named codec to the request stream — ### Summary An unauthenticated attacker can defeat Django's `DATA_UPLOAD_MAX_MEMORY_SIZE` limit and force a worker process to allocate arbitrary memor

next.js cache leak across root param values in nested 'use cache' functions — ### Impact With Cache Components enabled (`cacheComponents: true`), a `'use cache'` function that calls another `'use cache'` function that reads a ro

Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer — ``` ============================================================================ Heap buffer overflow writing JPEG comment after ICC profile fills buf

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise — ### Summary Affected Object and Source Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion — ### Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply a

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) — ### Summary Pillow's decompression-bomb protection (`Image._decompression_bomb_check`, gated by `Image.MAX_IMAGE_PIXELS`) is enforced only on the **fi

Sentry-Javascript: Middleware Bypass when using Tunnel route — ### Impact The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrit

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used — ## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execu

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service — ## Summary `FlexAssembler`, the custom-container assembler shipped in the `stream-json` package (`src/core/utils/flex-assembler.js`, re-exported at `s

PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery — ### Summary `HMACAlgorithm.from_jwk` accepts a symmetric (`kty=oct`) JWK whose `k` value is the empty string and returns a zero-length key without rai

ammonia: mXSS via MathML `annotation-xml` encoding strip — If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The `annotation-xml` tag has sl

virtualenv: Builtin creation follows linked environment directories — ## Summary The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those directories. This p

virtualenv: Deletion recovery can change a symlink target's mode — ## Summary The deletion error handler obtains permission bits with lstat() but applies them through chmod(), which follows symlinks. On an eligible un

virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax — ## Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and

Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags — ``` ============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF ta

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO — ``` ============================================================================ Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Lo

Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle — ``` ============================================================================ Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle Lo

Pillow: APNG background disposal allocates full canvas before decompression bomb check — ``` ============================================================================ APNG background disposal allocates full canvas before decompression b

Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) — ``` ============================================================================ Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) Locatio

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() — ### Summary `PdfParser`'s `get_value()` can recurse without any limit and crash with an uncaught `RecursionError`. It is reachable through `Image.save

Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes — ``` ============================================================================ ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minute

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory — ``` ============================================================================ Image.quantize() with empty palette leaks uninitialized stack memory

Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() — ``` ============================================================================ Quadratic GIF comment concatenation allows DoS in Image.open() Locati

Pillow: Infinite loop in MIC n_frames when the embedded TIFF — ``` ============================================================================ Infinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs Loca

Pillow: Quadratic GIF comment copying during save — On Pillow 12.3.0 and upstream `main` (`ad277e2761b489681e71b51e91367d46b0ceabb9`), a GIF with a long comment makes `_get_global_header()` copy portion

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images — ``` ============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size image

Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform — ``` ============================================================================ Double free in ImagingScaleAffine on calloc failure via Image.transfo

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size — ### Summary On `main`, even with the guard in #9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a s

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE — ### Summary `PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) without sanitization, pla

pypdf: Unvalidated JPEG image data loading — ### Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file — ### Summary In Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses

Vitest: Code injection via unauthenticated manual mock registration — ### Summary `@vitest/mocker`'s `interceptorPlugin` accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix — ## Summary The path traversal fix released for GHSA-82fw-gwwq-j7x9 can

Malware (1)

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Security Industry (5)

Mark Zuckerberg Threatened to Leave California. Meta's Board Cut Him a Deal

Security advisory: Critical remote code execution vulnerabilities, update now

Elon Musk Just Threatened the Coming Democratic Majority

GitPython validates a submodule's ".git" path only after cloning into it (RCE) — ### Summary `create_submodule(name, path, url)` clones a submodule into the repo's own `.git` directory before it rejects the path. A `path` of ".git/

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) — ### Summary The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `IN_PLACE` hook removes a differe

Server Security (5)

Brotli on Nginx thread pools: ngx_mbrotli vs. ngx_brotli

Setting Up SSH Keys on macOS with Touch ID

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() — ### Summary `toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first bounding the length of the digit sequ

Pillow multi-frame loaders can reuse stale native image storage after mode transitions — ### Summary Pillow multi-frame image loaders can retain native `ImagingCore` storage allocated for one frame while changing the Python-side image `mod

Next.js: Denial of Service in App Router using Server Actions — ## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking pr

*Total 84 security intelligence items, auto-collected by FoxTerm*

Trend Topics

Network Security 4

Show HN: Replacing CAPTCHAs with adaptive proof-of-work in WordPress; Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing; Pillow: MSP RLE decoder expands a tiny file into unbounded memory; ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

Vulnerability 69

Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure; Patch the Planet: global response coordination as agents uncover vulnerabilities; GitLab critical patch release; There isn't an easy exploit for this PHP vulnerability; Cloudflare deploys protections against php2shell vulnerability; Potential third critical PHP CVE; PHP web runtimes (CVE-2026-109618 and CVE-2026-109619); virtualenv: Generated files can follow existing destination links; Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load(); Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive; Nuxt server islands render `useHeadSafe` input without sanitisation; Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from ` ` when `pages` is disabled; Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes; pypdf: Possible long runtimes/large memory usage when retrieving form fields; pypdf: Possible large memory usage when parsing arrays and dictionaries; pypdf: Possible large memory usage when parsing content streams; Electron: Frame subscription trusts GPU-supplied frame geometry; Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry; Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays; fastify is vulnerable to header validation bypass via case-sensitive propertyNames; toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype; toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse(); toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse(); Storybook dev server vulnerable to code injection from the local network; Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering; Astro: Arbitrary CSS injection in Astro View Transitions; GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments; GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit; GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule; DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes; DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml; nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc; OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api; ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process; Black: GitHub Action installs unvalidated required-version from pyproject.toml; Django REST framework: TokenProxy.delete() reports success and revokes nothing; Django REST framework: JSONParser applies an attacker-named codec to the request stream; next.js cache leak across root param values in nested 'use cache' functions; Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer; Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise; Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion; Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek); Sentry-Javascript: Middleware Bypass when using Tunnel route; Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used; stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service; PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery; ammonia: mXSS via MathML `annotation-xml` encoding strip; virtualenv: Builtin creation follows linked environment directories; virtualenv: Deletion recovery can change a symlink target's mode; virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax; Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags; Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO; Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle; Pillow: APNG background disposal allocates full canvas before decompression bomb check; Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id); Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree(); Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes; Pillow: Image.quantize() with empty palette leaks uninitialized stack memory; Pillow: Quadratic GIF comment concatenation allows DoS in Image.open(); Pillow: Infinite loop in MIC n_frames when the embedded TIFF; Pillow: Quadratic GIF comment copying during save; Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images; Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform; Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size; Pillow: Argument Injection in Ghostscript call, potentially leading into RCE; pypdf: Unvalidated JPEG image data loading; Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file; Vitest: Code injection via unauthenticated manual mock registration; Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

Malware 1

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Security Industry 5

Mark Zuckerberg Threatened to Leave California. Meta's Board Cut Him a Deal; Security advisory: Critical remote code execution vulnerabilities, update now; Elon Musk Just Threatened the Coming Democratic Majority; GitPython validates a submodule's ".git" path only after cloning into it (RCE); DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

Server Security 5

Brotli on Nginx thread pools: ngx_mbrotli vs. ngx_brotli; Setting Up SSH Keys on macOS with Touch ID; toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse(); Pillow multi-frame loaders can reuse stale native image storage after mode transitions; Next.js: Denial of Service in App Router using Server Actions