Vulnerabilities, advisories and security releases: who is affected, how severe it is and what to patch, from the maintainers' own notices.
Security · Release breakdown
Vault v2.1.2 and v2.2.1 change ACL name matching, policy name validation, ACME SAN handling and plugin paths; operators should review rules and certificate workflows.
Security · News
We are not issuing certificates yet, and it will be a little while before we do.
Security analysis
php2shell (CVE-2026-109618 and CVE-2026-109619) affects PHP 5.4 and later. Update the PHP runtime and keep Cloudflare WAF protections enabled while patching.
Security · News
Docker reports CVE-2026-105445, where Docker Hub account conversions re-assigned personal access tokens to a new owner. The fix shipped September 30, 2026.
Security · Release breakdown
Vault v2.2.0 breaking changes cover container memory locking, PostgreSQL storage auth, ACME SAN rules and JWT revocation endpoints, with operator actions.
Security analysis
CISA reports active exploitation of Ivanti Connect Secure CVE-2026-104935, an authentication bypass, and urges immediate updates and compromise checks.
Security · News
The agency states that the flaw affects versions 26.2.3 and earlier, and that cyber threat actors are actively exploiting it.
Security analysis
OpenSSL's 4.0.3, 3.6.5 and 3.5.9 releases fix CVEs rated up to High in DTLS, QUIC, EC and SM2 code. Here is what changed and who should patch first.
Security · Release breakdown
Keycloak 26.8.1 lists many CVE fixes across admin permissions, OIDC, SAML and token exchange, following the features that 26.8.0 introduced.
Security · News
Developers often need to show a half-finished feature to someone else in seconds.
