curl 8.23.0 Closes 24 Security Holes, Including Credential Leaks to Rogue Proxies
The curl project has shipped version 8.23.0, closing two dozen security flaws in the data-transfer tool that underpins an estimated 30 billion installations worldwide. The fixes address credential...
F-Droid 2.0 Modernizes Android App Discovery but Leaves Some Privacy Tools Behind
F-Droid 2.0 brings the open-source Android repository its largest client redesign in a decade, with improved search, automatic updates and a modernized codebase. Privacy-conscious users should note that...
Five-Year-Old Bugs in a JSON Parser Open a Code Execution Hole in Self-Managed GitLab
Researchers chained two long-dormant memory-safety bugs in Ruby's Oj JSON parser to achieve remote code execution on self-managed GitLab instances, using nothing more than an ordinary commit and...
Flipper Zero Maker Overhauls Firmware Contribution Rules After Community Backlash
Flipper Devices has rolled out new firmware contribution rules, including GitHub Discussions-based feature voting and mandatory integration testing, after community backlash over a perceived firmware development slowdown.
Critical Marimo Python Notebook Zero-Day (CVE-2026-39987) Exploited Within 10 Hours of Disclosure
A critical pre-authentication RCE vulnerability (CVE-2026-39987, CVSS 9.3) in the popular Marimo Python notebook platform was weaponised within 10 hours of public disclosure. Attackers are actively harvesting credentials,...