The latest wire

De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données, un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.

Vercel Sandbox now exposes memory usage in its dashboard and CLI, helping teams see how workloads approach their allocated memory. Dashboard summaries include average and percentile measurements, while individual charts scale to the sandbox limit and mark its 85 percent level. Teams can build queries and alerts from the memory measure, and retrieve project or team aggregates with the metrics command.

On 27 September 2026, Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, among which 2 critical unauthenticated Remote Code Execution (RCE) vulnerabilities. Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild. CERT-EU recommends updating affected software and running a compromise assessment on those exposed on the internet.

SANS highlights Wireshark 4.6.9, reporting fixes for 19 vulnerabilities and 16 additional bugs. The project's release notes detail crashes, infinite loops and memory problems across protocol dissectors and file parsers, alongside a profile-import issue that could permit code execution. The update adds no new protocols, keeping its emphasis on repairs and existing protocol support.

A Worker can now call the Workflows it declares in the exports field of its Wrangler configuration through ctx.exports. You no longer need a workflows binding to call a Workflow from the Worker that defines it. Each Workflow is keyed by class name, and has the same API as a Workflow binding: src/index.jsjsexport default { async fetch(request, env, ctx) { const instance = await ctx.exports.MyWorkflow.create({ params: { name: "World" }, }); return Response.json({ id: instance.id }); }, }; src/index.tstsexport default { async fetch(request, env, ctx): Promise<Response> { const instance = await ctx.exports.MyWorkflow.create({ params: { name: "World" }, }); return Response.json({ id: instance.id }); }, } satisfies ExportedHandler<Env>; A workflows binding and a workflow export with the same name share their instances.

Fireworks’ Ember-1 is available through Vercel AI Gateway as a research preview with an initial two-week window. Built on Kimi K3, it supports a one-million-token context, image input and tool calling. Fireworks reports roughly 40% fewer generated tokens at comparable quality in its evaluations. The endpoint supports Zero Data Retention and No Prompt Training.

Sep 26, 10:58 UTC Resolved - This incident has been resolved. Sep 26, 10:47 UTC Monitoring - A fix has been implemented and we are monitoring the results. Sep 26, 10:44 UTC Investigating - We are continuing to investigate this issue.

Google Cloud has made Memorystore for Valkey 9.1 generally available, adding database-specific access controls, cluster-wide scanning and commands that combine common cache operations. A managed migration workflow also supports moving existing Redis or Valkey deployments. Google attributes its advertised throughput gains to updated threading and queue handling; the post notes that benchmark improvements depend on workload, rather than promising every application the same result.

Cloudflare closed a Durable Objects incident on September 25 after reporting elevated errors and implementing a fix. The same incident timeline initially described new Workflows instances remaining queued for some customers, before later updates focused on Durable Objects errors. Monitoring of the later fix began at 08:48 UTC, with resolution at 14:49 UTC; the notice does not explain a causal link between the two symptoms.

Mandiant describes renewed exploitation of Oracle PeopleSoft systems that remain vulnerable to CVE-2026-35273. The campaign reached organizations relying on web-application-firewall rules without applying Oracle’s patch, with attackers adapting requests to evade those rules. The report recommends patching or disabling the affected service, investigating application logs and deployed files, and rotating credentials exposed to the PeopleSoft service account.

SANS researcher Brad Duncan examined a macOS infection delivered through a fake verification prompt and found an information stealer with persistence and separate processor-specific payloads. His follow-up questions an earlier identification as AMOS because several behaviors differ. The diary documents the observed activity while leaving the malware-family attribution unresolved, rather than presenting the initial label as confirmed.

Vercel's new GitHub Actions login action lets workflows push container images to Vercel Container Registry using GitHub OIDC instead of stored, long-lived registry credentials. It obtains a temporary Vercel token and revokes it when the job finishes. Teams must configure a matching OIDC policy with registry write access and grant the workflow permission to request an identity token before using the integration.

Creating or editing Compression rules in Cloudflare's dashboard could return errors during a September 25 incident, while rules already in place continued working. Cloudflare reported the problem at 04:58 UTC, identified it an hour later and began monitoring a fix at 06:26 UTC. The incident was marked resolved at 06:31 UTC, limiting the reported disruption to rule management.

Vercel’s analysis of skills.sh describes rapid growth in reusable instructions for AI agents, with software engineering leading published listings but demand spread across more kinds of work. Install activity is concentrated among a small share of skills. The report uses aggregate registry counters, which do not represent unique users, and its category findings come from a classified sample rather than the whole catalog.

The September 25 Stormcast covers deceptive phishing links, risks from exposed GitLab email credentials and changes observed in MacSync malware. It also discusses SolarWinds Observability fixes for remote-code-execution weaknesses that depend on particular configurations. Johannes Ullrich emphasizes applying the relevant update instead of assuming that today's configuration will remain an adequate defense against later exposure.

Cloudflare reported resolved delays in Secondary DNS zone transfers on September 25, affecting how quickly record changes moved between primary nameservers and its secondary DNS service in either direction. The impact window ran from 00:05:10 to 01:52:54 UTC. The company said DNS lookups and edge proxying remained functional, separating delayed record propagation from a loss of those services.

De multiples vulnérabilités ont été découvertes dans les produits Elastic. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Vercel introduced Pixel Canary on AI Gateway as a stealth model with temporarily free access. The announcement emphasizes coding and interface development, citing Next.js evaluation results that allow up to four attempts per task. Zero Data Retention is unavailable, and submitted prompts and responses may be used for training and model improvement.

Custom spans in Workers now support more of the OpenTelemetry span API, so you can instrument more of your code and record errors directly on your spans. tracing.startSpan(name) creates a span without making it the active span, and returns it. Other spans do not nest under it. Call span.end() when the operation is complete. tracing.getActiveSpan() returns the currently active span. Use it to annotate the current span from helper functions and libraries without passing the span object through your code. Outside any custom span, it returns the invocation's root span. span.recordException(exception) records an exception event on a span. It accepts an Error, a string, or an object with a code, name, or message. span.setAttributes(attributes) sets multiple attributes at once. setAttribute() and setAttributes() now return the span, so you can chain calls.

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.

De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et une atteinte à la confidentialité des données.

Vercel's Marketplace database browser now supports both Redis and Upstash for Redis integrations. Team owners can execute commands, inspect values and browse keys from the dashboard, including filtering by type or pattern and checking expiration metadata. The command tab also supports transactions. Access to these new browser and CLI tabs is currently restricted to members with the Owner role.