The latest wire

De multiples vulnérabilités ont été découvertes dans OpenSSL. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité. Gitlab indique que la vulnérabilité CVE-2026-85706 est activement exploitée.

CERT-FR's September 30 CPython notice concerns CVE-2026-12345, which the agency says can compromise data integrity. It identifies CPython installations lacking the latest security patch as affected rather than listing individual release branches. The advisory refers maintainers to the Python Software Foundation's PSF-2026-42 bulletin, dated September 29, for the relevant correction details.

De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

AI Gateway now supports Machine Payments in beta. With Machine Payments, clients can use the x402 protocol to pay for eligible inference requests directly from a stablecoin wallet instead of maintaining a prepaid credit balance. Machine Payments is available for the /ai/run endpoint with select open models. To request x402 payment, authenticate with a Cloudflare API token and include the Cloudflare-specific Payment-Method: x402 header: curl -iX POST "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/run" \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Payment-Method: x402" \ --header "Content-Type: application/json" \ --data '{ "model": "z-ai/glm-4.7-flash", "input": { "messages": [ { "role": "user", "content": "What is Cloudflare?"

Supabase has released @supabase/middleware 1.0 on npm and JSR, with semantic versioning governing future breaking changes. The package composes request handlers with shared typed context and checks dependency ordering at compile time. It includes CORS and feature-flag middleware and runs across Fetch-compatible environments, including Supabase Edge Functions, Cloudflare Workers and Node 22 or later, supporting reuse across backend runtimes.

Cloudflare resolved an Asia-Pacific connectivity incident on September 29 after reporting congestion between Tokyo and Singapore linked to multiple subsea cable outages. The company said disruption began September 21, rerouted traffic and worked with outside vendors to restore capacity. Its September 25 update narrowed the remaining effect to intermittent connectivity degradation for a small subset of customers, rather than a region-wide outage.

Red Hat OpenShift Container Platform release 4.22.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Vercel Connect now accepts submissions from service providers for its connector directory. Providers describe their service and configure OAuth or API-key connection methods; OAuth methods must be tested by obtaining a real token through a test connector. Vercel reviews submissions before listing them, giving providers a path to integration without waiting for Vercel to build each connector itself.

Cloudflare revised its initial warning about Access one-time PIN emails on September 29. After investigating apparent delivery failures, engineering concluded customers had not experienced elevated failure levels and described the increase as isolated, without widespread impact. The company marked the incident resolved at 20:50 UTC. Its earlier notice also said other authentication methods were operating normally.

An update for gawk is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for gdb is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for gawk is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for nodejs24 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

New Zealand's Cyber Smart Week runs October 5–11, with the NCSC urging people to spot scams and build everyday security habits. Its campaign highlights backups, multi-factor authentication and incident planning for organizations. Free resources are available through Own Your Online, with the agency encouraging action before another business's breach becomes the wake-up call.

Repository administrators can choose a labeled runner for Dependabot version updates and optionally specify a runner group. GitHub exposes the controls for private and internal repositories on github.com; public repositories and Enterprise Server do not get them. Security configurations do not currently enforce these runner settings, so administrators manage the choice at repository level.

GitHub's external custom properties preview lets an outside system keep repository ownership, service tier or compliance context in sync. Values remain read-only in GitHub so the external integration stays in control. Teams can use that context in repository filters and rulesets, with either the initial Port.io integration or their own API integration.

GPT-6.1 Sol is rolling out in GitHub Copilot for supported paid plans across editor, terminal, mobile and coding-agent surfaces. GitHub says availability is gradual and enterprise administrators can control access through model policies. The announcement describes usage-based billing at provider list pricing; its performance statements are GitHub's early testing claims.

Google made its reinforcement-learning version of GKE Agent Sandbox and orchestration SDK generally available. It combines prewarmed environments, image streaming and reusable pods to reduce time that training accelerators spend waiting for execution sandboxes. In Google’s tests on a fixed ten-node pool, average startup improved roughly tenfold and worst-case waits improved up to 45-fold; those figures describe the published benchmark configuration.

Google Cloud expanded its Gemini Enterprise catalog with partner-built security agents and integrations for protecting AI workloads. Announced capabilities span identity containment, sensitive-data controls, application-security triage and defenses against prompt injection. The examples include workflows that retain human approval for privileged actions. These are vendor and partner product claims, rather than evidence that deploying the integrations eliminates security risk.

Google’s ADK tutorial shows how to turn an agent-driven refund process into an explicit graph of functions, agents and decision points. Independent lookups run together, while policy decisions can stay in deterministic code and ambiguous cases pause for human review. The walkthrough also distinguishes predefined graph routes from Python-driven orchestration that schedules additional work as results arrive.

An update for gdb is now available for Red Hat Enterprise Linux 10.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for gdb is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.