Repository navigation
Expand file tree
/
Copy pathindex.html
More file actions
60 lines (60 loc) · 37.4 KB
/
Copy pathindex.html
File metadata and controls
60 lines (60 loc) · 37.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
<!doctype html><html class=no-js lang=en><head><meta name=generator content="Hugo 0.167.0"><meta charset=UTF-8><meta name=viewport content="width=device-width,initial-scale=1"><meta http-equiv=X-UA-Compatible content="IE=edge"><title>StackRef Whistle</title><script>(function(e,t){e[t]=e[t].replace("no-js","js")})(document.documentElement,"className")</script><meta name=description content="The official blog of StackRef"><meta property="og:url" content="https://whistle.stackref.com/"><meta property="og:site_name" content="StackRef Whistle"><meta property="og:title" content="StackRef Whistle"><meta property="og:description" content="The official blog of StackRef"><meta property="og:locale" content="en_us"><meta property="og:type" content="website"><meta itemprop=name content="StackRef Whistle"><meta itemprop=description content="The official blog of StackRef"><meta itemprop=datePublished content="2026-11-13T08:00:00-05:00"><meta itemprop=dateModified content="2026-11-13T08:00:00-05:00"><meta name=twitter:card content="summary"><meta name=twitter:title content="StackRef Whistle"><meta name=twitter:description content="The official blog of StackRef"><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=dns-prefetch href=//fonts.googleapis.com><link rel=dns-prefetch href=//fonts.gstatic.com><link rel=stylesheet href="https://fonts.googleapis.com/css2?family=Roboto:400,400i,700"><link rel=stylesheet href=/css/style.css><link rel=stylesheet href=/css/custom.css><link rel=alternate type=application/rss+xml href=/index.xml title="StackRef Whistle"><link rel=icon href=/favicon.ico sizes=any><link rel=icon type=image/png href=/favicon-32x32.png sizes=32x32><link rel=icon type=image/png href=/favicon-16x16.png sizes=16x16><link rel=apple-touch-icon href=/apple-touch-icon.png sizes=180x180><script async src="https://www.googletagmanager.com/gtag/js?id=G-JST6DK31Z2"></script><script>var doNotTrack=!1,dnt=navigator.doNotTrack||window.doNotTrack||navigator.msDoNotTrack,doNotTrack=dnt=="1"||dnt=="yes";if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-JST6DK31Z2")}</script></head><body class=body><div class="container container--outer"><header class=header><div class="container header__container"><div class=header__top><div class="logo logo--mixed"><a class=logo__link href=/ title="StackRef Whistle" rel=home><div class="logo__item logo__imagebox"><img class=logo__img src=/img/sr-whistle-logo.png></div><div class="logo__item logo__text"><div class=logo__title>StackRef Whistle</div><div class=logo__tagline>The official blog of StackRef</div></div></a></div><div class=header__right><div class=header__right-text></div></div></div><nav class=menu><button class=menu__btn aria-haspopup=true aria-expanded=false tabindex=0>
<span class=menu__btn-title tabindex=-1>Menu</span></button><ul class=menu__list><li class=menu__item><a class=menu__link href=/><span class=menu__text>Whistle Home</span></a></li><li class=menu__item><a class=menu__link href=https://stackref.com><span class=menu__text>StackRef Home</span></a></li><li class=menu__item><a class=menu__link href="https://aws.amazon.com/marketplace/seller-profile?id=8c3a2dab-30bb-47b6-add8-036adde2c99a"><span class=menu__text>AWS Marketplace</span></a></li></ul></nav></div></header><div class="wrapper flex"><div class=primary><main class="main list" role=main><article class="list__item post"><figure class="list__thumbnail thumbnail"><a class=thumbnail__link href=/post/2026-11-13-cve-bulletin-apache-mod-http2-rce/><img class=thumbnail__image src=/img/cve-bulletin-apache-mod-http2-rce.png alt="Critical Apache HTTP/2 RCE: CVE-2026-119618 fixed in 2.4.71"></a></figure><header class=list__header><h2 class="list__title post__title"><a href=/post/2026-11-13-cve-bulletin-apache-mod-http2-rce/ rel=bookmark>Critical Apache HTTP/2 RCE: CVE-2026-119618 fixed in 2.4.71</a></h2><div class="list__meta meta"><div class="meta__item-author meta__item"><svg class="meta__icon icon icon-author" width="16" height="16" viewBox="0 0 12 16"><path d="M6 1c2.2.0 3.5 2 3.5 4.5C9.5 7 8.9 8.2 8 9c2.9.8 4 2.5 4 5v1H0v-1c0-2.5 1.1-4.2 4-5-.9-.8-1.5-2-1.5-3.5C2.5 3 3.8 1 6 1z"/></svg><span class=meta__text>Keith McDuffee</span></div><div class="meta__item-datetime meta__item"><svg class="meta__icon icon icon-time" width="16" height="14" viewBox="0 0 30 28"><path d="M15 0C7 0 1 6 1 14s6 14 14 14 14-6 14-14S23 0 15 0zm0 25C9 25 4 20 4 14S9 3 15 3s11 5 11 11-5 11-11 11zm1-18h-2v8.4l6.8 4.4L22 18l-6-3.8V7z"/></svg><time class=meta__text datetime=2026-11-13T08:00:00-05:00>2026-11-13</time></div><div class="meta__item-categories meta__item"><svg class="meta__icon icon icon-category" width="16" height="16" viewBox="0 0 16 16"><path d="m7 2 1 2h8v11H0V2z"/></svg><span class=meta__text><a class=meta__link href=/categories/news/ rel=category>News</a></span></div></div></header><div class="content list__excerpt post__content clearfix"><p>Apache shipped 2.4.71 on Wednesday with a fix for CVE-2026-119618, a race condition in mod_http2 that lets an unauthenticated client corrupt heap memory and execute code with the web server’s privileges. Releases 2.4.55 through 2.4.70 are in scope whenever HTTP/2 is enabled. There are no confirmed in-the-wild exploits and no CISA KEV entry yet. I’d patch this week anyway.</p></div></article><article class="list__item post"><figure class="list__thumbnail thumbnail"><a class=thumbnail__link href=/post/2026-11-13-cve-bulletin-mongodb-replica-set-uaf/><img class=thumbnail__image src=/img/cve-bulletin-mongodb-replica-set-uaf.png alt="MongoDB CVE-2026-118383: pre-auth UAF, patch replica sets"></a></figure><header class=list__header><h2 class="list__title post__title"><a href=/post/2026-11-13-cve-bulletin-mongodb-replica-set-uaf/ rel=bookmark>MongoDB CVE-2026-118383: pre-auth UAF, patch replica sets</a></h2><div class="list__meta meta"><div class="meta__item-author meta__item"><svg class="meta__icon icon icon-author" width="16" height="16" viewBox="0 0 12 16"><path d="M6 1c2.2.0 3.5 2 3.5 4.5C9.5 7 8.9 8.2 8 9c2.9.8 4 2.5 4 5v1H0v-1c0-2.5 1.1-4.2 4-5-.9-.8-1.5-2-1.5-3.5C2.5 3 3.8 1 6 1z"/></svg><span class=meta__text>Keith McDuffee</span></div><div class="meta__item-datetime meta__item"><svg class="meta__icon icon icon-time" width="16" height="14" viewBox="0 0 30 28"><path d="M15 0C7 0 1 6 1 14s6 14 14 14 14-6 14-14S23 0 15 0zm0 25C9 25 4 20 4 14S9 3 15 3s11 5 11 11-5 11-11 11zm1-18h-2v8.4l6.8 4.4L22 18l-6-3.8V7z"/></svg><time class=meta__text datetime=2026-11-13T08:00:00-05:00>2026-11-13</time></div><div class="meta__item-categories meta__item"><svg class="meta__icon icon icon-category" width="16" height="16" viewBox="0 0 16 16"><path d="m7 2 1 2h8v11H0V2z"/></svg><span class=meta__text><a class=meta__link href=/categories/news/ rel=category>News</a></span></div></div></header><div class="content list__excerpt post__content clearfix"><p>MongoDB <a href=https://www.mongodb.com/community/forums/t/important-mongodb-security-update-available-action-required-november-10-2026/344843>shipped fixed releases on Tuesday</a> for <a href="https://www.cve.org/CVERecord?id=CVE-2026-118383">CVE-2026-118383</a>, a use-after-free that can kill a replica set’s freshly elected primary before it accepts a write. The scores are already in: NVD rates 10.0 on CVSS 3.1, and MongoDB’s CNA puts it 9.5 on v4.0. There’s no CISA KEV entry and MongoDB says it’s unaware of exploitation attempts, but a proof of concept is <a href=https://github.com/googlesky/CVE-2026-118383>public on GitHub</a>. Patch every replica set member this week.</p></div></article><article class="list__item post"><figure class="list__thumbnail thumbnail"><a class=thumbnail__link href=/post/2026-11-12-whistle-week-46/><img class=thumbnail__image src=/img/whistle-w46-cover.png alt="The Whistle: Chrome's eighth zero-day, Qubole's trusted path, and an AI proof of Signal"></a></figure><header class=list__header><h2 class="list__title post__title"><a href=/post/2026-11-12-whistle-week-46/ rel=bookmark>The Whistle: Chrome's eighth zero-day, Qubole's trusted path, and an AI proof of Signal</a></h2><div class="list__meta meta"><div class="meta__item-author meta__item"><svg class="meta__icon icon icon-author" width="16" height="16" viewBox="0 0 12 16"><path d="M6 1c2.2.0 3.5 2 3.5 4.5C9.5 7 8.9 8.2 8 9c2.9.8 4 2.5 4 5v1H0v-1c0-2.5 1.1-4.2 4-5-.9-.8-1.5-2-1.5-3.5C2.5 3 3.8 1 6 1z"/></svg><span class=meta__text>Keith McDuffee</span></div><div class="meta__item-datetime meta__item"><svg class="meta__icon icon icon-time" width="16" height="14" viewBox="0 0 30 28"><path d="M15 0C7 0 1 6 1 14s6 14 14 14 14-6 14-14S23 0 15 0zm0 25C9 25 4 20 4 14S9 3 15 3s11 5 11 11-5 11-11 11zm1-18h-2v8.4l6.8 4.4L22 18l-6-3.8V7z"/></svg><time class=meta__text datetime=2026-11-12T08:00:00-05:00>2026-11-12</time></div><div class="meta__item-categories meta__item"><svg class="meta__icon icon icon-category" width="16" height="16" viewBox="0 0 16 16"><path d="m7 2 1 2h8v11H0V2z"/></svg><span class=meta__text><a class=meta__link href=/categories/news/ rel=category>News</a></span></div></div></header><div class="content list__excerpt post__content clearfix"><p>Google patched Chrome’s eighth in-the-wild zero-day of the year, Wiz published an October attack that walked through the front door Qubole customers built for their own data platform, and a researcher’s 33 zero-days made an RMM vendor unplug its own hosted service. Anthropic put a security model behind a verification program and a footnote, Google’s Carbon-powered agents produced a formal proof of Signal’s protocol implementation, and AWS gave every EKS pod the option of its own hardware-isolated virtual machine at no extra charge. France named Iran’s Revolutionary Guard Corps as the source of the freezer attacks, and the queue behind those stories ran from Barracuda email appliances to SonicWall MFA skips. Security leads, then everything else.</p></div></article><article class="list__item post"><figure class="list__thumbnail thumbnail"><a class=thumbnail__link href=/post/2026-11-09-whistle-week-45/><img class=thumbnail__image src=/img/whistle-w45-cover.png alt="The Whistle: 948 Linux root paths closed by a model, the cold chain hacked, and gVisor joins the CNCF"></a></figure><header class=list__header><h2 class="list__title post__title"><a href=/post/2026-11-09-whistle-week-45/ rel=bookmark>The Whistle: 948 Linux root paths closed by a model, the cold chain hacked, and gVisor joins the CNCF</a></h2><div class="list__meta meta"><div class="meta__item-author meta__item"><svg class="meta__icon icon icon-author" width="16" height="16" viewBox="0 0 12 16"><path d="M6 1c2.2.0 3.5 2 3.5 4.5C9.5 7 8.9 8.2 8 9c2.9.8 4 2.5 4 5v1H0v-1c0-2.5 1.1-4.2 4-5-.9-.8-1.5-2-1.5-3.5C2.5 3 3.8 1 6 1z"/></svg><span class=meta__text>Keith McDuffee</span></div><div class="meta__item-datetime meta__item"><svg class="meta__icon icon icon-time" width="16" height="14" viewBox="0 0 30 28"><path d="M15 0C7 0 1 6 1 14s6 14 14 14 14-6 14-14S23 0 15 0zm0 25C9 25 4 20 4 14S9 3 15 3s11 5 11 11-5 11-11 11zm1-18h-2v8.4l6.8 4.4L22 18l-6-3.8V7z"/></svg><time class=meta__text datetime=2026-11-09T08:00:00-05:00>2026-11-09</time></div><div class="meta__item-categories meta__item"><svg class="meta__icon icon icon-category" width="16" height="16" viewBox="0 0 16 16"><path d="m7 2 1 2h8v11H0V2z"/></svg><span class=meta__text><a class=meta__link href=/categories/news/ rel=category>News</a></span></div></div></header><div class="content list__excerpt post__content clearfix"><p>OpenAI shipped its cybersecurity model and the workload that proves it in the same week: GPT-6 Cyber powered the pipeline that validated and patched 948 Linux privilege-escalation flaws for about $1.2 million in API credits. On the other side of the ledger, Chainalysis disclosed that password hashes and live session tokens for all of its users were exposed to an attacker whose only public description is a phrase the company never defined. Anthropic explained why it will not fix the cross-machine Claude Dispatch hole it has known about since May, Sekoia mapped an SVR watering-hole campaign that hunts phones through already-patched devices, and the European cold-chain attacks reached France’s blood service. Zyxel’s June firmware fixed the sibling of the bug its attackers actually used, Japan announced a funded national cyber package, and Anthropic’s amended IPO filing turned “recursive self-improvement” into official risk language while Tencent’s launch post sold the same idea as a roadmap. On the cloud side, Google donated its agent runtime stack to the CNCF ahead of KubeCon, and AWS turned Hive-to-Iceberg migration into a managed job. Security leads, then everything else.</p></div></article><article class="list__item post"><figure class="list__thumbnail thumbnail"><a class=thumbnail__link href=/post/2026-11-06-cve-bulletin-openssh-sshhole/><img class=thumbnail__image src=/img/whistle-bulletin-openssh-sshhole.png alt="The Whistle: Special Bulletin - OpenSSH password bypass (CVE-2026-123158) on musl systems"></a></figure><header class=list__header><h2 class="list__title post__title"><a href=/post/2026-11-06-cve-bulletin-openssh-sshhole/ rel=bookmark>The Whistle: Special Bulletin - OpenSSH password bypass (CVE-2026-123158) on musl systems</a></h2><div class="list__meta meta"><div class="meta__item-author meta__item"><svg class="meta__icon icon icon-author" width="16" height="16" viewBox="0 0 12 16"><path d="M6 1c2.2.0 3.5 2 3.5 4.5C9.5 7 8.9 8.2 8 9c2.9.8 4 2.5 4 5v1H0v-1c0-2.5 1.1-4.2 4-5-.9-.8-1.5-2-1.5-3.5C2.5 3 3.8 1 6 1z"/></svg><span class=meta__text>Keith McDuffee</span></div><div class="meta__item-datetime meta__item"><svg class="meta__icon icon icon-time" width="16" height="14" viewBox="0 0 30 28"><path d="M15 0C7 0 1 6 1 14s6 14 14 14 14-6 14-14S23 0 15 0zm0 25C9 25 4 20 4 14S9 3 15 3s11 5 11 11-5 11-11 11zm1-18h-2v8.4l6.8 4.4L22 18l-6-3.8V7z"/></svg><time class=meta__text datetime=2026-11-06T06:00:00-05:00>2026-11-06</time></div><div class="meta__item-categories meta__item"><svg class="meta__icon icon icon-category" width="16" height="16" viewBox="0 0 16 16"><path d="m7 2 1 2h8v11H0V2z"/></svg><span class=meta__text><a class=meta__link href=/categories/news/ rel=category>News</a></span></div></div></header><div class="content list__excerpt post__content clearfix"><p>OpenSSH shipped an emergency release one day after learning of the bug, with Damien Miller telling musl-libc operators to disable password auth <a href="https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2">IMMEDIATELY</a>. <a href=https://nvd.nist.gov/vuln/detail/CVE-2026-123158>CVE-2026-123158</a> at CVSS 8.1 lets an attacker log into any passwordless account with a single sent password, first connection, every time. glibc distributions and PAM-using systems are not affected, which is why your Ubuntu fleet is safe. Your Alpine containers with an sshd inside are another matter.</p></div></article><article class="list__item post"><figure class="list__thumbnail thumbnail"><a class=thumbnail__link href=/post/2026-11-02-whistle-week-44/><img class=thumbnail__image src=/img/whistle-w44-cover.png alt="The Whistle: a Brotli patch wave, a 16-year-old UEFI hole, and Anthropic files to go public"></a></figure><header class=list__header><h2 class="list__title post__title"><a href=/post/2026-11-02-whistle-week-44/ rel=bookmark>The Whistle: a Brotli patch wave, a 16-year-old UEFI hole, and Anthropic files to go public</a></h2><div class="list__meta meta"><div class="meta__item-author meta__item"><svg class="meta__icon icon icon-author" width="16" height="16" viewBox="0 0 12 16"><path d="M6 1c2.2.0 3.5 2 3.5 4.5C9.5 7 8.9 8.2 8 9c2.9.8 4 2.5 4 5v1H0v-1c0-2.5 1.1-4.2 4-5-.9-.8-1.5-2-1.5-3.5C2.5 3 3.8 1 6 1z"/></svg><span class=meta__text>Keith McDuffee</span></div><div class="meta__item-datetime meta__item"><svg class="meta__icon icon icon-time" width="16" height="14" viewBox="0 0 30 28"><path d="M15 0C7 0 1 6 1 14s6 14 14 14 14-6 14-14S23 0 15 0zm0 25C9 25 4 20 4 14S9 3 15 3s11 5 11 11-5 11-11 11zm1-18h-2v8.4l6.8 4.4L22 18l-6-3.8V7z"/></svg><time class=meta__text datetime=2026-11-02T08:00:00-05:00>2026-11-02</time></div><div class="meta__item-categories meta__item"><svg class="meta__icon icon icon-category" width="16" height="16" viewBox="0 0 16 16"><path d="m7 2 1 2h8v11H0V2z"/></svg><span class=meta__text><a class=meta__link href=/categories/news/ rel=category>News</a></span></div></div></header><div class="content list__excerpt post__content clearfix"><p>One bug in a shared library owned the week. A buffer overflow in Google’s Brotli decoder was fixed in the library’s source in February, never released as an update, and spent the rest of the year bundled inside every runtime that links it. This October the catch-up finally ran: coordinated patches across Node.js, Python, Go and the proxy tier, and Microsoft shipped out-of-band .NET fixes on October 25. A 16-year-old UEFI vulnerability surfaced the other way, through a broken embargo. A campaign running on stolen GitHub tokens planted more than 13,500 secret-dumping workflows. Binance lost $6.3 billion to a compromised laptop in 20 minutes. Both sides of the exploit pipeline ran on models this week: Anthropic published a kernel root exploit written by Claude, Epoch AI pushed a Z.ai open-weight model through published-but-unshipped Firefox fixes at about $1,000 a target, AWS made machine-speed vulnerability remediation generally available, and Google gated its new cybersecurity model to defenders first. Security leads, then the rest.</p></div></article><article class="list__item post"><figure class="list__thumbnail thumbnail"><a class=thumbnail__link href=/post/2026-10-30-cve-bulletin-gitlab-kev/><img class=thumbnail__image src=/img/whistle-bulletin-gitlab-kev.png alt="The Whistle: Special Bulletin - GitLab's CI/CD regex RCE (CVE-2026-97229) joins CISA's KEV catalog"></a></figure><header class=list__header><h2 class="list__title post__title"><a href=/post/2026-10-30-cve-bulletin-gitlab-kev/ rel=bookmark>The Whistle: Special Bulletin - GitLab's CI/CD regex RCE (CVE-2026-97229) joins CISA's KEV catalog</a></h2><div class="list__meta meta"><div class="meta__item-author meta__item"><svg class="meta__icon icon icon-author" width="16" height="16" viewBox="0 0 12 16"><path d="M6 1c2.2.0 3.5 2 3.5 4.5C9.5 7 8.9 8.2 8 9c2.9.8 4 2.5 4 5v1H0v-1c0-2.5 1.1-4.2 4-5-.9-.8-1.5-2-1.5-3.5C2.5 3 3.8 1 6 1z"/></svg><span class=meta__text>Keith McDuffee</span></div><div class="meta__item-datetime meta__item"><svg class="meta__icon icon icon-time" width="16" height="14" viewBox="0 0 30 28"><path d="M15 0C7 0 1 6 1 14s6 14 14 14 14-6 14-14S23 0 15 0zm0 25C9 25 4 20 4 14S9 3 15 3s11 5 11 11-5 11-11 11zm1-18h-2v8.4l6.8 4.4L22 18l-6-3.8V7z"/></svg><time class=meta__text datetime=2026-10-30T08:00:00-04:00>2026-10-30</time></div><div class="meta__item-categories meta__item"><svg class="meta__icon icon icon-category" width="16" height="16" viewBox="0 0 16 16"><path d="m7 2 1 2h8v11H0V2z"/></svg><span class=meta__text><a class=meta__link href=/categories/news/ rel=category>News</a></span></div></div></header><div class="content list__excerpt post__content clearfix"><p>Two Mondays ago this bug led our patch notes. This week CISA put it in the KEV catalog, Alpine disclosed how close the attackers got, and the fix turned out to be a Ruby build change a GitLab version string cannot prove.</p></div></article><article class="list__item post"><figure class="list__thumbnail thumbnail"><a class=thumbnail__link href=/post/2026-10-26-whistle-week-43/><img class=thumbnail__image src=/img/whistle-w43-cover.png alt="The Whistle: LiteLLM's poisoned release train, hacker panels left open, and OpenAI lands on Google Cloud"></a></figure><header class=list__header><h2 class="list__title post__title"><a href=/post/2026-10-26-whistle-week-43/ rel=bookmark>The Whistle: LiteLLM's poisoned release train, hacker panels left open, and OpenAI lands on Google Cloud</a></h2><div class="list__meta meta"><div class="meta__item-author meta__item"><svg class="meta__icon icon icon-author" width="16" height="16" viewBox="0 0 12 16"><path d="M6 1c2.2.0 3.5 2 3.5 4.5C9.5 7 8.9 8.2 8 9c2.9.8 4 2.5 4 5v1H0v-1c0-2.5 1.1-4.2 4-5-.9-.8-1.5-2-1.5-3.5C2.5 3 3.8 1 6 1z"/></svg><span class=meta__text>Keith McDuffee</span></div><div class="meta__item-datetime meta__item"><svg class="meta__icon icon icon-time" width="16" height="14" viewBox="0 0 30 28"><path d="M15 0C7 0 1 6 1 14s6 14 14 14 14-6 14-14S23 0 15 0zm0 25C9 25 4 20 4 14S9 3 15 3s11 5 11 11-5 11-11 11zm1-18h-2v8.4l6.8 4.4L22 18l-6-3.8V7z"/></svg><time class=meta__text datetime=2026-10-26T08:00:00-04:00>2026-10-26</time></div><div class="meta__item-categories meta__item"><svg class="meta__icon icon icon-category" width="16" height="16" viewBox="0 0 16 16"><path d="m7 2 1 2h8v11H0V2z"/></svg><span class=meta__text><a class=meta__link href=/categories/news/ rel=category>News</a></span></div></div></header><div class="content list__excerpt post__content clearfix"><p>The release pipeline of LiteLLM, the model-gateway library, was emptied with three engineers’ stolen GitHub tokens. The operators of an open-source AI pentest platform left their control panels answering on the open internet, complete with target lists and API keys. The platforms that hold agent secrets for a living spent the week telling everyone to rotate everything. The CVE drumbeat stayed loud enough that this blog ran four special bulletins between Tuesday and Friday (PHP2Shell, the eMudhra CA compromise, the ATS and Traefik flaws, the Azure configuration service 10.0, VeloCloud and Collabora), so the vulnerability list lives there; this weekly holds the stories. Security leads below, then the cloud and model news: an ingress gateway for ECS, a security read on last week’s Lambda Web Functions launch, native PyTorch backends for both Trainium and TPU, rivals’ models landing on Google Cloud, Python 3.15, TypeScript in Rust, and three new model entries closing the week.</p></div></article><article class="list__item post"><figure class="list__thumbnail thumbnail"><a class=thumbnail__link href=/post/2026-10-24-cve-bulletin-velocloud-collabora/><img class=thumbnail__image src=/img/whistle-bulletin-velocloud-collabora.png alt="The Whistle: Special Bulletin - VeloCloud, Collabora CODE, Prime Mover, and Python's CA Denylist"></a></figure><header class=list__header><h2 class="list__title post__title"><a href=/post/2026-10-24-cve-bulletin-velocloud-collabora/ rel=bookmark>The Whistle: Special Bulletin - VeloCloud, Collabora CODE, Prime Mover, and Python's CA Denylist</a></h2><div class="list__meta meta"><div class="meta__item-author meta__item"><svg class="meta__icon icon icon-author" width="16" height="16" viewBox="0 0 12 16"><path d="M6 1c2.2.0 3.5 2 3.5 4.5C9.5 7 8.9 8.2 8 9c2.9.8 4 2.5 4 5v1H0v-1c0-2.5 1.1-4.2 4-5-.9-.8-1.5-2-1.5-3.5C2.5 3 3.8 1 6 1z"/></svg><span class=meta__text>Keith McDuffee</span></div><div class="meta__item-datetime meta__item"><svg class="meta__icon icon icon-time" width="16" height="14" viewBox="0 0 30 28"><path d="M15 0C7 0 1 6 1 14s6 14 14 14 14-6 14-14S23 0 15 0zm0 25C9 25 4 20 4 14S9 3 15 3s11 5 11 11-5 11-11 11zm1-18h-2v8.4l6.8 4.4L22 18l-6-3.8V7z"/></svg><time class=meta__text datetime=2026-10-24T08:00:00-04:00>2026-10-24</time></div><div class="meta__item-categories meta__item"><svg class="meta__icon icon icon-category" width="16" height="16" viewBox="0 0 16 16"><path d="m7 2 1 2h8v11H0V2z"/></svg><span class=meta__text><a class=meta__link href=/categories/news/ rel=category>News</a></span></div></div></header><div class="content list__excerpt post__content clearfix"><p>Between digests: two KEV additions sit on management planes under active attack, a WordPress plugin whose fix beat its advisory, and a 9.4 on CPython’s ssl.</p></div></article><article class="list__item post"><figure class="list__thumbnail thumbnail"><a class=thumbnail__link href=/post/2026-10-22-cve-bulletin-ats-traefik-trust/><img class=thumbnail__image src=/img/whistle-bulletin-ats-traefik-trust.png alt="The Whistle: Special Bulletin - mTLS bypasses in Traffic Server and Traefik"></a></figure><header class=list__header><h2 class="list__title post__title"><a href=/post/2026-10-22-cve-bulletin-ats-traefik-trust/ rel=bookmark>The Whistle: Special Bulletin - mTLS bypasses in Traffic Server and Traefik</a></h2><div class="list__meta meta"><div class="meta__item-author meta__item"><svg class="meta__icon icon icon-author" width="16" height="16" viewBox="0 0 12 16"><path d="M6 1c2.2.0 3.5 2 3.5 4.5C9.5 7 8.9 8.2 8 9c2.9.8 4 2.5 4 5v1H0v-1c0-2.5 1.1-4.2 4-5-.9-.8-1.5-2-1.5-3.5C2.5 3 3.8 1 6 1z"/></svg><span class=meta__text>Keith McDuffee</span></div><div class="meta__item-datetime meta__item"><svg class="meta__icon icon icon-time" width="16" height="14" viewBox="0 0 30 28"><path d="M15 0C7 0 1 6 1 14s6 14 14 14 14-6 14-14S23 0 15 0zm0 25C9 25 4 20 4 14S9 3 15 3s11 5 11 11-5 11-11 11zm1-18h-2v8.4l6.8 4.4L22 18l-6-3.8V7z"/></svg><time class=meta__text datetime=2026-10-22T03:00:00-04:00>2026-10-22</time></div><div class="meta__item-categories meta__item"><svg class="meta__icon icon icon-category" width="16" height="16" viewBox="0 0 16 16"><path d="m7 2 1 2h8v11H0V2z"/></svg><span class=meta__text><a class=meta__link href=/categories/news/ rel=category>News</a></span></div></div></header><div class="content list__excerpt post__content clearfix"><p>A short alert between digests: Traffic Server’s Tuesday release fixes fifteen flaws and two of them hand out the wrong client certificate identity; Traefik patched a second connection-identity bug in the same month on related plumbing; and Red Hat is pulling two roots out of its system CA bundle over the eMudhra key leak. mTLS origins, meet your change window.</p></div></article></main><div class=pagination><span class="pagination__item pagination__item--current">1/5</span>
<a class="pagination__item pagination__item--next btn" href=/page/2/>»</a></div></div><aside class=sidebar><div class="widget-search widget"><form class=widget-search__form role=search method=get action=https://google.com/search><label><input class=widget-search__field type=search placeholder=SEARCH… name=q aria-label=SEARCH…>
</label><input class=widget-search__submit type=submit value=Search>
<input type=hidden name=sitesearch value=https://whistle.stackref.com/></form></div><div class="widget-recent widget"><h4 class=widget__title>Recent Posts</h4><div class=widget__content><ul class=widget__list><li class=widget__item><a class=widget__link href=/post/2026-11-13-cve-bulletin-apache-mod-http2-rce/>Critical Apache HTTP/2 RCE: CVE-2026-119618 fixed in 2.4.71</a></li><li class=widget__item><a class=widget__link href=/post/2026-11-13-cve-bulletin-mongodb-replica-set-uaf/>MongoDB CVE-2026-118383: pre-auth UAF, patch replica sets</a></li><li class=widget__item><a class=widget__link href=/post/2026-11-12-whistle-week-46/>The Whistle: Chrome's eighth zero-day, Qubole's trusted path, and an AI proof of Signal</a></li><li class=widget__item><a class=widget__link href=/post/2026-11-09-whistle-week-45/>The Whistle: 948 Linux root paths closed by a model, the cold chain hacked, and gVisor joins the CNCF</a></li><li class=widget__item><a class=widget__link href=/post/2026-11-06-cve-bulletin-openssh-sshhole/>The Whistle: Special Bulletin - OpenSSH password bypass (CVE-2026-123158) on musl systems</a></li></ul></div></div><div class="widget-categories widget"><h4 class=widget__title>Categories</h4><div class=widget__content><ul class=widget__list><li class=widget__item><a class=widget__link href=/categories/artificial-intelligence/>Artificial Intelligence</a></li><li class=widget__item><a class=widget__link href=/categories/events/>Events</a></li><li class=widget__item><a class=widget__link href=/categories/hackathons/>Hackathons</a></li><li class=widget__item><a class=widget__link href=/categories/news/>News</a></li><li class=widget__item><a class=widget__link href=/categories/product/>Product</a></li><li class=widget__item><a class=widget__link href=/categories/quotes/>Quotes</a></li><li class=widget__item><a class=widget__link href=/categories/videos/>Videos</a></li></ul></div></div><div class="widget-taglist widget"><h4 class=widget__title>Tags</h4><div class=widget__content><a class="widget-taglist__link widget__link btn" href=/tags/ai/ title=Ai>Ai</a>
<a class="widget-taglist__link widget__link btn" href=/tags/alpine/ title=Alpine>Alpine</a>
<a class="widget-taglist__link widget__link btn" href=/tags/anthropic/ title=Anthropic>Anthropic</a>
<a class="widget-taglist__link widget__link btn" href=/tags/apache/ title=Apache>Apache</a>
<a class="widget-taglist__link widget__link btn" href=/tags/arista/ title=Arista>Arista</a>
<a class="widget-taglist__link widget__link btn" href=/tags/aws/ title=Aws>Aws</a>
<a class="widget-taglist__link widget__link btn" href=/tags/branding/ title=Branding>Branding</a>
<a class="widget-taglist__link widget__link btn" href=/tags/certificates/ title=Certificates>Certificates</a>
<a class="widget-taglist__link widget__link btn" href=/tags/cisco/ title=Cisco>Cisco</a>
<a class="widget-taglist__link widget__link btn" href=/tags/cloudflare/ title=Cloudflare>Cloudflare</a>
<a class="widget-taglist__link widget__link btn" href=/tags/collaboration/ title=Collaboration>Collaboration</a>
<a class="widget-taglist__link widget__link btn" href=/tags/competition/ title=Competition>Competition</a>
<a class="widget-taglist__link widget__link btn" href=/tags/cossell/ title=Cossell>Cossell</a>
<a class="widget-taglist__link widget__link btn" href=/tags/devseccon/ title=Devseccon>Devseccon</a>
<a class="widget-taglist__link widget__link btn" href=/tags/gcp/ title=Gcp>Gcp</a>
<a class="widget-taglist__link widget__link btn" href=/tags/github/ title=Github>Github</a>
<a class="widget-taglist__link widget__link btn" href=/tags/gitlab/ title=Gitlab>Gitlab</a>
<a class="widget-taglist__link widget__link btn" href=/tags/google-cloud/ title="Google Cloud">Google Cloud</a>
<a class="widget-taglist__link widget__link btn" href=/tags/hackathon-manager/ title="Hackathon Manager">Hackathon Manager</a>
<a class="widget-taglist__link widget__link btn" href=/tags/hackathons/ title=Hackathons>Hackathons</a>
<a class="widget-taglist__link widget__link btn" href=/tags/hermes/ title=Hermes>Hermes</a>
<a class="widget-taglist__link widget__link btn" href=/tags/infracost/ title=Infracost>Infracost</a>
<a class="widget-taglist__link widget__link btn" href=/tags/innovation/ title=Innovation>Innovation</a>
<a class="widget-taglist__link widget__link btn" href=/tags/inspiration/ title=Inspiration>Inspiration</a>
<a class="widget-taglist__link widget__link btn" href=/tags/ios/ title=Ios>Ios</a>
<a class="widget-taglist__link widget__link btn" href=/tags/judging/ title=Judging>Judging</a>
<a class="widget-taglist__link widget__link btn" href=/tags/kubernetes/ title=Kubernetes>Kubernetes</a>
<a class="widget-taglist__link widget__link btn" href=/tags/linux/ title=Linux>Linux</a>
<a class="widget-taglist__link widget__link btn" href=/tags/meta/ title=Meta>Meta</a>
<a class="widget-taglist__link widget__link btn" href=/tags/microsoft/ title=Microsoft>Microsoft</a>
<a class="widget-taglist__link widget__link btn" href=/tags/news/ title=News>News</a>
<a class="widget-taglist__link widget__link btn" href=/tags/nextcloud/ title=Nextcloud>Nextcloud</a>
<a class="widget-taglist__link widget__link btn" href=/tags/npm/ title=Npm>Npm</a>
<a class="widget-taglist__link widget__link btn" href=/tags/open-source/ title="Open Source">Open Source</a>
<a class="widget-taglist__link widget__link btn" href=/tags/openai/ title=Openai>Openai</a>
<a class="widget-taglist__link widget__link btn" href=/tags/openssh/ title=Openssh>Openssh</a>
<a class="widget-taglist__link widget__link btn" href=/tags/oracle/ title=Oracle>Oracle</a>
<a class="widget-taglist__link widget__link btn" href=/tags/php/ title=Php>Php</a>
<a class="widget-taglist__link widget__link btn" href=/tags/pickasso/ title=Pickasso>Pickasso</a>
<a class="widget-taglist__link widget__link btn" href=/tags/product-hunt/ title="Product Hunt">Product Hunt</a>
<a class="widget-taglist__link widget__link btn" href=/tags/python/ title=Python>Python</a>
<a class="widget-taglist__link widget__link btn" href=/tags/quality/ title=Quality>Quality</a>
<a class="widget-taglist__link widget__link btn" href=/tags/ruby/ title=Ruby>Ruby</a>
<a class="widget-taglist__link widget__link btn" href=/tags/security/ title=Security>Security</a>
<a class="widget-taglist__link widget__link btn" href=/tags/snyk/ title=Snyk>Snyk</a>
<a class="widget-taglist__link widget__link btn" href=/tags/stackref/ title=Stackref>Stackref</a>
<a class="widget-taglist__link widget__link btn" href=/tags/supply-chain/ title="Supply Chain">Supply Chain</a>
<a class="widget-taglist__link widget__link btn" href=/tags/teamwork/ title=Teamwork>Teamwork</a>
<a class="widget-taglist__link widget__link btn" href=/tags/tls/ title=Tls>Tls</a>
<a class="widget-taglist__link widget__link btn" href=/tags/traefik/ title=Traefik>Traefik</a>
<a class="widget-taglist__link widget__link btn" href=/tags/wordpress/ title=Wordpress>Wordpress</a></div></div><div class="widget-social widget"><h4 class="widget-social__title widget__title">Social</h4><div class="widget-social__content widget__content"><div class="widget-social__item widget__item"><a class="widget-social__link widget__link btn" title=Twitter rel="noopener noreferrer" href=https://twitter.com/stackref target=_blank><svg class="widget-social__link-icon icon icon-twitter" width="24" height="24" viewBox="0 0 384 312"><path d="m384 36.9c-14.1 6.3-29.3 10.5-45.2 12.4 16.3-9.7 28.8-25.2 34.6-43.6-15.2 9-32.1 15.6-50 19.1-14.4-15.2-34.9-24.8-57.5-24.8-43.5.0-78.8 35.3-78.8 78.8.0 6.2.7 12.2 2 17.9-65.5-3.3-123.5-34.6-162.4-82.3C20 26 16.1 39.6 16.1 54c0 27.3 13.9 51.4 35 65.6-12.9-.4-25.1-4-35.7-9.9v1c0 38.2 27.2 70 63.2 77.2-6.6 1.8-13.6 2.8-20.8 2.8-5.1.0-10-.5-14.8-1.4 10 31.3 39.1 54.1 73.6 54.7-27 21.1-60.9 33.7-97.8 33.7-6.4.0-12.6-.4-18.8-1.1C34.9 299 76.3 312 120.8 312c144.9.0 224.1-120 224.1-224.1.0-3.4-.1-6.8-.2-10.2 15.4-11.1 28.7-25 39.3-40.8z"/></svg>
<span>Twitter</span></a></div><div class="widget-social__item widget__item"><a class="widget-social__link widget__link btn" title=LinkedIn rel="noopener noreferrer" href=https://linkedin.com/in/../company/stackref target=_blank><svg class="widget-social__link-icon icon icon-linkedin" width="24" height="24" viewBox="0 0 352 352"><path d="M0 40v272c0 21.9 18.1 40 40 40h272c21.9.0 40-18.1 40-40V40c0-21.9-18.1-40-40-40H40C18.1.0.0 18.1.0 40zm312-8c4.6.0 8 3.4 8 8v272c0 4.6-3.4 8-8 8H40c-4.6.0-8-3.4-8-8V40c0-4.6 3.4-8 8-8H312zM59.5 87c0 15.2 12.3 27.5 27.5 27.5s27.5-12.3 27.5-27.5S102.2 59.5 87 59.5 59.5 71.8 59.5 87zM187 157h-1v-21h-45v152h47v-75c0-19.8 3.9-39 28.5-39 24.2.0 24.5 22.4 24.5 40v74h47v-83.5c0-40.9-8.7-72-56.5-72-23 0-38.2 12.6-44.5 24.5zM64 288h47.5V136H64V288z"/></svg>
<span>LinkedIn</span></a></div><div class="widget-social__item widget__item"><a class="widget-social__link widget__link btn" title=GitHub rel="noopener noreferrer" href=https://github.com/stackref target=_blank><svg class="widget-social__link-icon icon icon-github" width="24" height="24" viewBox="0 0 384 374"><path d="m192 0C85.9.0.0 85.8.0 191.7c0 84.7 55 156.6 131.3 181.9 9.6 1.8 13.1-4.2 13.1-9.2.0-4.6-.2-16.6-.3-32.6-53.4 11.6-64.7-25.7-64.7-25.7-8.7-22.1-21.3-28-21.3-28-17.4-11.9 1.3-11.6 1.3-11.6 19.3 1.4 29.4 19.8 29.4 19.8 17.1 29.3 44.9 20.8 55.9 15.9 1.7-12.4 6.7-20.8 12.2-25.6-42.6-4.8-87.5-21.3-87.5-94.8.0-20.9 7.5-38 19.8-51.4-2-4.9-8.6-24.3 1.9-50.7.0.0 16.1-5.2 52.8 19.7 15.3-4.2 31.7-6.4 48.1-6.5 16.3.1 32.7 2.2 48.1 6.5 36.7-24.8 52.8-19.7 52.8-19.7 10.5 26.4 3.9 45.9 1.9 50.7 12.3 13.4 19.7 30.5 19.7 51.4.0 73.7-44.9 89.9-87.7 94.6 6.9 5.9 13 17.6 13 35.5.0 25.6-.2 46.3-.2 52.6.0 5.1 3.5 11.1 13.2 9.2C329 348.2 384 276.4 384 191.7 384 85.8 298 0 192 0z"/></svg>
<span>GitHub</span></a></div><div class="widget-social__item widget__item"><a class="widget-social__link widget__link btn" title=GitLab rel="noopener noreferrer" href=https://gitlab.com/stackref target=_blank><svg class="widget-social__link-icon icon icon-gitlab" width="24" height="24" viewBox="0 0 265 265"><path d="M128.075 236.075l47.104-144.97H80.97l47.104 144.97zM14.956 91.104.642 135.16a9.752 9.752.0 003.542 10.903l123.891 90.012-113.12-144.97zM14.956 91.105H80.97L52.601 3.79c-1.46-4.493-7.816-4.492-9.275.0l-28.37 87.315zM241.194 91.104l14.314 44.056a9.752 9.752.0 01-3.543 10.903l-123.89 90.012 113.119-144.97zM241.194 91.105h-66.015l28.37-87.315c1.46-4.493 7.816-4.492 9.275.0l28.37 87.315z"/></svg>
<span>GitLab</span></a></div><div class="widget-social__item widget__item"><a class="widget-social__link widget__link btn" title=Email href=mailto:info@stackref.com><svg class="widget-social__link-icon icon icon-mail" width="24" height="24" viewBox="0 0 416 288"><path d="m0 16v256 16h16 384 16v-16V16 0h-16H16 0zm347 16-139 92.5L69 32zM199 157.5l9 5.5 9-5.5L384 46v210H32V46z"/></svg>
<span>info@stackref.com</span></a></div><div class="widget-social__item widget__item"><a class="widget-social__link widget__link btn" title="StackRef Home" rel="noopener noreferrer" href=https://stackref.com target=_blank><span>StackRef Home</span></a></div><div class="widget-social__item widget__item"><a class="widget-social__link widget__link btn" title="StackRef in AWS Marketplace" rel="noopener noreferrer" href="https://aws.amazon.com/marketplace/seller-profile?id=8c3a2dab-30bb-47b6-add8-036adde2c99a" target=_blank><span>StackRef in AWS Marketplace</span></a></div></div></div></aside></div><footer class=footer><div class="container footer__container flex"><div class=footer__copyright>© 2026 StackRef Inc. - All Rights Reserved</div></div></footer></div><script async defer src=/js/menu.js></script></body></html>