<p><strong>TLDR:</strong> Three malicious versions of node-ipc were published to npm after attackers hijacked a dormant maintainer account via an expired email domain, deploying an 80KB credential stealer that exfiltrates cloud keys, SSH keys, and CI/CD secrets over DNS. Multiple Linux kernel stable releases landed today patching CVE-2026-46333 and the ssh-keysign-pwn ptrace race, with a public PoC already circulating. The Microsoft Exchange zero-day XSS (CVE-2026-42897) is being actively exploited in the wild with no permanent patch yet. And the Linux kernel project merged new documentation clarifying what qualifies as a security bug, driven largely by a flood of low-quality AI-generated reports overwhelming maintainers.</p>
<hr>
<h2>node-ipc npm compromise via expired domain takeover</h2>
<p>Versions 9.1.6, 9.2.3, and 12.0.1 of node-ipc contain an obfuscated credential-stealing payload injected into the CommonJS entrypoint. The attack vector is worth understanding: attackers registered an expired custom domain tied to a dormant maintainer’s email account, triggered a password reset, and published malicious versions through a legitimate account. The malware collects credentials from over 100 sources — AWS, Azure, GCP, SSH keys, Kubernetes, Docker, GitHub tokens, .env files — and exfiltrates via DNS TXT queries to avoid detection. With roughly 700K weekly downloads and 424 dependent packages, the blast radius is real. If you have any of the affected versions in your dependency tree, rotate everything now and rebuild from a clean lockfile. The expired-domain-email-takeover vector likely affects other dormant maintainer accounts across the registry.</p>
<h2>Linux kernel patches ssh-keysign-pwn and CVE-2026-46333</h2>
<p>Seven stable kernel versions (7.0.8, 6.18.31, 6.12.89, 6.6.139, 6.1.173, 5.15.207, 5.10.256) were released today, all patching CVE-2026-46333 reported by Qualys — a bug that Jann Horn had proposed a fix for back in 2020. A public PoC is already out. The ssh-keysign-pwn exploit specifically abuses a race window in <code>__ptrace_may_access()</code> where the dumpable check is skipped when <code>task-&gt;mm == NULL</code>, combined with <code>pidfd_getfd</code> to steal file descriptors during process exit — confirmed working on Debian, Ubuntu, Arch, CentOS, and Raspberry Pi OS. Patch now; the PoC lowers the bar significantly.</p>
<h2>Microsoft Exchange zero-day XSS actively exploited</h2>
<p>CVE-2026-42897 is an XSS in Exchange’s Outlook Web Access that fires when a victim opens a crafted email — no clicks beyond that. Exchange Server 2016, 2019, and SE are all affected regardless of patch level; Exchange Online is not. No permanent fix exists yet. Microsoft pushed an interim mitigation through the Exchange Emergency Mitigation Service, which should have auto-applied on most installations. If EM Service is disabled or you’re air-gapped, run EOMT manually via PowerShell. The mitigation breaks calendar printing and inline images. That’s the trade-off. If this is the nudge your org needed to start a migration off on-premises Exchange, the timing is not coincidental.</p>
<h2>Linux kernel documents what counts as a security bug, pushes back on AI-generated reports</h2>
<p>The kernel project merged new documentation for Linux 7.1 authored by Willy Tarreau that does two things: clarifies the threat model and what actually qualifies for private disclosure, and sets explicit expectations for AI-assisted bug reports. The short version: findings made with AI tooling are treated as public by default, since multiple researchers tend to find the same issues simultaneously. Reports must be concise, plain text, no Markdown, no speculative impact claims, and must include a verified reproducer. The context here matters — recent high-profile LPEs like CopyFail, DirtyFrag, and Fragnesia were found with AI tools, but the same tooling is generating a flood of low-quality, unverified reports that are burning out maintainers. The documentation is a reasonable response to a real operational problem.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Fragnesia LPE (CVSS 7.8):</strong> Affects all Ubuntu releases 14.04 through 26.04 LTS via ESP/IPsec kernel modules; systems already mitigated for Dirty Frag are protected, others should block esp4/esp6 via modprobe and regenerate initramfs.</li>
<li><strong>CloudNativePG CVE-2026-44477:</strong> First CVE against the project; metrics exporter connected as postgres superuser with insufficient privilege demotion, allowing RESET ROLE to recover full privileges — versions 1.29.1 and 1.28.3 fix it, upgrade immediately.</li>
<li><strong>TanStack npm supply chain:</strong> 84 malicious versions across 42 packages published via GitHub Actions OIDC token extraction from a cache poisoning attack; OpenAI employee devices were reportedly compromised as a result.</li>
<li><strong>GitHub App installation tokens:</strong> New JWT-format tokens (~520 chars, <code>ghs_</code>-prefixed with two dots) are rolling out; check for hardcoded length assumptions, update regex patterns, and ensure database columns accept at least 520 characters before the header-based override is deprecated.</li>
<li><strong>pnpm 11:</strong> Default minimum release age of 1 day is now on by default — a small but meaningful supply chain defense; the broader pattern of cooldown flags across npm, Yarn, Bun, and pnpm is worth standardizing on across your toolchain.</li>
<li><strong>CloudWatch Logs:</strong> Query result limit raised from 10K to 100K; <code>GetQueryResults</code> API now paginates at 10K per call with a continuation token.</li>
<li><strong>Cloudflare Workflows V2:</strong> Deterministic step-based execution model with concurrent instance limit raised from 4,500 to 50,000 and new executions per second from 100 to 300.</li>
<li><strong>Thymeleaf CVE-2026-40478 (CVSS 9.1):</strong> Server-side template injection via tab character sandbox bypass; only exploitable if user input reaches the expression engine directly, but patch to 3.1.4 regardless.</li>
<li><strong>Apache Flink 2.2.1:</strong> 44 bug fixes including data corruption with custom partitioners and unaligned checkpoints, sensitive data in debug logs, and SSL failures with newer JDK versions — all Flink 2.2 users should upgrade.</li>
<li><strong>Avada Builder WordPress plugin:</strong> Two CVEs affecting ~1M installs — unauthenticated SQL injection (CVE-2026-4798) and arbitrary file read at subscriber level (CVE-2026-4782); patch to 3.15.3 is available.</li>
<li><strong>AWS Bedrock Advanced Prompt Optimization:</strong> GA tool that iteratively rewrites and scores prompts using LLM-as-a-Judge or custom Lambda metrics, with cross-model comparison across up to five models simultaneously.</li>
<li><strong>Depot CI microVM boot times:</strong> Went from 7-9 seconds to ~0.79s P50 through layered optimizations: direct kernel boot, custom init binary in initramfs, parallel initialization, and hugepages — good reference architecture for anyone running JIT VM schedulers.</li>
<li><strong>SQL concurrency bugs walkthrough:</strong> Solid post tracing atomicity gaps, TOCTOU races, and deadlocks in a money-transfer example — worth sending to anyone who thinks wrapping queries in a transaction is sufficient.</li>
</ul>


Server-side development, system design, API patterns, and distributed architecture.

Backend Digest

Three malicious versions of node-ipc (9.1.6, 9.2.3, 12.0.1) were published to npm after attackers hijacked a dormant maintainer account via an expired email domain, deploying an 80KB credential stealer targeting AWS, GCP, Azure, SSH keys, and CI/CD secrets via DNS exfiltration — affecting ~700K weekly downloads. Seven Linux kernel stable releases patch CVE-2026-46333 and the ssh-keysign-pwn ptrace race condition, with a public PoC already circulating. Microsoft Exchange has an actively exploited XSS zero-day (CVE-2026-42897) with no permanent fix yet. The Linux kernel project also merged new documentation clarifying its security bug policy and explicitly treating AI-generated reports as public by default. Additional notable items include a TanStack npm supply chain attack, Thymeleaf SSTI (CVSS 9.1), Avada Builder WordPress SQLi, CloudNativePG privilege escalation CVE, pnpm 11 supply chain defenses, and GitHub App token format changes.

node-ipc supply chain attack hits 700K weekly downloads, Linux kernel patches ssh-keysign-pwn