Topic
security
Vulnerability notes from vendor advisories and source diffs: affected versions, how to tell if a host is exposed, and how to confirm the fix is running.
16 engineering notes.
- Binance 14 cleared its EIP-7702 delegation: what the chain proves, and what it does notAt block 26,301,896 the address labelled Binance 14 reset its code to empty with a type-4 transaction. The clear removes the sweeper contract; it does not prove the signing key is safe. A read-only probe for any delegated account.
- Binance's $3.3B wallet transfers: what the chain shows, and how to tell a hack from a moveRead from a public Ethereum node: an EIP-7702 delegation on the Binance 14 address, a 65-token sweep, and Tether and Circle freezes. Signs that separate theft from an internal move.
- eMudhra CA compromise: eight intermediate keys anyone could recoverEight eMudhra intermediate CA keys were generated with almost no randomness. What happened, which root was distrusted, and which clients stayed exposed after browsers were fixed.
- Argo CD October 2026: eight advisories, then a compromised root CA in the imagesArgo CD 3.3.15, 3.4.10 and 3.5.4 fix four critical repo-server and AppProject flaws. Only 3.3.18, 3.4.12 and 3.5.6 also drop the compromised eMudhra root from the image.
- CVE-2026-98432: a 9.8 kernel TCP use-after-free Ubuntu has not patched yetThe Linux kernel rates it 9.8, Red Hat rates it 5.9, and Ubuntu still lists every maintained release as work in progress. How to tell whether you are exposed.
- Install scripts are the supply-chain attack surfaceThe 2026 npm and PyPI compromises ran through lifecycle scripts and stolen publish tokens. A probe that shows what your install actually executes.
- Docker Engine 29: the image store changed under youEngine 29 makes the containerd image store the default for new installs, bumps the API, and its 29.9.x line carries a long list of security fixes.
- OpenSSL 4.0 is current: find the copies your services actually loadOpenSSL 4.0 shipped in April 2026 and 4.1 in October. A probe that finds the OpenSSL builds linked into running services, not the one on PATH.
- OpenSSH 10.6: the October 2026 security releaseOpenSSH 10.6 fixes a compression side-channel, tightens command-line username handling, and enables a hybrid post-quantum signature by default.
- MTA-STS, TLS-RPT and DANE: mail transport security with Postfix 3.10Postfix 3.10 adds TLS-RPT reporting for DANE and MTA-STS. What the three mechanisms do, how to enable reporting, and what the implementation does not cover.
- DMARC is now RFC 9989: what changed in May 2026The DMARC specification was replaced in May 2026. The pct tag is gone, np and psd arrived, and policy discovery no longer uses the Public Suffix List.
- TLS certificates are getting shorter: 200 days now, 100 days in 2027The 200-day maximum is already in force, Let's Encrypt moves to 64-day and then 45-day certificates, and hardcoded renewal intervals need to change now.
- nginx 1.30.6 and 1.31.7: the October 2026 security releaseFive nginx CVEs fixed in October 2026: the affected directives, exposure conditions, fixed versions, and how to confirm which build is actually serving.
- CVE-2026-109618: PHP memory exhaustion and request cleanupHow PHP's OOM bailout corrupts request state, why mod_php and FPM differ, and how to verify a patched deployment.
- CVE-2026-109619: stale PHP state across worker requestsThe producer-consumer lifetime bug behind CVE-2026-109619, conditional FPM exposure, and a practical worker-replacement and configuration review.
- CVE-2026-115560: audit PHP session serialization changesThe configuration and application-code conditions behind PHP's October 23 session advisory, with a source audit, mitigation placement and regression plan.
Related service: Security & Penetration Testing →
