https://fresh-reads.lovable.app/What developers should know about, and what to do — from advisory databases and the researchers who find supply-chain malware.Sun, 01 Nov 2026 08:57:41 +0000https://github.com/advisories/GHSA-hff9-5pqw-6w9fe1698c89ebba49c9Fri, 30 Oct 2026 22:57:00 +0000Summary The ICO loader allocates data_size + BMP_FILE_HEADER_LEN bytes after reading a 32-bit attacker-controlled data_size. For data_size > UINT32_MAX - BMP_FILE_HEADER_LEN, the addition wraps before allocation. imgproxy then writes the ICO prefix and reads up to the original de — What to do: Upgrade github.com/imgproxy/imgproxy/v3 to 4.0.16 or later. [confirmed · GitHub Advisory Database]govulnshttps://github.com/advisories/GHSA-cxf3-9h37-7rr844a9dce2c41f3986Fri, 23 Oct 2026 20:49:37 +0000Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that co — What to do: Upgrade github.com/labstack/echo/v4 to 4.16.1 or later. [confirmed · GitHub Advisory Database]govulnshttps://www.reversinglabs.com/blog/graphalgo-campaign-moves-upstream-into-infrastructure-as-codeec2de5e96b358e60Wed, 21 Oct 2026 15:00:00 +0000First reported by ReversingLabs in February, the malware has moved to Terraform providers and Go modules. Here’s what you need to know. [confirmed · ReversingLabs]go