https://fresh-reads.lovable.app/What developers should know about, and what to do — from advisory databases and the researchers who find supply-chain malware.Sun, 01 Nov 2026 08:57:41 +0000https://github.com/advisories/GHSA-mghf-wjfp-p5xm9b6feff8c4ed6b6fWed, 28 Oct 2026 21:14:14 +0000Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one br_table instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to a — What to do: Upgrade wasmtime to 36.0.19 or later. [confirmed · GitHub Advisory Database]rustvulnshttps://github.com/advisories/GHSA-m665-v7pm-7grjfb59cb7f9aa5190eWed, 28 Oct 2026 21:09:50 +0000Summary A critical architectural parser differential exists in the zip crate ( (&mut self, file: &mut ZipFile ) -> ZipResult { file.safe_prepare_path(&self.outpath, &mut outpath, None:: bool)>)?; let mut outfile = fs::File::create(&outpath)?; io::copy(file, &mut outfile)?; Ok(()) — What to do: Upgrade zip to 9.0.5 or later. [confirmed · GitHub Advisory Database]rustvulnshttps://github.com/advisories/GHSA-897f-g5gm-fmxm53ba0e8cdeceaeaaFri, 23 Oct 2026 22:02:20 +0000Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function bod — What to do: Upgrade wasmtime to 36.0.19 or later. [confirmed · GitHub Advisory Database]rustvulnshttps://socket.dev/blog/rust-cargo-cooldowns?utm_medium=feed49724aea5fefde99Tue, 20 Oct 2026 14:21:31 +0000Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases. [confirmed · Socket]rust