Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2026-109432 lets Camunda 7 task queries run JUEL through orQueries. Fixes are enterprise only and CE 7.24.0 is affected. How it works and what to do.
fast-uri, the URI parser under ajv and Fastify, fixed four CVEs on 19 October in 2.4.8, 3.1.9 and 4.2.3. What each bug does and how to find old copies.
Two Angular SSR bugs: one URL can crash the SSR worker, another makes an open redirect. Fixed in 20.3.33, 21.2.25 and 22.2.1; Angular 19 gets no fix.
Malicious Electrum servers swapped just-broadcast payments for fakes, then waited for a fee bump. Upgrade to 4.8.3 and check outputs before signing.
CVE-2026-113351: libexpat 2.7.2 to 2.9.0 reset parsers reject every later XML document. Fix merged 23 Oct, no release yet. Who is affected, what to do.
Rails 8.0 security fixes end 7 Nov 2026. It got 10 advisory fixes in 2026, one critical. 8.1 needs the same Ruby. Versions, removals and upgrade steps.
OpenSSL 3.4 lost upstream support on 22 October 2026 and 3.6 ends on 1 November. Where they still ship, how to check each runtime, and what to move to.
Next.js 15 left Maintenance LTS on 21 October 2026. The last 15.x fixes, how to find every 15.x app in your estate, and a tested path to Next.js 16.
Eight problems worked in Vedic sutras, Chinese rods and suanpan, Japanese soroban and the school method, with step counts and what the evidence says.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
