Vulnerabilities
Apostrophe CMS patch fixes disk exhaustion flaw in rich text widget
Version 4.33.0 resolves a high severity issue where rejected uploads persist in temporary directories, allowing unauthenticated users to fill disk space.
npm
Everything Patch Gazette has reported about npm: 2 stories, newest first. Part of our Malware & Ransomware coverage.
Malware & Ransomware
Shai-Hulud worm enters AI sector through tainted Tensorlake npm package
Credential-stealing malware was detected within minutes of the npm release, though the full scope of the compromise remains unknown to security researchers.