https://www.kalfoundry.com/blog.html One post per major event in software, every fact linked to its source. en Wed, 21 Oct 2026 12:00:00 GMT https://www.kalfoundry.com/blog/php2shell-critical-php-rce.html https://www.kalfoundry.com/blog/php2shell-critical-php-rce.html Wed, 21 Oct 2026 12:00:00 GMT vulnerability PHP shipped emergency releases for two unauthenticated remote code execution bugs in the runtime itself, after details leaked ahead of the coordinated disclosure. https://www.kalfoundry.com/blog/nextjs-oct-2026-critical-rce-fixes.html https://www.kalfoundry.com/blog/nextjs-oct-2026-critical-rce-fixes.html Wed, 14 Oct 2026 12:00:00 GMT vulnerability Vercel released out-of-band Next.js updates for two critical flaws that let an attacker with no login run code on the server: one in "use cache" and one in SVG image optimization. https://www.kalfoundry.com/blog/google-gemini-4-argon-ga.html https://www.kalfoundry.com/blog/google-gemini-4-argon-ga.html Tue, 13 Oct 2026 12:00:00 GMT ai Google's new flagship reasoning model reached general availability on October 13, 2026, after a limited release to cyber defenders, at introductory prices that double on December 1. https://www.kalfoundry.com/blog/citrix-netscaler-zero-days-cve-2026-88771.html https://www.kalfoundry.com/blog/citrix-netscaler-zero-days-cve-2026-88771.html Sun, 27 Sep 2026 12:00:00 GMT vulnerability Citrix disclosed two critical NetScaler ADC and Gateway flaws already being exploited, one of them an unauthenticated code-execution bug that works in default configurations. https://www.kalfoundry.com/blog/anthropic-claude-opus-5-5.html https://www.kalfoundry.com/blog/anthropic-claude-opus-5-5.html Tue, 22 Sep 2026 12:00:00 GMT ai Claude Opus 5.5 launched September 22, 2026 on the Claude API and the major clouds at $4/$20 per million tokens, and Anthropic now recommends it as the starting model for most workloads. https://www.kalfoundry.com/blog/wordpress-core-page-template-rfi-cve-2026-87902.html https://www.kalfoundry.com/blog/wordpress-core-page-template-rfi-cve-2026-87902.html Tue, 22 Sep 2026 12:00:00 GMT vulnerability A WordPress core bug let unauthenticated attackers make a site include a local PHP file of their choosing, which can lead to remote code execution when certain server and theme conditions are met. Probing began the same day. https://www.kalfoundry.com/blog/adobe-commerce-magento-stylesmuggler-cve-2026-75650.html https://www.kalfoundry.com/blog/adobe-commerce-magento-stylesmuggler-cve-2026-75650.html Mon, 07 Sep 2026 12:00:00 GMT vulnerability A maximum-severity template-engine bug let attackers run code on Magento and Adobe Commerce stores without logging in, and it was exploited before Adobe shipped a hotfix. https://www.kalfoundry.com/blog/openai-gpt-6-astra.html https://www.kalfoundry.com/blog/openai-gpt-6-astra.html Thu, 03 Sep 2026 12:00:00 GMT ai OpenAI's GPT-6 Astra arrived in the API at $10/$50 per million tokens with tighter cyber safeguards, followed within weeks by lower-cost Sol and Luna models. https://www.kalfoundry.com/blog/google-play-target-api-36.html https://www.kalfoundry.com/blog/google-play-target-api-36.html Mon, 31 Aug 2026 12:00:00 GMT release New Android apps and updates on Google Play must now target Android 16 (API level 36), which changes how apps lay out on large screens and handle the back gesture. https://www.kalfoundry.com/blog/openai-assistants-api-shutdown.html https://www.kalfoundry.com/blog/openai-assistants-api-shutdown.html Wed, 26 Aug 2026 12:00:00 GMT ai OpenAI turned off the Assistants API on August 26, 2026, one year after announcing its deprecation; apps must now use the Responses and Conversations APIs. https://www.kalfoundry.com/blog/mcp-2026-07-28-stateless-spec.html https://www.kalfoundry.com/blog/mcp-2026-07-28-stateless-spec.html Tue, 28 Jul 2026 12:00:00 GMT ai The open protocol AI assistants use to reach tools and data dropped sessions and its handshake, about seven months after Anthropic handed MCP to a Linux Foundation fund. https://www.kalfoundry.com/blog/eu-ai-act-digital-omnibus.html https://www.kalfoundry.com/blog/eu-ai-act-digital-omnibus.html Fri, 24 Jul 2026 12:00:00 GMT ai The Digital Omnibus on AI, published as Regulation (EU) 2026/1744, moved high-risk obligations to December 2027 and August 2028 while keeping a December 2026 deadline for marking AI-generated content. https://www.kalfoundry.com/blog/azure-west-us-outage-2026-07-23.html https://www.kalfoundry.com/blog/azure-west-us-outage-2026-07-23.html Thu, 23 Jul 2026 12:00:00 GMT outage A defect expanded an automated network repair to every optical device leaving one datacenter, cutting it off from Microsoft's WAN and disrupting Azure services in West US and Microsoft 365. https://www.kalfoundry.com/blog/wordpress-core-wp2shell-rce-chain.html https://www.kalfoundry.com/blog/wordpress-core-wp2shell-rce-chain.html Fri, 17 Jul 2026 12:00:00 GMT vulnerability Two WordPress core bugs could be chained so an attacker with no login could run code on a default WordPress site, and both were under active exploitation within days of the fix. https://www.kalfoundry.com/blog/sharepoint-onprem-exploitation-wave-july-2026.html https://www.kalfoundry.com/blog/sharepoint-onprem-exploitation-wave-july-2026.html Tue, 14 Jul 2026 12:00:00 GMT vulnerability Attackers used on-premises SharePoint Server bugs to run code, steal IIS machine keys and plant malware, and CISA's alert grew to cover six exploited CVEs. https://www.kalfoundry.com/blog/amazon-linux-2-end-of-support.html https://www.kalfoundry.com/blog/amazon-linux-2-end-of-support.html Tue, 30 Jun 2026 12:00:00 GMT release AWS's long-running Amazon Linux 2 stopped getting standard security updates on June 30, 2026, and AWS points everyone to Amazon Linux 2023. https://www.kalfoundry.com/blog/klue-oauth-token-breach-salesforce.html https://www.kalfoundry.com/blog/klue-oauth-token-breach-salesforce.html Thu, 18 Jun 2026 12:00:00 GMT breach Attackers used a compromised legacy credential at sales-intelligence vendor Klue to steal the OAuth tokens connecting it to customers' platforms, then pulled data out of those customers' Salesforce and other SaaS accounts. https://www.kalfoundry.com/blog/anthropic-claude-fable-5-export-suspension.html https://www.kalfoundry.com/blog/anthropic-claude-fable-5-export-suspension.html Tue, 09 Jun 2026 12:00:00 GMT ai Anthropic launched Claude Fable 5, a Mythos-class model it said it had made safe for general use, on June 9, 2026; three days later a US government export control directive led Anthropic to switch it off for all customers until July 1. https://www.kalfoundry.com/blog/github-copilot-usage-based-billing.html https://www.kalfoundry.com/blog/github-copilot-usage-based-billing.html Mon, 01 Jun 2026 12:00:00 GMT ai On June 1, 2026 GitHub replaced Copilot's premium requests with token-metered GitHub AI Credits, with a monthly credit allotment included in each plan. https://www.kalfoundry.com/blog/drupal-core-sqli-sa-core-2026-004.html https://www.kalfoundry.com/blog/drupal-core-sqli-sa-core-2026-004.html Wed, 20 May 2026 12:00:00 GMT vulnerability A highly critical SQL injection in Drupal core let anonymous visitors attack sites running on PostgreSQL, and exploit attempts were detected within two days. https://www.kalfoundry.com/blog/wordpress-7-0-armstrong.html https://www.kalfoundry.com/blog/wordpress-7-0-armstrong.html Wed, 20 May 2026 12:00:00 GMT release WordPress 7.0 shipped on May 20, 2026 with AI plumbing in core, a refreshed admin, and a higher minimum PHP version. https://www.kalfoundry.com/blog/tanstack-npm-compromise.html https://www.kalfoundry.com/blog/tanstack-npm-compromise.html Mon, 11 May 2026 12:00:00 GMT supply chain Attackers chained a GitHub Actions workflow flaw, cache poisoning and an OIDC token pulled from runner memory to publish 84 malicious versions of TanStack Router and Start packages straight to npm; StepSecurity tied it to a wider self-spreading wave. https://www.kalfoundry.com/blog/nodejs-20-end-of-life.html https://www.kalfoundry.com/blog/nodejs-20-end-of-life.html Thu, 30 Apr 2026 12:00:00 GMT release Node.js 20 stopped getting security fixes on April 30, 2026, five days before Node.js 26 shipped as the last release line under the old odd/even schedule. https://www.kalfoundry.com/blog/linux-copy-fail-cve-2026-31431.html https://www.kalfoundry.com/blog/linux-copy-fail-cve-2026-31431.html Wed, 29 Apr 2026 12:00:00 GMT vulnerability A Linux kernel bug let any local user become root with a short, reliable script, and because the page cache is shared across containers on a host it put Kubernetes nodes and CI runners at risk. https://www.kalfoundry.com/blog/app-store-xcode-26-sdk-requirement.html https://www.kalfoundry.com/blog/app-store-xcode-26-sdk-requirement.html Tue, 28 Apr 2026 12:00:00 GMT release Since April 28, 2026, App Store Connect only accepts uploads built with Xcode 26 or later and a 26-series SDK or later, so an outdated build setup can block your next app update. https://www.kalfoundry.com/blog/cpanel-whm-auth-bypass-cve-2026-41940.html https://www.kalfoundry.com/blog/cpanel-whm-auth-bypass-cve-2026-41940.html Tue, 28 Apr 2026 12:00:00 GMT vulnerability A flaw in cPanel's login flow let unauthenticated attackers into the hosting control panel, and it was exploited before a patch existed and used in ransomware attacks. https://www.kalfoundry.com/blog/deepseek-v4-open-weights.html https://www.kalfoundry.com/blog/deepseek-v4-open-weights.html Fri, 24 Apr 2026 12:00:00 GMT ai DeepSeek published V4-Pro and V4-Flash weights with a 1M-token context, made them its API models, and retired the old deepseek-chat and deepseek-reasoner names three months later. https://www.kalfoundry.com/blog/mysql-8-0-end-of-life.html https://www.kalfoundry.com/blog/mysql-8-0-end-of-life.html Tue, 21 Apr 2026 12:00:00 GMT release Oracle moved MySQL 8.0 to Sustaining Support in April 2026 and released MySQL 9.7 LTS the same day, pointing users to 8.4 LTS or 9.7 LTS. https://www.kalfoundry.com/blog/axios-npm-compromise.html https://www.kalfoundry.com/blog/axios-npm-compromise.html Tue, 31 Mar 2026 12:00:00 GMT supply chain Attackers took over the axios lead maintainer's npm account and published versions 1.14.1 and 0.30.4, which installed a remote access trojan through an injected dependency. https://www.kalfoundry.com/blog/ingress-nginx-retired.html https://www.kalfoundry.com/blog/ingress-nginx-retired.html Tue, 24 Mar 2026 12:00:00 GMT release The Kubernetes project retired its widely used Ingress NGINX controller in March 2026, so clusters that still run it keep working but will never get another fix. https://www.kalfoundry.com/blog/netscaler-saml-idp-memory-overread-cve-2026-3055.html https://www.kalfoundry.com/blog/netscaler-saml-idp-memory-overread-cve-2026-3055.html Mon, 23 Mar 2026 12:00:00 GMT vulnerability A NetScaler ADC and Gateway bug could leak appliance memory to unauthenticated attackers when the box acts as a SAML identity provider, and it reached CISA's exploited list seven days later. https://www.kalfoundry.com/blog/trivy-github-action-compromise.html https://www.kalfoundry.com/blog/trivy-github-action-compromise.html Thu, 19 Mar 2026 12:00:00 GMT supply chain Attackers used stolen credentials to repoint Trivy's GitHub Action tags and publish a backdoored Trivy release that harvested secrets from CI pipelines; LiteLLM believes the fallout led to its own PyPI compromise. https://www.kalfoundry.com/blog/aws-middle-east-drone-strikes.html https://www.kalfoundry.com/blog/aws-middle-east-drone-strikes.html Sun, 01 Mar 2026 12:00:00 GMT outage Drone strikes physically damaged AWS facilities in the UAE and Bahrain, impairing multiple Availability Zones; AWS later said data held only in one UAE zone, or only in the Bahrain Region, cannot be restored. https://www.kalfoundry.com/blog/notepad-plus-plus-update-hijack.html https://www.kalfoundry.com/blog/notepad-plus-plus-update-hijack.html Mon, 02 Feb 2026 12:00:00 GMT supply chain Attackers who compromised Notepad++'s former hosting provider quietly redirected selected users' update requests to malicious installers for months before the project disclosed it. https://www.kalfoundry.com/blog/fortinet-forticloud-sso-bypass.html https://www.kalfoundry.com/blog/fortinet-forticloud-sso-bypass.html Tue, 27 Jan 2026 12:00:00 GMT vulnerability A second FortiCloud single sign-on flaw let attackers holding a FortiCloud account and a registered device log into other customers' Fortinet devices, even ones patched for December's SSO bug. https://www.kalfoundry.com/blog/office-zero-day-cve-2026-21509.html https://www.kalfoundry.com/blog/office-zero-day-cve-2026-21509.html Mon, 26 Jan 2026 12:00:00 GMT vulnerability Microsoft fixed an exploited Office bug that bypasses OLE protections when a user opens a malicious document. https://www.kalfoundry.com/blog/mongobleed-mongodb-zlib-heap-leak.html https://www.kalfoundry.com/blog/mongobleed-mongodb-zlib-heap-leak.html Fri, 19 Dec 2025 12:00:00 GMT vulnerability A length-field bug in MongoDB's zlib-compressed protocol headers let any client that could reach the server read uninitialized heap memory without logging in. https://www.kalfoundry.com/blog/n8n-critical-rce-cve-2025-68613.html https://www.kalfoundry.com/blog/n8n-critical-rce-cve-2025-68613.html Fri, 19 Dec 2025 12:00:00 GMT vulnerability Two critical n8n flaws — one needing only a login, one needing none if a vulnerable form workflow exists — could let attackers run code on, or read files from, n8n servers. https://www.kalfoundry.com/blog/watchguard-firebox-iked-cve-2025-14733.html https://www.kalfoundry.com/blog/watchguard-firebox-iked-cve-2025-14733.html Fri, 19 Dec 2025 12:00:00 GMT vulnerability An out-of-bounds write in WatchGuard's iked VPN process could let unauthenticated attackers run code on Firebox firewalls, and WatchGuard saw attackers exfiltrate configuration files and, in one variant, the local management user database. https://www.kalfoundry.com/blog/chrome-safari-zero-days-december-2025.html https://www.kalfoundry.com/blog/chrome-safari-zero-days-december-2025.html Wed, 10 Dec 2025 12:00:00 GMT vulnerability Google and Apple patched browser-engine bugs flagged as exploited in the wild — reported by Apple and Google's Threat Analysis Group — across Chrome, Safari and Apple's operating systems. https://www.kalfoundry.com/blog/cloudflare-outage-2025-12-05.html https://www.kalfoundry.com/blog/cloudflare-outage-2025-12-05.html Fri, 05 Dec 2025 12:00:00 GMT outage While rushing WAF protection for a critical React vulnerability, Cloudflare flipped a global killswitch that hit a years-old bug and returned HTTP 500s for about 25 minutes. https://www.kalfoundry.com/blog/react2shell-react-server-components-rce.html https://www.kalfoundry.com/blog/react2shell-react-server-components-rce.html Wed, 03 Dec 2025 12:00:00 GMT vulnerability An unauthenticated remote code execution flaw in React Server Components put Next.js App Router apps and other RSC frameworks at risk, and attackers moved within hours. https://www.kalfoundry.com/blog/mistral-3-apache-open-weights.html https://www.kalfoundry.com/blog/mistral-3-apache-open-weights.html Tue, 02 Dec 2025 12:00:00 GMT ai Mistral released Mistral Large 3 and three Ministral 3 sizes under Apache 2.0, on its own platform, Hugging Face and the major clouds. https://www.kalfoundry.com/blog/shai-hulud-2-npm-worm.html https://www.kalfoundry.com/blog/shai-hulud-2-npm-worm.html Mon, 24 Nov 2025 12:00:00 GMT supply chain A second wave of the self-spreading npm worm ran at install time, stole developer and cloud credentials, published them to public GitHub repos, and could try to wipe home directories. https://www.kalfoundry.com/blog/php-8-5-release-php-8-1-eol.html https://www.kalfoundry.com/blog/php-8-5-release-php-8-1-eol.html Thu, 20 Nov 2025 12:00:00 GMT release PHP 8.5 arrived on November 20, 2025 with a pipe operator and a built-in URL parser, six weeks before PHP 8.1 lost all security support. https://www.kalfoundry.com/blog/gainsight-salesforce-oauth-breach.html https://www.kalfoundry.com/blog/gainsight-salesforce-oauth-breach.html Wed, 19 Nov 2025 12:00:00 GMT breach Compromised tokens tied to Gainsight's Salesforce connected app gave attackers access to some customers' Salesforce data, and the integrations stayed offline for weeks. https://www.kalfoundry.com/blog/cloudflare-outage-2025-11-18.html https://www.kalfoundry.com/blog/cloudflare-outage-2025-11-18.html Tue, 18 Nov 2025 12:00:00 GMT outage A database permissions change doubled a Bot Management config file, crashed Cloudflare's proxy, and returned 5xx errors for sites behind it for hours. https://www.kalfoundry.com/blog/dotnet-10-lts.html https://www.kalfoundry.com/blog/dotnet-10-lts.html Tue, 11 Nov 2025 12:00:00 GMT release Microsoft shipped .NET 10 as a three-year long-term-support release, and both earlier supported versions stop getting patches on the same day in November 2026. https://www.kalfoundry.com/blog/azure-front-door-outage-2025-10-29.html https://www.kalfoundry.com/blog/azure-front-door-outage-2025-10-29.html Wed, 29 Oct 2025 12:00:00 GMT outage A latent bug in Azure Front Door crashed edge servers worldwide, causing timeouts and DNS failures for Azure, Microsoft 365 and sites fronted by AFD from mid-afternoon UTC until just after midnight. https://www.kalfoundry.com/blog/wsus-rce-out-of-band-cve-2025-59287.html https://www.kalfoundry.com/blog/wsus-rce-out-of-band-cve-2025-59287.html Thu, 23 Oct 2025 12:00:00 GMT vulnerability Microsoft released an out-of-band update for a critical Windows Server Update Services flaw after an earlier update did not fully mitigate it, and CISA added it to its known-exploited catalog the next day. https://www.kalfoundry.com/blog/nextjs-16-release.html https://www.kalfoundry.com/blog/nextjs-16-release.html Tue, 21 Oct 2025 12:00:00 GMT release Next.js 16 changed the default bundler, made caching opt-in and raised version floors, and it is now the only Next.js line in Active LTS.