Mitigation code available
A 9.8 in the kernel's IPv4 TCP path, no fixed kernel for any Ubuntu release and a tracker page that lists no mitigation. The fix you cannot install yet still tells you what the bug needs, and what a bug needs can be taken away.
Seven of our remediation roles are public, with the shared library they depend on. The fixes themselves are a morning's work each. What took the time was deciding what a pack must declare and demonstrate before anything will run it as root across a fleet, and only some of those gates exist today.
Mitigation code available
PHP2Shell and the Brotli decoder bug were patched the same day. One got the emergency response, the other did not, and the quiet one is harder to find on your estate because the obvious version strings lie about it. There is a role you can run to work out what you have.
Microkernels, eBPF, WebAssembly, LoRa mesh and confidential computing are usually filed as five unrelated hobbies. They are one argument, running for about a decade, about where you put a boundary and what it costs to cross it.
Mitigation code available
Two unauthenticated remote code execution bugs in PHP core, CVSS 9.2, with upstream releases out the same afternoon. The patch is the easy part. CISA's first instruction is to inventory every system running any PHP, and on most estates nobody can do that tonight.
Hybrid key exchange is largely deployed; certificates and signatures are nowhere near. The real bottleneck is crypto-agility, because anything that hard-codes an algorithm or needs a firmware update can't pivot in time.
The UK has the power to issue a technical capability notice under the Investigatory Powers Act. Apple withdrew Advanced Data Protection for UK users rather than weaken it. Almost everything else about the case is secret, including whether the notice exists.
Mitigation code available
Next.js used an internal header to mark its own subrequests, and anyone could send it. Authorisation checks made in middleware were skipped. The mitigation is a header strip at the proxy, which works because the boundary was in the wrong place to begin with.
The asymmetry cliché is true, and it is usually wheeled out as grounds for despair. Read properly it argues for a particular kind of engineering: reduce what has to be defended rather than defending it better.
Every attestation chain ends in something you trust for reasons that have nothing to do with technology. Knowing where yours ends is more use to you than the chain itself.
The interesting part of WebAssembly outside the browser has little to do with portability. A module arrives with no ambient authority at all; it gets handles, not a filesystem.
What attestation proves, what the trusted computing base holds once you have counted the firmware and what becomes possible when the machine you rent cannot read the work you run on it.
Two years of government documents ask vendors to stop writing new code in memory-unsafe languages and to publish roadmaps for the old code. None of it is law. The clearest production-scale evidence yet that the roadmap approach works arrived last month: five years of Android results, published by the vendor rather than demanded by a regulator.
The backdoor sat in the release tarball and not in the git tree. Closing that gap is what reproducibility is for, and it's the highest-value control to come out of the whole incident.
Mitigation code available
regreSSHion is unauthenticated root on sshd, and the published workaround turns it into a denial of service. Five days of reading advisories to find that the only safe verdict a scanner can reach, on a lot of hosts, is "unknown".
Mitigation code available
A backdoor in xz-utils 5.6.0 and 5.6.1, planted over a multi-year social engineering campaign against a burnt-out maintainer, and caught by one engineer who wondered why SSH was half a second slow.
Almost every useful security tool is also an attack tool. The question was never whether to build dual-use technology; it is what you owe the people downstream of it.
Mandated, useful and routinely oversold. A bill of materials answers "where is it running" in seconds, which is valuable because that question used to take days.
A pacemaker, a cochlear implant and an insulin pump are embedded computers with firmware, update paths and signing keys. Every assumption this trade makes about patching, rollback and end-of-life was written for machines you can switch off, and none of them survives contact with a device that is inside somebody.
Mitigation code available
PwnKit is a local privilege escalation in pkexec affecting every version since 2009. Qualys published a one-line workaround; Red Hat published a note saying do not use it. We shipped a role that does both things, and the interesting part is which hosts get which.
Mitigation code available
Six days after Log4Shell went public we shipped an Ansible role that stripped JndiLookup from every JAR it could find, a week ahead of the joint advisory. Almost none of those days went on the fix. They went on answering where Log4j was running, which is a question about your own estate rather than about Apache.
WireGuard shipped in Linux 5.6 at roughly 4,000 lines, against OpenVPN's hundred thousand and more. The size is the security argument; it isn't a happy side effect of one.
Containers won on ergonomics and spent the decade paying for the boundary they gave up. The answer that arrived in 2018 was a smaller virtual machine rather than a stronger container: tens of thousands of lines of Rust, a boot measured in milliseconds and a device model with almost nothing in it.
Speculative execution was the free lunch of CPU design for twenty years, and it leaks straight across the privilege boundary everything else was built on. This is the week that will explain the next decade of isolation work.
