Skip to content
TrustList

TrustList daily digest · Tech and security

Thursday, 8 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security7

  1. 1Security advisories

    GitHub fixes secret-scanning flaw that can reach code execution on GHES

    Exploiting the high-severity bug needs only push access to a repository with Advanced Security on, and a second, medium flaw lets a collaborator swap a repository's default branch.

  2. 2Security advisories

    Docker Engine 29.8.2 fixes DNS trick that disables TLS checks

    The flaw sits in how the daemon decides a registry is insecure, so removing entries from insecure-registries does not help. Docker names three workarounds for teams that cannot upgrade yet.

  3. 3Security advisories

    Splunk Enterprise fixes a critical Patroni flaw and 20 other bugs

    Four Splunk Secure Gateway fixes ship as an app update as well, and one medium flaw needs a limits.conf change after the upgrade, not just new binaries.

  4. 4Security advisories

    CISA lists old Strapi, ONLYOFFICE and Struts flaws as exploited

    All five flaws were fixed between 2015 and 2023, and the newest is a Strapi admin-panel leak fixed in 4.8.0. Federal agencies have until 11 October to deal with them.

  5. 5Security advisories

    IBM lists five WebSphere Liberty flaws fixed in 26.0.0.10

    The medium-severity bulletin covers every Liberty release from 17.0.0.3 to 26.0.0.9, offers no workaround, and gives October as the expected fix pack date.

  6. 6Security advisories

    Broadcom fixes 61 Brocade Fabric OS, SANnav and ASCG flaws

    Thirty-seven of the 61 are rated high. ASCG carries two unauthenticated flaws reachable from the adjacent network, and Fabric OS 10.0.1 closes both a command injection and a buffer overflow.

  7. 7Security advisories

    HashiCorp Vault 2.1.2 fixes ACL deny bypass and plugin code flaw

    Four Vault flaws were fixed in total, two rated high. Enterprise customers on older lines get patches in 1.21.12, 1.20.17 and 1.19.23, and a policy rewrite is needed first.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy