Skip to content
TrustList

TrustList daily digest · Tech and security

Friday, 23 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security10

  1. 1Security advisories

    HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8 wireless

    Seven CVE records scored 10.0 cover authentication bypass, command injection, SQL injection and buffer overflows that need no login. Fixed releases are 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 and 8.10.0.24.

  2. 2Security advisories

    Ruby 4.0.9, 3.4.12 and 3.3.13 fix the regexp bugs behind GitLab RCEs

    Any Ruby application that builds a regular expression from user input is exposed to the memory corruption GitLab turned into code execution. Regexp.timeout is no defence; the fix is the new releases.

  3. 3Security advisories

    Arista VeloCloud flaw lets any logged-in user become a superuser

    CVE-2026-114625, rated critical (CVSS 4.0 score 9.4), affects on-premises VeloCloud Orchestrator. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12; hosted orchestrators are already patched.

  4. 4Security advisories

    Fortinet ships FortiOS fixes for AI-found flaws, details on 10 November

    FortiOS 7.6.8, 7.4.13 and 8.0.2 and matching FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator builds fix critical and high-severity bugs. Fortinet is withholding the advisories until Patch Tuesday.

  5. 5Security advisories

    Pillow 13.0.0 fixes heap overflow in its bundled OpenJPEG

    Every Pillow wheel from 11.1.0 to 12.3.0 ships its own copy of libopenjp2 with an out-of-bounds write reachable by simply opening an image. Patching the operating system does not help.

  6. 6Security advisories

    MongoDB C# driver 3.13.0 fixes 11 CVEs, some with public exploits

    The flaws range from NoSQL injection to silent loss of client-side encryption and shared connections across client certificates. Several fixes change driver behaviour, so test before upgrading.

  7. 7Security advisories

    Python security releases ship new pip to drop emSign trust

    Python 3.15.1, 3.14.9 and 3.13.17 bundle pip 26.2.2 with certifi 2026.10.19. Upgrading Python alone leaves existing virtual environments on the old pip and the old certificate bundle.

  8. 8Security advisories

    Pleasanter fixes LDAP login bypass CVE-2026-113438 in 1.5.9.1

    Anyone who knows a valid login ID can sign in without the password on Linux or Docker installs, and Windows with the Novell provider, against Active Directory or an LDAP server allowing anonymous bind.

  9. 9Security advisories

    PHP advises disabling session upload progress over CVE-2026-115560

    A third, unlikely remote code execution path follows this week's critical PHP fixes. The mitigation, session.upload_progress.enabled=0, was already in the CVE-2026-109619 advisory; no fixed release yet.

  10. 10Security advisories

    CERT Polska lists 11 CGM CLININET flaws, several still unfixed

    Patient documents could be listed and downloaded without logging in, and four paths lead to root on the hospital system server. Version 2026.MS3 fixes six of the eleven; the rest remain open.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy