Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. The fixes are in

#infosec #threatintel #next #critical #flaws #outofband #svg

Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.

#infosec #threatintel #drupal #flaw #contributed #core #critical

Argentina defender Lisandro Martinez follows up criticism of his club with social media explanation of frustration.

#news #world #middleeast #social #club #criticism #martinez #media

Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of

#infosec #threatintel #langflow #critical #flaw #ai #attempts

Reform says all of those people filmed by ITV are under investigation having resigned or been suspended.

#news #world #bbc #filmed #reform #comments #councillors #criticism

US immigration authorities raid home of Democratic Trump critic Ilhan Omar    Reuters

#news #reuters #world #authorities #critic #democratic #home #ilhan