The curl project released version 8.23.0 on October 14, 2026, fixing an HTTP/2 upload flaw. curl says the flaw can allow remote code execution under specific conditions. Tracked as CVE-2026-92392 and rated High by curl, it affects libcurl and the command-line tool. Certain server-sent stream reset messages during an upload can cause curl to use a freed object. Maintainer Daniel Stenberg said successful exploitation in the wild would be extremely difficult and a crash more likely. The release includes 24 security fixes, according to Stenberg’s release announcement. Sources: Daniel Stenberg, curl
SecuritySource: Daniel Stenberg
curl fixes HTTP/2 upload use-after-free flaw in 8.23.0
Why it matters
Developers should check the libcurl versions their applications load, including bundled copies and container images. Prioritize affected applications uploading over HTTP/2 to potentially attacker-controlled endpoints. Upgrade to 8.23.0. [2] Exploitation in the wild has not been established.
Attribution
Sources
- 1Daniel Stenberg14 | October | 2026Source published (UTC)
- 2curlHTTP/2 upload Use-After-Free - CVE-2026-92392Source published (UTC)
- 3Daniel StenbergA UAF turned RCESource published (UTC)
- 4opengeekcurl 8.23.0: 24 falle corrette, una grave su HTTP/2Source published (UTC)
Read the original source for full details and context.
Article · Backend
Patch Drupal Field UI and verify the fix on every deployment
Drupal’s October 14, 2026 advisory identifies fixes for CVE-2026-108097, a Field UI vulnerability rated Critical 19/25. This guide covers module inventory, temporary mitigation, update planning and evidence to collect during patch verification.
Cloud
GitHub previews dependency lockfiles for Actions workflows
GitHub Actions workflow dependency lockfiles are in public preview for Free, Team, Enterprise Cloud, and Enterprise Cloud with data residency. According to GitHub, the gh actions-lock extension generates .github/workflows/actions.lock to pin action dependencies to exact commits. These dependencies include transitive actions and reusable workflow references. Teams can adopt locking one workflow at a time. Dependencies inside a reusable workflow use the lockfile in the repository that defines that workflow.
Security
Adobe patches 11 Commerce vulnerabilities, including four unauthenticated critical flaws
Adobe released security bulletin APSB26-153 on October 13, 2026, patching 11 Adobe Commerce vulnerabilities. Four critical flaws require no authentication. Adobe lists five critical, five high and one medium issue. SecurityWeek also reported 11 vulnerabilities. According to Adobe, two unauthenticated critical flaws allow code execution without user interaction. Two others allow privilege escalation through stored cross-site scripting and require user interaction. Adobe said it knew of no exploitation of these issues.