sep 4, 2026
10 links from the engineering internet.
bun 1.4.1 serves http/2 and http/1.1 on the same port
bun.serve now speaks http/2 alongside http/1.1 on one port, sharing the same routes and fetch handler. javascriptcore also drops jit-generated code after a long idle, and the release closes 202 issues.
workerd v1.20260904.1 adds experimental subscribe support for workflows
the daily workers runtime cut adds experimental workflow subscribe, makes javascript generators visitable to the garbage collector, and moves memory-cache onto real atomic operations. wasm memory.discard and cppgc eager sweeping were both reverted for stability.
traefik digestauth hands unknown usernames an empty secret
cve-2026-85595, cvss 9.3: the digestauth middleware returns an empty secret for a username it does not know instead of rejecting the request, so an attacker can compute a valid digest response from arbitrary credentials and authenticate.
traefik tls option clash drops ingress-nginx client cert checks
cve-2026-85596, cvss 8.2: when two ingress objects share a host and a client ca secret, traefik's tls option naming collides and it falls back to default tls with no client certificate required, ignoring auth-tls-verify-client. patched in v3.7.11.
grav form plugin picks its recaptcha version from the field name
cve-2026-85602, cvss 9.3: the plugin decides between recaptcha v2 and v3 purely from which response field key is present, so submitting a v3 token under the v2 field name skips score thresholds and action verification. fixed in 9.1.20.
grav's twig sort filter runs unsandboxed and reaches spl_autoload
cve-2026-85604, cvss 8.7: grav's sortfunc wrapper hardcodes twig's issandboxed argument to false, so anyone with page-write permission can craft a sort filter payload that invokes spl_autoload and executes arbitrary php. fixed in 2.0.19.
openpanel's site-checker fetches any url it is handed
cve-2026-85614, cvss 9.2: get /tools/site-checker accepts a fully client-controlled url with no private ip filtering and no dns-rebinding protection, so an unauthenticated caller can reach internal services and cloud metadata endpoints.
snipe-it bulk delete accepts user ids outside your scope
cve-2026-85617, cvss 8.7: a low-privilege user can include unauthorized user ids in a bulk delete request and soft-delete accounts past their instance-level restrictions. fixed in 8.6.3.
phpmyfaq turns off totp without a password or a current code
cve-2026-85590, cvss 7.1: disabling two-factor auth checks only that the session is logged in and the csrf token is valid, so a hijacked session can strip totp from any account, admins included. fixed in 4.1.8.
llama.cpp b10795 fuses rms_norm chains on the sycl backend
the sycl backend now fuses rms_norm+mul+add and add+add residual chains behind ggml_sycl_enable_fusion, cutting kernel launches per token on intel gpus.