sep 5, 2026
10 links from the engineering internet.
workerd v1.20260905.1 exposes configured container images to durable objects
the daily workers runtime cut lets durable objects read their configured container images, adds tracing getactivespan, and tags sqlite errors with sentry_do. thread sanitizer builds now cover macos arm64 hosts alongside linux x86_64.
bun 1.4.2 pulls in two javascriptcore memory-safety fixes
the webkit bump fixes jsarray shift/splice/setlength clearing live butterfly slots through libc memset, and ic stub routine watchpoints outliving the cells their conditions key on. asynclocalstorage also stops retaining the outer store from exit().
coolify's oauth callback trusts the email address and nothing else
cve-2026-86117, cvss 9.2: the callback matches users by email without validating provider assertions or linking oauth identities, so registering a victim's address on any enabled provider logs you in as them, past passwords and mfa. affects builds through 4.3.17.
sql chat runs arbitrary queries against any host you name
cve-2026-86123, cvss 9.4: four api endpoints take database connection parameters straight from the caller with no authentication, so anyone can point the app at internal databases, enumerate schemas, and pivot through the network.
webstudio proxy routes fetch any url when resize_origin is unset
cve-2026-86119, cvss 9.2: /cgi/image, /cgi/video and /cgi/asset proxy unauthenticated requests when the resize_origin env var is missing, which reaches cloud instance metadata and internal services. affects releases through 0.296.0.
cua computer-server drops authentication when container_name is unset
cve-2026-86121, cvss 9.3: with the env var missing the server binds every interface and skips auth entirely, leaving port 8000 open to arbitrary shell commands, file writes, and interactive sessions. fixed in 0.3.42.
arcane lets any user rewrite the system-wide compose templates
cve-2026-86114, cvss 7.1: template create, edit and delete ran without authorization checks, so a standard account could plant a compose default carrying privileged containers or host path mounts for someone else to deploy. fixed in 2.0.0.
metabase glossary endpoints skip the data analyst permission check
cve-2026-86116, cvss 7.1: post, put and delete on the glossary api ran without authorization enforcement, so any authenticated user could rewrite or delete business glossary entries instance-wide. fixed in 0.63.1.
ixon vpn client crlf injection persists a root command across reboots
cve-2026-75925, cvss 9.4: unescaped carriage returns in the configuration interface let an unauthenticated attacker write directives into files a privileged process reads, executing as root or system while the vpn keeps working normally. fixed in 1.4.7.
llama.cpp b10819 plugs a metal memory leak on an early return
the build is a single fix to the metal backend, which leaked whenever it took an early-return path. the b10818 cut an hour earlier restored kronecker product fwht support and unbroke test-backend-ops on sycl.