PHP published an informational advisory on 23 October 2026 (10:12 UTC, 6:12 pm Perth) suggesting that users set session.upload_progress.enabled=0 until the next regular bugfix release, 'to fully protect from an unlikely RCE vector', tracked as CVE-2026-115560. PHP says the issue can only occur under an unusual combination of configuration and application code: an application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(), and session upload progress must also still be enabled. PHP says applications that never change the serialize handler at runtime can keep the feature enabled. PHP says the same setting was already listed as a mitigation in its GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on 21 October, and that anyone who applied it then should keep it in place and needs to take no further action. Because the setup is unlikely in practice, PHP says it is handling the issue in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release. According to The Hacker News (23 Oct), the new issue is separate from, and not fixed by, the 21 October releases (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) that fixed the critical PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619; PHP has not stated which versions are affected, which releases will contain the fix, or a severity score; and no exploitation of CVE-2026-115560 has been reported. Primary: PHP.net; wire: The Hacker News. Updated 24 Oct 2026: the CVE number has no published record on cve.org yet, so the card no longer links to one; PHP's own advisory is the primary source. (source: PHP.net) UPDATE (25 Oct 2026): Palo Alto Networks added an FAQ to its PHP advisory on 25 October saying its current analysis shows no impact of CVE-2026-115560 on PAN-OS (NGFW and Panorama), because the issue relates to an uncommon configuration that PAN-OS does not use, and that a review of impact to its other products is underway. (source: Palo Alto Networks advisory CVE-2026-109618)
PHP.net — Informational advisory: Session upload progress (23 Oct 2026)
Eye Security's research team said on 22 October 2026 that between November 2025 and March 2026 it actively disabled the vulnerable update mechanism in Time4Popcorn, a fork of the Popcorn Time BitTorrent streaming client, by executing code on systems running it. The flaw is CVE-2026-30612, which the CVE record describes as allowing a remote attacker to execute arbitrary code through updater.exe on Windows and PT.updd on macOS in Time4Popcorn for Windows up to 6.2.1.18, for macOS up to 6.2.1.17 and for Android up to 3.5.0.173; CISA's ADP enrichment scores it CVSS 3.1 9.8. Eye Security says it found an Updater.exe at a client trying to reach the lapsed domain popcorntimeupd.xyz. After registering it, Eye found the updater would download and run any executable named in a JSON reply with NT AUTHORITY\SYSTEM privileges, with no code signing and over unencrypted HTTP; on macOS a pushed update ran as root. It estimates it encountered about 2.5 to 3.0 million Windows hosts and 250,000 to 350,000 macOS hosts, connecting mostly from home ISPs but also from government, military and corporate networks around the world. Eye says its update only stopped and disabled the updater service, with no telemetry or file deletion, and that it had to adjust the code to get past endpoint products that flagged it. It says more than a million systems were updated by December 2025, it sent over 2 million update downloads in total, and update requests had fallen 98% by 1 March 2026. In late March it handed the 15 domains it controlled to The Shadowserver Foundation; some other update domains are still owned by third parties. Eye did not touch Android, where updates need user interaction, and says the application itself remains unsafe: it is built on a 2014 Chrome engine with the sandbox disabled, loads content over plain HTTP and loaded JavaScript from abandoned domains, and Eye has a proof of concept that runs calc.exe through JavaScript. Primary: Eye Security. Updated 23 Oct 2026: BleepingComputer reported the research. (source: BleepingComputer)
Eye Security — Operation IXIM: Preventing a botnet of millions of Popcorn Time users (22 Oct 2026)
HPE's security bulletin HPESBNW05162 rev.1, released 22 October 2026, lists 72 CVEs in the HPE Networking Wireless Operating Systems AOS-8 and AOS-10 for Mobility Conductors, Controllers, Gateways and Access Points. HPE rates eight of them 10.0 under CVSS 3.1: CVE-2026-79844 and CVE-2026-79850 (authentication bypass leading to remote code execution in AOS-10 and AOS-8), CVE-2026-79845 (authentication bypass in the PAPI protocol of AOS-10 allowing unauthorised access and modification of sensitive data), CVE-2026-79846 (unauthenticated command injection in AOS-8), CVE-2026-79848 and CVE-2026-79849 (unauthenticated SQL injection allowing remote code execution in AOS-8), and CVE-2026-79847 and CVE-2026-79851 (unauthenticated buffer overflows leading to remote code execution in AOS-10). A further 25 are rated between 9.0 and 9.8, among them unauthenticated command and SQL injection in the PAPI protocol and an authentication bypass in the AOS-8 SSH daemon. HPE lists affected versions as AOS-10.8.x.x: 10.8.1.1 and below, AOS-10.7.x.x: 10.7.2.6 and below, AOS-10.4.x.x: 10.4.1.13 and below, AOS-8.13.x.x: 8.13.3.0 and below and AOS-8.10.x.x: 8.10.0.23 and below. It recommends upgrading to AOS-10.8.x.x: 10.8.1.2 and above, AOS-10.7.x.x: 10.7.2.7 and above, AOS-10.4.x.x: 10.4.1.14 and above, AOS-8.13.x.x: 8.13.3.1 and above or AOS-8.10.x.x: 8.10.0.24 and above. HPE says versions that have reached End of Maintenance are presumed to be affected and are not covered by the advisory. HPE says the vulnerabilities were generally discovered by its internal security research and that it 'is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory'. It adds: 'Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities.' Until patches are applied, HPE recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or controlling them with firewall policies at layer 3 and above. HPE published CVE records citing the bulletin on 22 October (UTC), and CISA's ADP enrichment on the seven 10.0-rated HPE records lists exploitation as none. When checked on 23 October, the CVE list entry for CVE-2026-79845 was an unrelated record assigned by VulDB, not an HPE record. Primary: HPE security bulletin; vendor: HPE CVE records. Updated 23 Oct 2026: BleepingComputer reported the bulletin, noting that ArubaOS powers Aruba Networking enterprise wireless infrastructure. (source: BleepingComputer)
HPE — HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8) (22 Oct 2026)
Security firm V12 said on 22 October 2026 that it found 25 vulnerabilities in the x402 codebase, the open standard that lets software such as AI agents pay for an API call inside an ordinary HTTP exchange (a server answers 402 Payment Required, the client signs a payment and retries). V12 described three it rated critical. First, the documented default client setup enforced no per-payment limit or total budget, so, according to V12, a hostile API could turn a routine request into a request for the wallet's full balance of a compatible token, and with an automatic signer and no application-supplied policy the client could sign it. Second, the TypeScript Solana facilitators did not check the instruction type, so a token approval, which moves no tokens, was accepted as a payment in V12's local test; V12 called it "a complete payment bypass" and says the test did not submit a live transaction. Third, the Sign-In-With-X client signed login messages without checking that the website named in them was the one it had contacted, which V12 says could let a malicious server log in to another site as the agent's wallet. V12 says it reported the 3 critical and 13 high-severity findings to the x402 team on 12 August 2026 and that the 3 critical flaws were fixed by 20 August. The x402 Foundation's TypeScript changelogs for 2.23.0 list the matching changes: client spendControls that by default allow only recognised pegged assets with a $1 USD cap, a required origin check before signing Sign-In-With-X messages, and a validation guard for TransferChecked in the Solana package. Primary: V12; vendor: x402 Foundation changelog. Updated 23 Oct 2026: according to The Hacker News, neither V12 nor the x402 Foundation has publicly reported attacks using the flaws, the foundation has published no security advisory for them, and npm audit and PyPI listed no advisories for the last releases before the fixes as of 23 October. (source: The Hacker News)
V12 — 25 Vulnerabilities in the x402 Protocol: Inside Three Critical Findings (22 Oct 2026)
Trend Micro's Zero Day Initiative (ZDI) lists two Linux vulnerabilities, ZDI-CAN-33549 and ZDI-CAN-33774, each rated CVSS 9.0 and reported to the vendor on 21 October 2026. According to The Hacker News (22 Oct), both are remote code execution flaws in KSMBD, the Linux kernel's built-in SMB server, and were sent to public mailing lists without patches. The Hacker News says ZDI-CAN-33774 needs no authentication and exposes any server running KSMBD on port 445: a race in how KSMBD assigns its handler table lets a burst of short SMB1 packets followed by an SMB2 packet make workers read past the end of a buffer, with a path to writing past it once an attacker has access to a share. It says ZDI-CAN-33549 is an integer underflow in KSMBD's SMB Direct path that needs an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share and a client negotiating SMB Direct. According to The Hacker News, as of Thursday 22 October neither flaw had a named fix in the mainline kernel or linux-next, and neither has a CVE, since the kernel assigns CVEs only after a stable-tree fix. Phoronix (22 Oct) says a patch for ZDI-CAN-33549 sits in a Git branch intended for Linux 7.5, and that the reports appear to have been sent to the public list by mistake. The Hacker News says Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's documentation. No exploitation has been reported. Sources: ZDI upcoming advisories; The Hacker News (22 Oct); Phoronix (22 Oct).
Zero Day Initiative — Upcoming advisories (ZDI-CAN-33549 and ZDI-CAN-33774, Linux, CVSS 9.0, reported 21 Oct 2026)
Arista Security Advisory 0199 (22 October 2026) documents CVE-2026-114625, an SQL injection flaw (CWE-89) in on-premises VeloCloud Orchestrator (VCO), the management portal for VeloCloud SD-WAN. Arista says any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user, reaching functionality meant for internal use only, and that successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. An attack needs network access to the VCO web interface and a valid authenticated session; the minimum role is Enterprise Read Only, the lowest built-in tenant role, and Arista says no configuration prevents the exposure. Arista says the issue was detected by Arista and is known to be actively exploited, and that Hosted (including Dedicated) VCO was impacted and has already been patched. Arista rates it CVSS 3.1 9.9 and CVSS 4.0 9.4. Affected on-prem releases: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12; end-of-support versions were not assessed. Arista lists two IP addresses seen conducting the attacks (74.82.197.86 and 38.54.50.151) and advises blocking them and checking logs for them. VeloCloud Gateway, VeloCloud Edge and Arista EOS-based products are listed as not affected. This is a separate flaw from the actively exploited VCO bug CVE-2026-93952 that Arista disclosed in September (see this desk's card). BleepingComputer reported the advisory on 22 October. Source: Arista Security Advisory 0199 (22 Oct 2026); wire: BleepingComputer (22 Oct). UPDATE (24 Oct 2026): CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on 23 October 2026 (catalog version 2026.10.23), with a remediation due date of 26 October 2026 for US federal civilian agencies and forensic triage required. (source: CISA KEV)
ISC published four BIND 9 security advisories on 21 October 2026, all rated High and remotely exploitable, after early notification to its support customers on 14 October. CVE-2026-94300 (CVSS 8.1, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): according to ISC, replaying GSS-TSIG-signed UDP messages can corrupt memory in named; an attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid, and by also sending crafted queries to a zone the attacker controls may potentially achieve remote code execution. ISC says it found the flaw in internal testing and thanks Dave Aitel of OpenAI, who independently found and reported it. CVE-2026-19630 (CVSS 7.5): ISC says inbound DNS messages with a particular structure trigger extra processing with no limit in a BIND resolver, so a message with a maliciously large number of them can exhaust CPU and memory. CVE-2026-96888 (CVSS 7.5): a resolver configured with both a 'redirect' zone and 'qname-minimization strict' may abort with an assertion failure. CVE-2026-97313 (CVSS 7.5): a recursive server with at least two RPZ zones, one with the default 'recursive-only yes' and one with 'recursive-only no', may exit with an assertion failure when a recursion-desired query is followed by a non-recursive one; ISC credits Vitaly Simonovich for the last two. ISC lists affected versions as 9.11.0 to 9.18.50 (9.16.0 onwards for CVE-2026-96888 and CVE-2026-97313), 9.20.0 to 9.20.29 and 9.21.0 to 9.21.26, plus the Supported Preview Edition from 9.11.3-S1; fixes are 9.20.30, 9.21.27 and 9.20.30-S1. ISC says there are no workarounds and it is not aware of active exploits. ISC's download page lists 9.18.50 as end of life and 9.20.30 as the current stable extended-support release, and no 9.18 fix is listed. Source: ISC advisories CVE-2026-94300, CVE-2026-19630, CVE-2026-96888 and CVE-2026-97313 (21 Oct 2026).
Cisco published a critical advisory (cisco-sa-vcs-static-cred-hr7EWZ8t) on 21 October 2026 at 16:00 GMT (22 Oct 00:00 Perth) for CVE-2026-76466 in the database service feature of Cisco Expressway Series. According to Cisco, an unauthenticated, remote attacker with network access to an Expressway device could run arbitrary operating system commands as root. Cisco says the flaw is due to the use of persistent cookies, and that client certificates are not validated when TLS Verify Mode is set to Enabled for clustering; an attacker who has the cookies could connect to the database service and invoke specific remote procedure call (RPC) commands. Cisco rates it CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-798 (use of hard-coded credentials), bug CSCww27732. It affects Expressway-C and Expressway-E, virtual and appliance, only when the devices are configured in a cluster. Cisco lists X15.5.20 as the first fixed release for X15.5.3 and earlier, says X14 and earlier must migrate to a fixed release, and says there are no workarounds; the fix is also part of the 'Cisco Expressway Series Security Hardening Release: October 2026'. Cisco's PSIRT says it is not aware of any public announcements or malicious use. Cisco credits Stefan Aleksic of Jane Street. The advisory is part of Cisco's 21 October 2026 bundled publication. Source: Cisco security advisory cisco-sa-vcs-static-cred-hr7EWZ8t (21 Oct 2026).
Cisco — Cisco Expressway Series Remote Code Execution Vulnerability (cisco-sa-vcs-static-cred-hr7EWZ8t, 21 Oct 2026)
The Apache Traffic Server project announced on 21 October 2026 (02:07 UTC, 10:07 Perth, on its announce list, posted by Masakazu Kitajo) that 15 vulnerabilities are fixed in versions 9.2.16, 10.1.5 and 10.2.1. According to the announcement, affected versions are 9.0.0 to 9.2.15, 10.0.0 to 10.1.4 and 10.2.0 (some flaws affect only 10.x). The two rated critical are in experimental plugins: CVE-2026-111813 (CVSS 3.1 10.0) lets an unauthenticated client control ImageMagick convert arguments through the magick plugin in its default unsigned configuration, and CVE-2026-111804 (CVSS 3.1 8.2, 10.x only) is a use-after-free in the wasm plugin. Others, as described by the project: request smuggling where an origin connection still owed a request body is reused (CVE-2025-31699, 8.9) or an unread Expect: 100-continue body is parsed as a new request (CVE-2025-55702, 8.7); a malformed chunked 302 response being cached and served, allowing cache poisoning (CVE-2026-111816); HEAD-response smuggling (CVE-2026-111809); HTTP/2 worker-pool exhaustion (CVE-2026-111805 and CVE-2026-111808); session sharing that confuses mutual-TLS identities (CVE-2026-111814) and TLS session-ticket resumption bypassing per-SNI verify_client STRICT enforcement (CVE-2026-111815); unauthenticated cache access through the tsmemcache plugin (CVE-2026-111811); the origin_server_auth plugin signing client-controlled AWS headers with the proxy's IAM credentials (CVE-2026-111812); log flooding (CVE-2026-111810); a stalled passthrough transfer when chunked trailers are dropped (CVE-2026-111817); and a null-pointer dereference on a POST half-close with a chunked response (CVE-2026-112381). The announcement says 9.x users should upgrade to 9.2.16, 10.1.x to 10.1.5 and 10.2.x to 10.2.1 or later. The CVE record for CVE-2026-111811 also lists 8.0.0 to 8.1.11 as affected. No exploitation has been reported. Source: Apache Traffic Server security announcement (21 Oct 2026); CVE records.
Apache Traffic Server — [SECURITY] Multiple vulnerabilities fixed in Apache Traffic Server 9.2.16, 10.1.5 and 10.2.1 (announce list, 21 Oct 2026)
Splunk published security advisories on 21 October 2026, following an advance notice on 14 October, for Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 and 9.4.16 and Splunk SOAR 8.7.0. SVD-2026-1008 (Critical, highest CVSS 3.1 score 9.9) covers internally identified vulnerabilities in Splunk Enterprise 10.4.0 to 10.4.3, 10.2.0 to 10.2.7, 10.0.0 to 10.0.10 and 9.4.0 to 9.4.15, grouped by weakness class with one CVE per group: CVE-2026-76299 (improper access control, 9.9), CVE-2026-76300 (8.8), CVE-2026-76301 (7.6) and CVE-2026-76302 (improper neutralization, 9.9); each group's score is the highest among its findings, and Splunk gives no further detail. SVD-2026-1007 (High, highest 8.8) lists 12 CVEs. Splunk says that in CVE-2026-76298 (8.8) the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier, which appears in search job logs, so a user without the admin or power roles could derive the sidecar's superuser password and run operating-system commands as the Splunk Enterprise account on search head cluster members (versions below 10.4.4 and 10.2.8). CVE-2026-76291 (8.8) lets a user with the schedule_search capability bypass the SPL safeguards for risky commands, because the scheduler does not apply them to scheduled searches, and CVE-2026-76293 (7.2) lets a user with the edit_manager_xml capability run operating-system commands through Splunk Web Manager XML; the list also includes unauthenticated denial-of-service flaws in Splunk Web (CVE-2026-76288) and the Edge Processor package download endpoint (CVE-2026-76290), and two Splunk Secure Gateway issues (CVE-2026-76292, CVE-2026-76295). SVD-2026-1009 updates third-party packages in Splunk Enterprise. For Splunk SOAR, SVD-2026-1011 (Critical, highest 9.9) and SVD-2026-1010 (High) fix issues in versions below 8.7.0. Splunk's advisories do not report exploitation. This is a separate release from Splunk's 7 October advisories (Splunk Enterprise 10.4.3/10.2.7/10.0.10/9.4.15, CVE-2026-76268), which have their own card.
Splunk — SVD-2026-1008: Security Hardening in Splunk Enterprise, October 2026 (21 Oct 2026)
Oracle published Security Alert CVE-2026-91403 (Rev 1) on 21 October 2026 for a vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. Oracle says the flaw is remotely exploitable without authentication over multiple protocols and scores it CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); Oracle's CVE record says successful attacks can result in unauthorised creation, deletion or modification of critical data or all data accessible to these products, as well as unauthorised access to critical data or complete access to all accessible data. The supported versions Oracle lists as affected are Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, Oracle GraalVM for JDK 17.0.21 and 21.0.13, and Oracle GraalVM Enterprise Edition 21.3.20. Oracle says the flaw can be exploited through APIs in the component, for example through a web service that supplies data to them, and also applies to sandboxed Java Web Start applications or applets that load and run untrusted code. Oracle's alert credits no reporter and points to its Java SE Patch Availability Document for patches; the alert page does not list fixed build numbers or say whether the flaw has been exploited. Correction (25 Oct 2026): Oracle's alert page, as read on 25 October (still Rev 1 of 21 October), says the Security Alert addresses CVE-2026-91403 by providing Java updates that distrust the set of impacted intermediate CA certificates related to eMudhra, and tells customers to update to the latest Java version or apply the recommended mitigations. This card earlier said the alert did not describe the bug; that was wrong and has been removed. (source: Oracle Security Alert Advisory - CVE-2026-91403) UPDATE (25 Oct 2026): Oracle published a second Security Alert, CVE-2026-114820 (Rev 1, 24 October), which it says provides Java updates that remove the set of impacted root CA certificates related to eMudhra. Oracle again places the issue in the JSSE component, scores it CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and lists as affected Oracle Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2, Oracle GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2, and Oracle GraalVM Enterprise Edition 21.3.20.0.2. Oracle says to update to the latest Java version or apply the recommended mitigations; the alert does not list fixed build numbers. (source: Oracle Security Alert Advisory - CVE-2026-114820)
GitLab said it released GitLab Community Edition and Enterprise Edition 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on 21 October 2026 and strongly recommends that all self-managed installations upgrade immediately. GitLab says the critical flaw, CVE-2026-110264, could under certain conditions have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to an integer overflow when compiling a specially crafted regular expression; it rates it CVSS 3.1 10.0 and lists all CE/EE versions from 7.0 as affected up to the fixed releases. GitLab says it backported the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 in addition to its standard patch releases, that GitLab.com is already running the patched version, and that GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes. GitLab has released two threat detections for self-managed customers, 'Onigmo native worker crash' and 'Org mode render error burst'. Researcher joaxcar reported the flaw through GitLab's HackerOne bug bounty programme. GitLab's release also fixes 11 further security issues rated high, medium or low, including an account takeover flaw when OmniAuth SAML and LDAP auto-linking are both enabled (CVE-2026-15723, CVSS 8.2) and an OAuth/OIDC discovery cache-poisoning flaw (CVE-2026-112212, CVSS 7.5). GitLab says the patch includes database migrations, so single-node instances will have downtime during the upgrade, while multi-node instances can apply it without downtime using zero-downtime upgrade procedures. According to The Hacker News, GitLab's 12 October fix for the earlier regex-compiler flaw CVE-2026-97229 covered only 19.2 and later, so an instance updated then is in range again, and GitLab's advisory offers no interim workaround. Primary: GitLab Critical Patch Release 19.5.1 (21 Oct); wire: The Hacker News (21 Oct). UPDATE (24 Oct 2026): Ruby said on 23 October (03:11 UTC) that it has released Ruby 4.0.9, 3.4.12 and 3.3.13, which fix the bugs in Ruby's regular expression engine (Onigmo) behind GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Ruby says the fix for the bug behind CVE-2026-110264 (overflow of internal IDs in a pattern with many repeats) first ships in 4.0.9, so Ruby 4.0.8 does not contain it, while 3.4.12 and 3.3.13 contain all the fixes. Ruby says an application is affected only if it compiles a regular expression from a string an attacker controls, for example by passing it to Regexp.new, Regexp.union or Regexp.compile or interpolating it into a regexp literal such as /#{input}/; applications that only use regular expressions written by their own developers are not affected. Ruby says Regexp.timeout does not protect against these bugs and that limiting pattern length is not reliable because some can be triggered by short patterns. Ruby has not requested CVE identifiers of its own 'at least for now' and asks users to track the issues by GitLab's CVE numbers, for example in a security scanner. (source: Ruby)
