Microsoft AI scanner finds long-lived Rust standard library bugs
Two issues affect stable Rust, including a possible freed-memory access; Microsoft calls practical exploitation unlikely.
Stories per day · 30 days
4 RSS
Relatedrust5fuzzing2microsoft2out-of-bounds-read2php2php2shell2standard-library2use-after-free2appsec1arxiv1bright-security1browser1chrome1cloudbleed1cloudflare1code-generation1coding-agents1compartment-isolation1
37 stories, newest first · one card per story
Stories tagged #memory-safety
Coding agents copy existing vulnerabilities into new code
Insecure neighbors cut secure backend implementations 3.4% and widen the C/C++ context gap to 35.4%.
KVGuard detects KV cache safety bugs in LLM serving
KVGuard covers all 29 historical bugs from vLLM and SGLang plus 8 new ones with 3% overhead.
DualGuard unifies memory safety for normal and speculative execution
The LLVM framework reports 3% to 72% less overhead than naive combinations of separate memory-safety and speculative defenses.
PHP2Shell patches are out; exploit attempts seen, no confirmed hits
Memory-safety flaws in PHP back to about 5.4 can yield remote code execution, and some sites cannot patch in place.
Bright Security launches STAR Fuzzer for agentic application fuzzing
Bright says an open-source run found High or Critical issues in 45% of projects tested, with ten findings in eight projects.
Paper gives probabilistic semantics for Rowhammer-style bit flips
A collapse theorem says physical separation makes protected executions match the fault-free run for every finite prefix.
Blog says Cloudflare is rewriting its proxy layer in Rust
The author ties the shift to 2017 Cloudbleed and says a November 18, 2025 outage came from unwrap on bad config.
1
Wiz details PHP2Shell RCEs in core PHP back to 5.4
Unauthenticated attackers can run code or read worker memory that may hold passwords, tokens and keys; PHP patched on October 21, 2026.
Chrome 156 patches 353 flaws, mostly memory-safety bugs
Six critical issues are included; Google does not say any are exploited, and stable builds are 156.0.8078.47/.48.
Imager::File::GIF before 1.006 allows out-of-bounds GIF reads
Stig Palmquist reported the Perl module issue to oss-security on October 20.
Blame-aware recomposition extends secure compilation proofs to low-level isolation
The technique allows compartments to observe each other's code and is applied to a tag-based reference monitor.
Evaluating and Improving Static Application Security Testing Tools for Rust
Researchers evaluate Rust SAST tools and use LLM framework TRUST to uncover 46 faults.
DPDK security advisory: Multiple vulnerabilities in vhost/vhost-crypto/vDPA/GSO libraries
DPDK patched guest-triggerable memory-safety flaws in vhost, vhost-crypto, vDPA, and GSO.
Building Sound Evaluation Practices for Rust-Based Security Frameworks
Researchers propose a reproducible way to evaluate Rust fuzzers and test it on 20 projects.
Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup
Unpatched Godot 4.x heap out-of-bounds read affects OptimizedTranslation parsing of untrusted files.
Re: libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675
libpng 1.6.59 fixes use-after-free CVE-2026-46675; its release tarball is now available.
Valen's Memory Safety: A New Kind of Borrow Checking
Valen's group-borrowing checker aims to stop use-after-free with fewer restrictions than Rust-style borrow checking.
4
CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument
Perl ExtUtils::Typemaps::STL::String before 1.06 may read an SV length before stringifying arguments.
Google Chrome Update Fixes Massive 247 Vulnerabilities, Including 4 Code Execution Flaws
Google patched 247 Chrome flaws, including four critical use-after-free bugs, in version 155.0.8059.39.
CVE-2026-80490: Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified
CVE-2026-80490 in Perl's Algorithm::AhoCorasick::XS through 0.04 reads haystack length before scalar stringification, causing incorrect search behavior.
Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug
Google Chrome 154 patches 32 flaws including critical ANGLE buffer overflow CVE-2026-102331 and multiple V8 type-confusion bugs; no active exploitation reported.
CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction
GNU Inetutils CVE-2026-95510 uses an uninitialized sigaction in rlogin, rlogind, and telnetd, risking crashes.
USN-8824-1: libpcap vulnerability
Ubuntu's USN-8824-1 says libpcap may allow out-of-bounds operations via weak BPF checks.