security

Angular router SSR: upgrade for RouterLink queryParams DoS (1 Oct 2026)

On 1 Oct 2026 Angular published GHSA-57xq-rjx2-v5xh: High DoS in @angular/router when SSR + RouterLink queryParamsHandling merge/preserve retain UrlTree query maps in heap. Patched in 21.2.25 and 22.2.1. Client-only SPAs unaffected. ShopperCove upgrade checklist only—no exploit payloads; no affiliate.

What Does Next.js 16.3.8 Fix? 7 Security Bugs

Next.js 16.3.8 (30 Sep 2026) covers image SSRF and cache bugs. CVE-2026-94545, the next/og RCE, was patched in 16.3.6 and is not a 16.3.8 fix.

ast.literal_eval vs json.loads: Localhost Lab

ipaddress vs String Prefix Allowlist: Localhost Lab

Hands-on ipaddress CIDR containment vs naive string prefix allowlists: real checks/s, measured on Linux localhost today in this hands-on lab for SREs.

XZ Utils Backdoor: A Technical Deep Dive

How a two-year-long social engineering effort inserted a backdoor into xz/liblzma's release tarballs, and how a Postgres developer's curiosity about slow SSH logins caught it.