Security Advisory – 18 Apr 2026

Security fixes and advisories that landed overnight. Updated 18 Apr 2026 00:16 GMT.

Top items

NIST

CVE-2026-40324

Hot Chocolate’s recursive descent parser has no recursion depth limit in affected versions. A crafted GraphQL document can trigger a StackOverflowException and terminate the worker process immediately.

  • Published: 18 Apr 2026 00:16 GMT
  • CVEs: CVE-2026-40324
  • Notes: Fixes add a MaxAllowedRecursionDepth option

Related posts

Prometheus | v3.15.1

Prometheus v3 15 1: container images distrust emSign ECC Root CA G3 and Comodo AAA Services root, rebuilt with Go 1 27 3, x net v0 60 0, upgrade to v3 15 1

headscale | v0.29.7

Headscale v0 29 7 security release: upgrade to v0 29 7, update Tailscale to v1 104 4 or newer, disable SSH agent and port forwarding per node until update

ionCube Loader: offline PHP bytecode decryption

ionCube Loader is not magic, just a native PHP extension with a very hard boundary. Once you trace the entrypoint and the key derivation properly, the supposed mystery turns into a pile of exacting...