A forged `cifs.spnego` request should die in the kernel, but on affected builds it reaches root-owned helper code instead. The ugly bit is `cifs.upcall`, where CIFS authentication key descriptions can cross a namespace boundary and hand attacker-controlled data to NSS while privileges are still live.
Flux v2 9 0: CLI plugin system, UX and build fixes, Kustomize SOPS Age and drift rules, Helm post render, Git signing, Workload Identity, automation fixes
Tempo v3 0 2: Security build updated to Go 1 26 3, includes upstream fixes issue 7423, adopt v3 0 2 for security fixes, contribution by ie pham
PAN-OS GlobalProtect authentication bypass is not a clever trick, it is a trust error with a neat finish. I prefer the boring fix, disable auth override cookies, then check the portal and gateway properly, because convenience is a poor trade when the device is already being eyed up.
Grafana v13 0 3: Alpine Docker base bumped to 3 24 1, folder metadata saved on create and move, provisioning and PR link fixes, datasource API and migration fixes
SOPS v3.13.2: install, verify via Cosign and SHA256, container images for amd64 arm64 with signatures, SLSA provenance and SBOMs, fixes and deps updates
Traefik v3 7 6: migration note, stability and bug fixes for Kubernetes, Gateway API, middleware, headers, TLS, WebSocket, dependency and docs updates
Flux v2 9 0: CLI plugins and UX, Kustomize drift control, SOPS Age, Helm post render, literal values, signing, repo auth, automation, receivers
Tempo v3 0 2: Security build bump to Go 1 26 3, no functional changes, update dev and CI toolchains, follow rolling upgrade, verify builds, issue 7423
Grafana v13 0 3: Alpine 3 24 1, write folder metadata on create or move, provisioning PR fixes for multi org, datasource UID validation and migration fix
SOPS v3 13 2: install and verify binaries, cosign image and slsa provenance checks, key bug fixes, SBOMs and CI dependency updates
Traefik v3 7 6: upgrade guidance, k8s and Gateway API fixes, middleware and auth fixes, server TLS websocket header improvements, dependency security and docs updates
n8n 2 28 3, 2026 06 29: fixes startup when partial community package installs interrupt, ensures reliable start, Stage Review PR 33188, cubic dev review noted
Zero Trust Network Access looks tidy until you test the policy against a failed identity provider, a stale token, or a changing location. I have seen too many setups where conditional access does all the work, while the network quietly keeps the old trust assumptions alive.
ZTNA access policies only work when I treat the service, not the subnet, as the thing being protected. Once you start drawing the boundary around the app, rather than the VLAN, the gaps show up quickly, and they are usually where I least wanted them.
Telegraf v1 39 1: bug fixes for OPC UA, smartctl, tail, temp, vsphere, parser, dependency bumps, new migrations, multi platform packages with checksums
Telegraf v1 39 1: bugfixes and plugin fixes, automated configuration migrations, dependency and compatibility updates, multi platform packages and checksums
NocoDB 2026 06 2: Oracle DB add on, UI and views upgrades, security hardening, self host Helm and performance improvements, safer auth and exports
n8n 2 27 5: fixes startup failures from partially installed community packages, hardens package loading, boosts resilience, upgrade if you see startup errors
ESPHome 2026 6 3: deps bumped, ESP32 ESP IDF tooling and secure boot fixes, Wi Fi and ESP NOW stability, MIPI SPI display fixes, storage and integration tweaks
AWS Cognito writes the user record before most people notice the decision point has gone, so I keep the real check in AWS Cognito PreSignUp_ExternalProvider. Anything later is tidying up after the fact, and by then the account may already exist.
Android Biometric AuthToken handling is one of those details that looks tidy until you trace what actually trusts it. I pay closest attention to the hand-off points, because that is where a neat biometric check can quietly turn into an open door.
WrappedADS wrapTo() mint path is not hiding much, and that is the point. If the caller is trusted, the mint goes through; if that trust is wrong, supply moves just as easily.
The ugly part of an Ethereum bridge dispatcher is not the proof itself, it is the gap between a tidy verification trace and the bytes that finally reach custody logic. If those two ever diverge, the bridge has stopped proving anything useful.
k3s v1 36 2 k3s1: Kubernetes v1 36 2 upgrade, containerd and runtime fixes, security and component bumps, backports and Go 1 26 4 toolchain
