One image parser sits under Slack, Discourse, Next.js and GitHub
Hacktron's HEIF Heist traces attacks on libheif and libde265 through ImageMagick, libvips and Sharp into applications that never chose to decode HEIC.
Security
Passing a hash test suite says nothing about chosen-input collisions
A study of the popular fast hashes shows attacker-selected inputs can collide far above the average rate, without the attacker ever learning the seed.
Researcher publishes the factors of RSA-896
Two 448-bit primes, published on a one-page post dated 19 September. The multiplication verifies in a second; the method is not described at all.
RFC 10008 defines QUERY, a sixth HTTP method
RFC 10008 defines QUERY - a GET with a body, safe, idempotent and cacheable. Handling in the wild already disagrees: nginx and Django reject it, Caddy, Traefik and FastAPI pass it through.
pgAdmin 9.18 fixes four CVEs, including an auth bypass
pgAdmin 4 v9.18 closes an authentication bypass and two connection-string injections that redirect the connection, and the exported password, to a host of the caller's choosing.