tl;dr: Temporary 24-hour cooldown period for plugin/theme releases before auto-updates. AI can give defenders an edge. We want to secure all 78K plugins and themes on WordPress.org.  One of the things we’ve always striven to do as the…
It was discovered that YARD incorrectly sanitized paths in its built-in documentation server. An attacker could possibly use this issue to read arbitrary files from the server host.
https://security-tracker.debian.org/tracker/DSA-6322-1
It was discovered that the Inetutils telnet daemon incorrectly handled the CREDENTIALS_DIRECTORY environment variable. An attacker could possibly use this issue to escalate privileges. (CVE-2026-28372) It was discovered that the Inetutils…
Improved permission and domain-ownership validation Improve permission and domain-ownership validation for Sitejet actions. For a full list of changes, read the Sitejet Builder change log.