
The full firehose, with digest picks marked.
Everything our pipeline collected. Use the section tabs and filters to narrow — look for the In digest badge to see which stories actually made it into the newsletter.


Remote - Rain is the world's first AI Financial Health Platform, serving 3.5 million employees at leading organizations like McDonald's, Marriott, and T-Mobile. Rain works in the background to optimiz

Remote - Established in 1744, Sotheby’s promotes access and ownership of exceptional art and luxury objects through auctions, private sales and retail. Our deep expertise across 70 selling categorie
Proposal Details Code that probes candidate directories, such as a package loader checking whether foo/bar holds a package, needs to treat "a path ele
Proposal Details Idea On Linux, support enforcing Seccomp-BPF filters between fork (2) and execve (2), when executing subprocesses through os/exec . S
I have the following test file sample test.go : go package main im
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation. Verify will now filter out chains which contain these intermediates, preve...
Proposal Details This proposal describes adding a default-on, offline server certificate revocation checking mechanism to crypto/tls using a local cac
Why are Kubernetes, Docker, Terraform, and so many infrastructure tools written in Go? The answer comes down to a ...
🥳 Go 1.27.3 and 1.26.10 are released! 🔏 Security: Includes 1 security fixes to the standard library. 📣 Announcement: https:// groups.google.com/g/golang-ann ounce/c/66pojueaQek/m/tmWX2Pq9AgAJ
👩🏽🔬 Go 1.27.3 and 1.26.10 are released! 🔐 Security: Includes 1 security fixes to the standard library. 🗣 Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2P

Stable Go release. See release notes for changes.
Hello gophers, We plan to issue a security fix for the package golang.org/x/net/html in the golang.org/x/net module during US business hours on Tuesday, October 27. This will cover the following CVEs:
Running an open-source AI model on your own hardware sounds straightforward. Load a model, send a prompt, get an answer.
TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI
Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI
Getting Started with Go Review: UC Irvine's Golang Course on Coursera Getting Started with Go (UC Irvine) on Coursera: ...
go-staticmaps: A go (golang) library and command line tool to render static. 2 minutes from clone to running. 2 minutes from clone ...
Gregor Zunic posted that they're migrating their backend from Python to Go: "completely impossible 3 years ago. Now it's taking 1 ...
The 2026 Go Developer Survey is open! Help set Go’s priorities for next year by telling us how you use Go and where it could be better. ⏱️ 10–20 minutes 📅 Open through November 3 blink.qual
Want to learn coding in 2025 but confused about where to start? In this video, we cover the Top 5 Programming Languages that ...
JOIN ACEDEVHUB COURSE WAITLIST FOR FREE ▭▭⭐ https://acedevhub.com/courses ⭐▭▭ DOWNLOAD SOURCE ...

Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core
Coraza: Truncated multipart body bypasses MULTIPART STRICT ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that cou
