Released upstream • October 2026
oauth2 is the Ruby OAuth 2.0 client gem behind omniauth-oauth2, with over 280 million downloads. A cross-origin redirect replayed the token request body, with the authorization code and possibly the client secret, to the new host, and a response without a token was dumped whole into the error message. Maintainer Peter Boling merged both our fixes, hardened them and released them the same day.
- 24–25 Oct 2026. We opened pull requests #775 and #776 with fixes and regression tests.
- 25 Oct. Both merged, followed up in #777 and released in v2.0.26 and v2.1.0, credited to us in the changelog.
How to read this. The redirect leak needs a compromised or misconfigured token endpoint or proxy, and the error leak needs a token-less response, so these are hardening fixes, not remote exploits. Findings are leads for people, not verdicts.
Benchmark Report • Hacktoberfest 2026
What happens when you audit real-world codebases with a 65,536-token context window on bare-metal ARM64 CPUs? We benchmarked Google's Gemma 4 family across 7 model configurations on Neoverse-V2 silicon, uncovering an unexpected SIMD unpacking paradox where 4-bit runs twice as fast as 2-bit, and evaluating 3-round skeptical triage against verified ground-truth zero-days.
- 24 Oct 2026. Headless execution of 7 local model configurations and Google Vertex AI MaaS on real-world targets (yopass and curlie).
- 25 Oct. Published for the DEV Hacktoberfest 2026 Open-Source AI Challenge (Best Use of Gemma).
Fixed upstream • October 2026
Orca is a desktop app for running a fleet of coding agents. It read SSH keys from IdentityFile paths with no check on file type or size, so a path pointing to a named pipe froze the app and a huge file was loaded whole. Maintainer Neil built a broader fix on our pull request, kept our tests and credited us as co-author.
- 22 Oct 2026. We filed issue #31965 and pull request #31966 with a fix and tests.
- 23 Oct. The maintainer merged #32274, which builds on ours, with us as co-author; not in a release yet.
How to read this. The key paths come from the user’s own SSH configuration, so this is a robustness fix, not a vulnerability. Findings are leads for people, not verdicts.
Released upstream • October 2026
mise manages versions of developer tools and installs many of them from aqua registry entries. Its template lexer looped forever on a string literal without a closing quote, so a broken registry template hung mise instead of failing. Maintainer Jeff Dickey added tests to our fix and merged it the same day; it shipped in v2026.10.17.
- 20 Oct 2026. We opened pull request #14752 with the fix and a regression test; Jeff Dickey merged it the same day.
- 21 Oct. Released in mise v2026.10.17.
How to read this. Triage imagined a malicious registry; in practice the templates come from the bundled or user-chosen registries, so it is a hang on a broken entry. Findings are leads for people, not verdicts.
Released upstream • October 2026
KDE Connect links phones with desktops to share notifications, files and the clipboard. Its Android Bluetooth backend buffered incoming packets with no size limit, so a paired device that never sent a line terminator could make the app run out of memory. Bluetooth support is an opt-in beta. Creator and maintainer Albert Vaca Cintora merged our fix, which reuses the 32 MB limit the LAN backend already had.
- 4 Oct 2026. A scan of KDE Connect for Android flagged the unbounded buffer in
BluetoothLink.kt; triage rated it valid.
- 8 Oct. We opened merge request !696 with the fix and a unit test. Albert Vaca Cintora merged it the same day; released in v1.36.0.
How to read this. The scanner’s triage called the attacker remote; reading the code narrowed it to an opt-in backend and an already paired device. Findings are leads for people, not verdicts.
Merged upstream • October 2026
ProFTPD is a widely deployed FTP and SFTP server. Its mod_sftp_pam module matched keyboard-interactive answers to PAM prompts by the wrong index. When a PAM module sent an info message before a prompt, as pam-krb5 does during a password change, login failed or the session process read past the end of the answers array. Maintainer TJ Saunders merged our fix.
- 30 Sep 2026. A scan of the ProFTPD tree flagged
sftppam_converse(); three triage rounds rated it valid.
- 2 Oct. We confirmed it with an AddressSanitizer harness and opened pull request #2355.
- 7 Oct. TJ Saunders merged it into master; not in a tagged release yet.
How to read this. The scanner’s triage overstated the reach; reading the receiving code narrowed it to PAM stacks that mix messages and prompts. Findings are leads for people, not verdicts.
Released upstream • October 2026
Windmill is an open-source platform for scripts, workflows and internal tools. When an AI step referenced an S3 object, Windmill downloaded the whole object and base64-encoded it with no size limit, so one large object could exhaust a worker’s memory. Our size check came too late; maintainer Ruben Fiszel replaced it with a bounded download.
- 2 Oct 2026. A scan of Windmill’s AI backend flagged the unbounded download in
image_handler.rs.
- 4 Oct. We opened pull request #11515 with a size check before encoding.
- 5 Oct. Ruben Fiszel merged a bounded download in #11534, released in v1.824.0.
How to read this. Our patch was only a partial mitigation; the maintainer’s fix is better. Findings are leads for people, not verdicts.
Merged • Shared library hardening • October 2026
Himalaya is a popular CLI email client written in Rust. BudgetScan flagged that message metadata (subjects, sender names, attachment filenames) was printed into terminal tables without escaping control characters. An attacker could craft emails with OSC 52 sequences to silently overwrite the user's clipboard, manipulate terminal output, or use Unicode BiDi overrides to disguise executable attachments. Maintainer Clément Douin extracted our sanitization into the shared pimalaya-cli library with co-authorship credit, so its sister CLI tools can adopt it too.
- 2 Oct 2026. BudgetScan flagged unescaped metadata rendering in Himalaya's table output. We opened pull request #771 on GitHub with an initial patch and test suite.
- 2 Oct. Maintainer Clément Douin (
soywod) recognized that sister CLI projects (cardamum, calendula) share the same tables. He moved the sanitization into pimalaya-cli 0.2.6 with BiDi override filtering, crediting Martin Vlach as co-author.
- 3 Oct. We completed backend coverage across IMAP, JMAP, Gmail, Graph and pimdir backends and added unit tests. Maintainer Douin reviewed and merged pull request #771 into master.
- 11 and 14 Oct. Separately, two patches by contributor SORALNV were merged: PR #782 (attachment downloads) and PR #783 (message view sanitization).
How to read this. Automated scanning detected an input-sanitization gap, and close collaboration with the maintainer turned a single bug fix into a shared function the other Pimalaya CLI tools can adopt. Findings are actionable leads for humans, not unquestioned verdicts.
Fixed in OpenBSD and tmux upstream • October 2026
tmux is the ubiquitous terminal multiplexer. When executing its copy-mode -S handler without an attached client (such as from a hook or background server queue), tmux dereferenced a NULL client pointer, crashing that tmux server with SIGSEGV and ending all of its sessions. Creator and lead maintainer Nicholas Marriott accepted our report and applied the fix to OpenBSD CVS.
- 1 Oct 2026. BudgetScan flagged the unguarded client pointer in
cmd-copy-mode.c. We verified the crash path via hooks and opened pull request #5670 on GitHub with the fix and an automated regression test.
- 2 Oct. tmux lead maintainer Nicholas Marriott (
nicm) reviewed the pull request, replied “Applied to OpenBSD now, will be in GitHub later. Thanks!”, and committed revision 1.55 to OpenBSD CVS credited to Martin Vlach. The same day it was synced to tmux on GitHub as commit 5932140.
How to read this. The scanner flagged the unguarded pointer as an actionable lead, and an engineer confirmed the control flow, isolated the hook trigger, wrote the test, and reported the fix. Upstream maintainer Nicholas Marriott validated and committed it to OpenBSD. Findings are leads for people, not verdicts.
Fixed upstream • October 2026
dnsmasq is the DNS and DHCP server built into many routers and Linux systems. A DHCP lease that lost its hostname kept its SLAAC name records, so a later ICMPv6 reply handed a NULL hostname to a log call. We mailed a patch for the log line; author Simon Kelley fixed the underlying stale records instead and credited Martin Vlach in the commit. A second patch from the same scan was applied too.
- 30 Sep 2026. A scan flagged the NULL hostname in
slaac_ping_reply(); we mailed a patch to dnsmasq-discuss.
- 1 Oct. Simon Kelley committed a broader fix that clears stale SLAAC-name data, and also committed our second patch from the same scan, for an allocation-failure bug in
poll_listen().
- 11 Oct. He replied to both patches on the list; neither is in a tagged release yet.
How to read this. The scanner found a symptom; the maintainer found the cause. Findings are leads for people, not verdicts.
First hit on open source • September 2026
Yopass is an open-source tool (over 3,000 GitHub stars) for securely sharing secrets, passwords and files. When it is set to allow logins only from certain email domains, its OIDC login trusted the email address returned by the identity provider without checking the email_verified claim. Someone with an unverified account at an identity provider under an allowed domain could therefore get past the domain restriction.
- 23 Sep 2026. BudgetScan flagged the missing check. We opened a pull request with a fix and tests.
- 24 Sep. An automated review asked for stronger tests, which we added. The maintainer pointed out that
email_verified is an optional claim, so enforcing it blindly could break existing setups.
- 25 Sep. Maintainer Johan Haals built on our patch in a new pull request: he kept our commit as the first one, with its authorship, and added an explicit opt-out for providers that omit the claim, a startup warning, configuration validation, tests and documentation.
- 26 Sep. Merged into Yopass. By default, OIDC logins now require a verified email.
How to read this. Thanks to Johan Haals for the quick, careful handling. The scanner found the problem and a human maintainer decided how to fix it safely, which is how we want it to work: findings are leads for people, not verdicts. It is one data point, not a benchmark. We will publish measured results once we have them.