A malicious Twitch chat message could trigger native code execution on a streamer's Windows PC running OBS Studio 32.2.2 or older by exploiting an unsanitized XSS vulnerability in a custom chat overlay combined with CVE-2024-7971, a V8 vulnerability in the bundled Chromium engine. The attack chain was discovered by Orange researchers and disclosed after coordination with the OBS team. OBS is addressing the issue by upgrading to Chromium 128 and testing sandbox re-enablement.
A security researcher discovered an account takeover vulnerability in Sourcehut's build logs caused by improper XSS protection in the ansi2html library. The vulnerability allows attackers to craft malicious ANSI escape sequences that generate unsafe HTML links with JavaScript execution capabilities, potentially compromising user accounts accessing build logs.
GitLab released critical security patches (19.4.1, 19.3.3, 19.2.7) on September 23, 2026 to address multiple high-severity vulnerabilities including a double-free in the regex parser (CVE-2026-89078) and integer overflow (CVE-2026-93577) that could allow authenticated users to execute arbitrary code via malicious CI/CD configurations. Additional vulnerabilities in the merge request diff viewer and Duo AI feature were also patched.
A web crawler named lawa discovered significant HTTP header inconsistencies across millions of requests, including variable capitalization patterns, frequent misspellings in headers with limited valid values, and numerous security issues such as exposed RFC 1918 addresses and request header echo-back vulnerabilities that revealed other crawlers' IP addresses.