glibc, marketplace malware, and Apache CVEs

Security traffic on 2026-10-30 centered on a glibc gettext advisory with code-execution risk and a compromised VS Code extension delivering a RAT. Several Apache projects also shipped CVEs covering industrial protocols, RPC parsing, analytics authorization, and related library flaws.

glibc gettext directory traversal (GLIBC-SA-2026-0025)

The GNU C Library published GLIBC-SA-2026-0025 describing a directory traversal in gettext driven by the LANGUAGE environment variable. The flaw can lead to code execution. Systems that rely on glibc localization need the corresponding updates.

Claude Code VS Code extension compromised

The Claude Code extension for VS Code on Open VSX was compromised and pushed a remote access trojan through its auto-update path. The incident is relevant to open source maintainers who publish or depend on marketplace extensions.

Apache PLC4X OPC UA secure channel bypass

CVE-2026-102508 covers an inverted signature check, missing server certificate validation, and silent downgrade in the Apache PLC4X OPC UA driver before 1.0.0. The issues allow integrity bypass and acceptance of unverifiable certificates on industrial protocol stacks.

Apache Thrift Java skip recursion DoS

Apache Thrift disclosed CVE-2026-120135, a high-severity uncontrolled recursion denial of service in Java TProtocolUtil.skip() before 0.24.0. By default the method does not limit recursion depth, so services parsing untrusted Thrift input remain exposed until upgraded.

HTTP::Parser::XS PATH_INFO NUL truncation

CVE-2026-116130 affects HTTP::Parser::XS versions before 0.18 for Perl. parse_http_request truncates PATH_INFO at an encoded NUL byte. The pure-Perl backend is unaffected.

Go 1.24+ MPTCP and kernel CVE-2026-98432

A short thread forwarded guidance on protecting Go programs against Linux kernel CVE-2026-98432. Go 1.24 and later enable MPTCP by default, which can surface the kernel issue; a sysctl mitigation is noted.

Apache Pinot single-stage lookup authorization bypass

CVE-2026-73322 describes incorrect authorization in Apache Pinot's single-stage query engine. The flaw lets callers read unauthorized dimension tables through the lookup() function.

CallBackery Perl package (ten CVEs)

Ten CVEs were disclosed for CallBackery versions before 0.62.0 for Perl. The set covers password hashes, sessions, backups, and command execution in this niche package.