Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-19 · source-backed
Hacktron surfaced it as a Next.js image optimization flaw in August, then traced upstream to libheif's AVIF decoder. Reported with a working PoC August 11-12, platform-wide mitigation August 13, libvips maintainer reached August 19, libheif 1.23.2 fix August 25 alongside a Next.js release that disabled AVIF outright. GHSA-g89c-p67h-r497, with blast radius covering ImageMagick, WordPress and sharp. Vercel A full public disclosure timeline is rarer than it should be.
Each link below shares sources, entities, or timing with this story.
Hacktron published its writeup on September 18: a heap buffer overflow in libheif 1.19.7/1.19.8 (a missing Debian 12/13 security backport) reached through ImageMagick's HEIF handling into Discourse image uploads on community.openai.com, then via an OpenAI SSO misconfiguration...
Two adapters on August 25: the Notion one lets an agent already running on Slack, Discord, GitHub, Teams or WhatsApp join comment discussions on Notion pages with no separate codebase, and the XChat one handles encryption, key management and signature verification for E2E-encr...
vercel ai-gateway coding-agents setup routes Claude Code, Codex, OpenCode, Pi, Cline, Cursor, Hermes, Kilo Code, and OpenClaw through AI Gateway, consolidating spend, traces, tokens, and model attribution into one dashboard with per-key budgets (--budget 500 --refresh-period m...
Six clients. One manifest. Zero vendor lock. Vercel published Agent Plugins 1.0.0 on August 6, an openly licensed spec that bundles Agent Skills and MCP servers behind a single portable manifest. The shape is deliberately boring: a plugin.json requiring only schemaVersion and...
Vercel just shipped the stuff that makes Fly.io and Railway nervous, and they did it in a single push. The Vercel Container Registry is now a thing: an OCI-compliant image registry on Vercel's own infrastructure. You can deploy an HTTP server straight from a Dockerfile or Cont...
GitHub published four advisories against omnigent-ai/omnigent v0.1.0, the meta-harness that runs Claude Code, Codex and Pi under policy and sandboxing. GHSA-jrrm-9hc7-2v3h at CVSS 9.0 lets any user with session edit rights overwrite a shared template agent via PUT /sessions/{i...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.