Zip Slip, Path Traversal Vulnerability during File Decompression ASEC
Zip Path Traversal | Security | Android Developers
The Zip Path Traversal vulnerability, also known as ZipSlip, is related to handling compressed archives. On this page, we demonstrate this vulnerability using the ZIP format as an example, but similar problems can arise in libraries handling other formats, like TAR, RAR, or 7z.
Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
### Summary A path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extraction directory. The vulnerability has two attack vecto...
Secure coding technique: Default behavior of Zip libraries can lead to Remote Code Execution - Blog
This week we are going to talk about the default behavior of Zip libraries. If you are an application developer, it is very likely that you have used this before. Most resources that are downloaded over the internet are in zip format, this makes sense; compressed data is smaller, so it downloads faster and consumes less bandwidth.
How to Prevent Zip File Exploitation | CrowdStrike
This blog post explores how the zip file format can be exploited and shares the solution the CrowdStrike team came up with.
Linux distributions worldwide targeted by the Copy Fail exploit
An exploit for the "Copy Fail" security vulnerability (CVE-2026-31431) in the Linux kernel has been made public. The vulnerability affects all major Linux
GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog
A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.
“Implementation Selection” in Rust — Andrew Lilley Brinker
Exploring options for selecting branching paths in Rust code at compile time and runtime.
Tree Borrows | Proceedings of the ACM on Programming Languages
The Rust programming language is well known for its ownership-based type system, which offers strong guarantees like memory safety and data race freedom. However, Rust also provides unsafe escape hatches, for which safety is not guaranteed automatically ...
Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak
Critical out-of-bounds read in Ollama before 0.17.1 leaks process memory including API keys from over 300000 servers via crafted GGUF files.
Bringing back at://
I’d also like to voice a strong dissenting opinion: a separate URI scheme follows long-standing precedent, reduces cognitive overhead and software complexity by making the transport distinction explicit, and has less ambiguous error handling. I think this direction trades short-term convenience for long-term ambiguity. The transport models are incompatible, not variants of each other Public atproto records flow through a well-understood pipeline: repos export as CAR files, relays consume fireh...
Cross-Platform File System Operations Based on libuv
A cross-platform interface to file system operations, built on top of the libuv C library.
Sharing this! Wish I'm not late for #IETF126 Tangled found PDS doesn't fit well for contributions even with upcoming permissioned space spec. So, we are planning to store record-like data outside of PDS, in Knot. This is a post explaining the reasons & upstream spec change we need. #atproto #atdev
tangled-cob.md · by boltless.me
tangled.orgOne of the more nagging questions atm relates to path-dependency: Given #atproto / Bluesky largely emerged from (the ruins of) the other place, are we falling for Russell Ackoff's "trying to do the wrong thing righter" trap? 🤔
