#rust

2 articles

Adobe has patched StyleSmuggler. The first confirmed victim was fully patched too

2026-09-08Security

CVE-2026-75650 is rated CVSS 10.0 and Adobe shipped the fix on 8 September, four days into active exploitation. Applying it is only half the remediation — the encryption keys have to be rotated as well. And the first confirmed victim was already running the August patches, which is why patching is not the same as being clear.

A crate in three quarters of Rust builds was poisoned and pulled in 86 minutes — compiling was enough to run it

2026-08-21Security

arrayref has over 245 million downloads. On 20 August a malicious 0.3.7 appeared on crates.io with a dependency impersonating proc-macro2, whose build script fetched a second stage over TLS with certificate validation switched off. Wiz attributes it to a North Korean actor on infrastructure overlaps with two earlier campaigns.