# race-condition Published articles for race-condition. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## CVE-2026-98276: Patched kernels available in testing DevFeed: [CVE-2026-98276: Patched kernels available in testing]() Original publisher: [Read original article]() Author: Andrew Lukoshko AlmaLinux Lead Architect Published: 2026-11-06T00:00:00Z Content type: news Language: en Sources: [AlmaLinux]() Topics: [Linux Kernel](), [cve remediation](), [race-condition](), [Memory Safety](), [Kernel](), [releases]() Tags: [2026](), [account](), [almalinux](), [code](), [condition](), [cve](), [cvss](), [kernel](), [kernel-vulnerability](), [kernels](), [linux](), [linux-kernel](), [linux-kernel-vulnerability](), [local](), [patched](), [production](), [race-condition](), [release](), [repository](), [testing]() ### AI overview CVE-2026-98276 is a local Linux kernel race that can cause a UDP socket use-after-free. An ordinary local user can race `bind()` with the `SIOCGSTAMP` timestamp ioctl; network traffic alone cannot trigger it. The kernel CVE team rates it 7.8 High, while Red Hat rates it 7.0 Moderate, citing the difficulty of winning the race. AlmaLinux 8, 9, and 10 are affected. Patched kernels are in AlmaLinux's testing repository: 4.18.0-553.184.2.el8_10, 5.14.0-687.66.2.el9_8, and 6.12.0-211.74.2.el10_2; install the version for your release or newer, then reboot. The AlmaLinux 8 fix required adapting the upstream change and related protocol handlers, so its testing is especially welcome. No practical workaround is identified; limiting who can run code reduces exposure. The text says no fixed RHEL kernel was available at publication and that AlmaLinux planned to move these builds to production after community testing. ### Source excerpt A new Linux kernel vulnerability, CVE-2026-98276, is a race condition in the socket code that can lead to a use-after-free of a UDP socket. The Linux kernel CVE team scores it CVSS 7.8 (High): it needs a local account that can run code, but no special privileges and no user interaction. AlmaLinux 8, 9, and 10 are affected. Patched kernels are available in the testing repository today, and we would like your help verifying them before we release them to production. ## CVE-2026-61854 - VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth DevFeed: [CVE-2026-61854 - VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth]() Original publisher: [Read original article]() Author: CVEFEED.io Published: 2026-10-30T18:25:28Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [race-condition](), [shared mutable state](), [thread safe data sharing](), [locking]() Tags: [2026](), [async](), [asyncio](), [atomic](), [buffer](), [can](), [cause](), [cleanup](), [concurrent](), [condition](), [crash](), [cve](), [cve-2026-61854](), [cvss](), [data](), [feature](), [growth](), [race-condition](), [report](), [transcript]() ### AI overview In VoiceSentinel versions 2.2.1 through before 3.3.1, the optional report buffer can race when retention cleanup rewrites a tenant's transcripts.jsonl while unsynchronized writes append to it. Concurrent cleanup and writes may lose, duplicate, or corrupt transcripts and defeat retention pruning, allowing disk use to grow without bound and potentially crash the host or other services sharing its storage. The issue is reachable during normal operation; worker_count of at least two and shared server_key values increase collisions. The feature is disabled by default, and the description says the issue is fixed in 3.3.1. ### Source excerpt CVE ID :CVE-2026-61854 Published : Oct. 30, 2026, 6:25 p.m. | 49 minutes ago Description :VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## Fresh WordPress Vulnerability in Attackers' Crosshairs DevFeed: [Fresh WordPress Vulnerability in Attackers' Crosshairs]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-10-30T12:04:13Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [WordPress](), [Exploit](), [race-condition](), [Vulnerabilities](), [XSS]() Tags: [exploited](), [race-condition](), [remote-code-execution](), [vulnerabilities](), [vulnerability](), [wordpress]() ### AI overview Attackers began probing a high-severity, unauthenticated race condition in WordPress's Core update process within hours of patches becoming available. Exploitation requires a full-package update, access to a web-accessible staging tree, a predictable or discovered staging path, and timing the brief period before temporary files are removed; Defiant describes the attack complexity as high. WordPress 7.1.4 randomizes the staging directory, adds an index guard, and blocks unsafe promotion of staged configuration data. Fixes were also backported through WordPress 4.7. Wordfence reported more than 18,500 requests targeting staged installer paths in the first 21 hours, but no successful compromises. No CVE had been assigned at publication. ### Source excerpt Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution. The post Fresh WordPress Vulnerability in Attackers' Crosshairs appeared first on SecurityWeek. ## ZDI-26-838: FreeBSD Kernel TTY Race Condition Local Privilege Escalation Vulnerability DevFeed: [ZDI-26-838: FreeBSD Kernel TTY Race Condition Local Privilege Escalation Vulnerability]() Original publisher: [Read original article]() Published: 2026-10-29T05:00:00Z Content type: news Language: en Sources: [Zero Day Initiative]() Topics: [race-condition](), [freebsd](), [Kernel]() Tags: [condition](), [freebsd](), [kernel](), [local](), [local-privilege-escalation](), [privilege-escalation](), [race-condition](), [vulnerability]() ### AI overview A race condition in FreeBSD Kernel's TIOCSCTTY handler can let a local attacker escalate privileges and execute code in the kernel context. Exploitation requires the attacker to already be able to run low-privileged code on the affected system. The flaw stems from missing locking during object operations. FreeBSD has issued an update; the supplied text does not specify affected versions or mitigation steps. The vulnerability is CVE-2026-58093, rated CVSS 7.8 by ZDI. ### Source excerpt This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-58093. ## CVE-2026-77059 - TOCTOU Race Condition in boneIO DevFeed: [CVE-2026-77059 - TOCTOU Race Condition in boneIO]() Original publisher: [Read original article]() Author: cvefeed.io Published: 2026-10-26T15:16:43Z Content type: article Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [race-condition](), [Cybersecurity]() Tags: [2026](), [boneio](), [cve](), [cve-2026-77059](), [fixed](), [local-privilege-escalation](), [race-condition](), [root](), [rules]() ### AI overview In boneIO Black, `create_timedatectl_sudoers_file()` writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker may exploit the gap between validation and installation to replace the content, or attack the predictable filename with a symlink, enabling malicious sudoers rules and local privilege escalation to root. The issue is stated as fixed in version 1.6.0; the excerpt does not provide exact affected versions. ### Source excerpt CVE ID :CVE-2026-77059 Published : Oct. 26, 2026, 3:16 p.m. | 48 minutes ago Description :boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race window between validation and installation to substitute malicious content, or use the predictable filename for symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root. This issue was fixed in version 1.6.0. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## CVE-2026-116201 - Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition DevFeed: [CVE-2026-116201 - Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition]() Original publisher: [Read original article]() Author: CVEFEED.io; vulncheck.com Published: 2026-10-25T14:17:00Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [saml](), [race-condition]() Tags: [2026](), [cve](), [cve-2026-116201](), [cvss](), [race-condition](), [saml](), [snipe-it](), [snipeitapp](), [vulnerability]() ### AI overview Snipe-IT versions before 8.5.0 are described as vulnerable to SAML assertion replay through a race condition in the SAML ACS handler's non-atomic nonce check. An attacker with a captured assertion can send concurrent POST requests to `/saml/acs` to create multiple authenticated victim sessions, which may persist despite identity-provider-driven revocation. The excerpt rates the vulnerability 8.8 (High); it does not provide further remediation details. ### Source excerpt CVE ID :CVE-2026-116201 Published : Oct. 25, 2026, 2:17 p.m. | 15 minutes ago Description :Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List DevFeed: [Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List]() Original publisher: [Read original article]() Author: BeauHD Published: 2026-10-22T16:16:00Z Content type: news Language: en Sources: [Slashdot]() Topics: [Linux Kernel](), [Linux](), [Security research]() Tags: [buffer](), [buffer-overflow](), [code-execution](), [driver](), [graphics](), [information](), [kernel](), [linux](), [linux-kernel](), [local-privilege-escalation](), [network](), [public](), [race-condition](), [remote](), [remote-code-execution](), [remote-code-execution-vulnerability](), [security](), [smb](), [tcp](), [vmware](), [vulnerabilities]() ### AI overview Trend Micro's Zero Day Initiative appears to have accidentally posted reports about several unpatched Linux kernel vulnerabilities to the public mailing list. Two CVSS 9.0 flaws could enable remote code execution: an SMB Direct integer underflow (with a patch in a Git branch intended for Linux v7.5) and a KSMBD race condition. Other listed issues include network-code and VMware graphics-driver bugs that can lead to local privilege escalation, an NVMET information disclosure flaw, and a TCP query stack buffer overflow. For the network-code issue, the excerpt says developers had received another report and a patch was expected soon; it gives no further patch status for the other issues. ### Source excerpt Trend Micro's Zero Day Initiative appears to have accidentally disclosed several unpatched Linux kernel vulnerabilities on the public LKML instead of the private security list, including two CVSS 9.0 flaws that could enable remote code execution through SMB Direct and KSMBD. "This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list," adds Phoronix. The newly-disclosed vulnerabilities include: ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline. ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability. ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon. ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation. ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure. ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation. Read more of this story at Slashdot. ## Linus Torvalds's first LLM-assisted patch series DevFeed: [Linus Torvalds's first LLM-assisted patch series]() Original publisher: [Read original article]() Author: corbet Published: 2026-10-14T13:50:29Z Content type: news Language: en Sources: [LWN.net]() Topics: [race-condition]() Tags: [linus-torvalds](), [llm-assisted](), [race-condition](), [rcu](), [review](), [series]() ### AI overview Linus Torvalds has posted a ten-patch series that uses RCU-delayed folio release to allow folio data access under RCU without refcounting on a fast path. A read-heavy benchmark showed an order-of-magnitude speedup, though review has identified a race condition that needs further work. ### Source excerpt At the recently concluded Maintainers Summit, Linus Torvalds said that he had been using a large language model to work on a patch series addressing a longstanding problem; he has now posted that series for review. The fairly short series of ten patches basically enhances folio lookup by noticing when folios are hot, and setting a "delay releasing this folio until after a RCU period", and then using that RCU delay it does not just the folio lookup itself under RCU (which we've done forever), but also the actual folio data accesses themselves under RCU. No refcount taking needed for the fastpath where we can just read the data from the folio entirely in an RCU-protected region when the user copy doesn't cause page faults. The end result is an order-of-magnitude speedup for a read()-heavy benchmark. Review has already identified a race condition in the code, though, so further work will be needed. ## Racing Trains DevFeed: [Racing Trains]() Original publisher: [Read original article]() Author: Remy Porter Published: 2026-10-08T06:30:00Z Content type: opinion Language: en Sources: [The Daily WTF]() Topics: [Concurrency](), [Deadlock]() Tags: [feature-articles](), [race-condition](), [race-conditions]() ### AI overview A train reservation app apparently confirmed two passengers for the same seat. The article attributes the duplicate booking to a race condition in the reservation system, where concurrent checks and reservations were not atomic, and speculates that the bug may have gone unfixed because it was not prioritized. ### Source excerpt Robert G sends us a WTF from the outside, but I think we can come up with some hypotheses about what actually happened. Robert was traveling by train. For complicated train reasons, the car he was seated on was not actually scheduled to continue with the train he was booked to ride, the replacement can missed its scheduled arrival, and the result was that Robert was left at a station needing to rebook his travel. Now, given that this is in a region of the world with a fairly robust train network, this represented a hiccup of thirty minutes in a many hour trip. Not a particularly big deal. But Robert didn't want to get stranded any longer than he had to, so he took out his phone, fired up the train company's app, and made sure he had a reservation on the next train. He got the confirmation, and grabbed a coffee while he waited. Not quite thirty minutes later, Robert boarded the train and went towards his reserved seat. Another passenger approached from the opposite direction, and they met at the seat. "Excuse me," Robert said, "but I reserved this one." "No, I reserved this one." Being reasonable people, they both pulled out their phones and pulled up their apps. Sure enough, each one of them was confirmed for that seat. Since the email confirmation had more details than the app provided, they both pulled up the email. Same seat. Both confirmed. The timestamp of the reservation? The same, down to the second. "I don't think the conductor will let us sit in each other's laps," the other passenger said. As it turned out, there was enough room on the train that no lap sitting was required. Everyone got a seat, even if it wasn't the one they reserved. But the story stuck with Robert. A major transit provider had a reservation system that clearly had a race condition. It seemed like the most basic example of race conditions too, the kind you're shown in college to explain the basic concept. "Check if the seat is reserved, and if it's not, reserve it." Because that sequence ## How Nix enables deterministic debugging of race conditions DevFeed: [How Nix enables deterministic debugging of race conditions]() Original publisher: [Read original article]() Published: 2026-10-07T19:00:00Z Content type: article Language: en Sources: [Farid Zakaria's Blog]() Topics: [Nix](), [gdb](), [race-condition](), [Deadlock]() Tags: [debugger](), [nix](), [race-condition]() ### AI overview The author describes Rewind, a debugger built around Nix derivations and a deterministic virtual machine. Rewind can replay builds, vary thread schedules to find race conditions, compare runs, and inspect program state with gdb. Nix supplies reproducible inputs, sources, and debug symbols for the debugging workflow. ### Source excerpt A few days ago I wrote about Rewind VM, a deterministic VM where every run of a Nix build is a pure function of its inputs, thread schedule included! I have been using it to find, reproduce and solve numerous race conditions in Nix builds, but it's been making me feel a little crazy. What is this superpower, and why is nobody else using it? The tool has quickly grown a source panel, stack frames, bookmarks, a "Compare" tab, a lot more gdb support, thread lanes, which show who held the CPU at every step, and "Check from here", which helps find the exact step where a race condition happens. I went into each new feature thinking it would be a big code-lift but I kept running into the same thing: the hard part of each feature was already done, and Nix had done it. A debugger for instance, needs the exact inputs of the program, its debug symbols, its sources, the sources of every library under it, and a way for someone else to get all of that on their machine. That's exactly what a derivation is, and Nix makes that easy. ## TeamViewer urges users to update clients after five security flaws DevFeed: [TeamViewer urges users to update clients after five security flaws]() Original publisher: [Read original article]() Author: Sergiu Gatlan Published: 2026-09-30T12:25:10Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Fygo remote access](), [Security research](), [code security](), [cve remediation](), [Access Control](), [container escape]() Tags: [2026](), [actively-exploited](), [buffer-overflow](), [bypass](), [computer-help](), [computer-security](), [computers](), [cve](), [elevation-of-privileges](), [infosec](), [infosec-computer-security](), [linux](), [local-privilege-escalation](), [mac](), [macos](), [malware](), [malware-removal](), [path-traversal](), [privilege-escalation](), [race-condition](), [remote-access](), [remote-code-execution](), [security](), [security-updates](), [spyware](), [support](), [teamviewer](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [vulnerabilities](), [vulnerability](), [warning](), [windows]() ### AI overview TeamViewer urged customers to update its Full Client and Host software to version 15.82 after disclosing five high-severity vulnerabilities affecting Windows, Linux, and macOS. The flaws include an access control bypass, path traversal, heap-based buffer overflow, race condition, and path validation issue. The company said it knew of no public exploit code or active exploitation. ### Source excerpt Remote access software company TeamViewer warned customers on Tuesday to immediately patch a set of high-severity vulnerabilities affecting its client and host software. [...] ## New FUTEX Syscalls Back To Being Worked On For Helping Valve's ARM64 Gaming Ambitions DevFeed: [New FUTEX Syscalls Back To Being Worked On For Helping Valve's ARM64 Gaming Ambitions]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-25T22:42:16Z Content type: news Language: en Sources: [Phoronix]() Topics: [Linux Kernel](), [Kernel](), [Emulator](), [io\_uring](), [race-condition](), [x86](), [x86-64](), [Open Source]() Tags: [desktop-linux](), [emulator](), [igalia](), [kernel](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-kernel](), [linux-performance](), [linux-server-benchmarks](), [open-source](), [open-source-graphics](), [phoronix](), [phoronix-test-suite](), [race-condition](), [ubuntu-benchmarks](), [ubuntu-hardware](), [x86](), [x86-64]() ### AI overview Igalia has posted an updated version of Linux kernel patches for the FUTEX get_robust_list2 and set_robust_list2 system calls. The work addresses shortcomings affecting FEX-Emu and other emulation layers supporting ARM64 gaming, and follows fixes for a race condition and VDSO changes. ### Source excerpt Going back to last year the Igalia open-source consulting firm has been working on enhancing the Linux kernel to help Steam Play gaming on ARM64 and ensuring the FEX emulator is operating efficiently for x86/x86_64 games running on the likes of the Steam Frame. After other kernel work in recent months, there's finally an updated round of the FUTEX get_robust_list2 and set_robust_list2 system call patches... ## Burp Suite Adds HTTP/3 Support and High-Throughput Fuzzing Techniques DevFeed: [Burp Suite Adds HTTP/3 Support and High-Throughput Fuzzing Techniques]() Original publisher: [Read original article]() Author: Tom Stacey Published: 2026-09-23T14:00:00Z Content type: release Language: en Sources: [PortSwigger Research]() Topics: [QUIC](), [Fuzzing/Fuzz testing](), [race-condition](), [Vulnerabilities](), [Network]() Tags: [fuzzing](), [http-3](), [http3](), [network](), [quic](), [race-condition](), [server]() ### AI overview PortSwigger announces HTTP/3 support in Burp Suite through a new HTTP/3 Adapter plugin and HTTP/3 support in Turbo Intruder. The article describes performance tuning, high request rates, and new race-condition testing techniques over HTTP/3. ### Source excerpt How many bugs have you missed because you didn't send quite enough HTTP requests? Turbo Intruder now supports HTTP/3, can comfortably exceed 100,000 requests per second over Wi-Fi, and auto-tunes for ## ZDI-26-742: Foxit PDF Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability DevFeed: [ZDI-26-742: Foxit PDF Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability]() Original publisher: [Read original article]() Published: 2026-09-23T05:00:00Z Content type: news Language: en Sources: [Zero Day Initiative]() Topics: [race-condition](), [Exploit]() Tags: [local](), [local-privilege-escalation](), [pdf](), [privilege-escalation](), [race-condition](), [vulnerability]() ### AI overview A race condition in Foxit PDF Reader's update functionality can let a local attacker with the ability to run low-privileged code exploit missing object-operation locking to execute arbitrary code as SYSTEM. The advisory rates it CVSS 7.8 and identifies CVE-2026-91813. Foxit has issued an update to address the vulnerability. ### Source excerpt This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-91813. ## Claude's merged chat and Cowork vs. ChatGPT's Work mode: ChatGPT is faster, Claude is more thorough DevFeed: [Claude's merged chat and Cowork vs. ChatGPT's Work mode: ChatGPT is faster, Claude is more thorough]() Original publisher: [Read original article]() Author: Jessica Wachtel Published: 2026-09-22T17:45:46Z Content type: comparison Language: en Sources: [The New Stack]() Topics: [ChatGPT](), [Claude](), [anthropic](), [OpenAI](), [Code](), [Command-line interface](), [codex](), [API](), [Latency](), [race-condition]() Tags: [ai-agents](), [ai-engineering](), [anthropic](), [chatgpt](), [claude](), [code](), [codex](), [coding](), [coding-agent](), [command-line](), [developer-tools](), [latency](), [openai](), [race-condition]() ### AI overview The article compares Anthropic's unified Claude chat and Cowork experience with ChatGPT's Work mode through tests based on developer tasks. The tests cover API research, building a command-line parser from a specification, and analyzing logs for race conditions, latency percentiles, and endpoint error rates. ### Source excerpt When Anthropic merged Claude chat and Cowork into a single interface last week, it removed an increasingly irrelevant decision users The post Claude's merged chat and Cowork vs. ChatGPT's Work mode: ChatGPT is faster, Claude is more thorough appeared first on The New Stack. ## How to Prevent Stale API Responses with AbortController DevFeed: [How to Prevent Stale API Responses with AbortController]() Original publisher: [Read original article]() Author: Jhon-Harry Published: 2026-09-22T08:12:45Z Content type: tutorial Language: en Sources: [SitePoint]() Topics: [API](), [JavaScript](), [race-condition](), [cancellation](), [Error Handling](), [browser](), [Promise](), [input]() Tags: [api](), [apis](), [app-development](), [browser](), [cancellation](), [error-handling](), [javascript](), [race-condition]() ### AI overview This tutorial explains how stale API responses can overwrite newer results when network requests finish out of order. It shows how JavaScript's AbortController can cancel the previous request in search and autocomplete interfaces, and why cancellation should be handled separately from actual errors to avoid misleading logs and metrics. ### Source excerpt null Continue reading How to Prevent Stale API Responses with AbortController on SitePoint. ## Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities DevFeed: [Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-09-21T09:31:12Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Linux Kernel](), [Vulnerabilities](), [Security](), [Exploit](), [patches](), [race-condition](), [TLS (Transport Layer Security)]() Tags: [cisa](), [cisa-kev](), [cvss](), [cybersecurity](), [exploit](), [exploited](), [featured](), [linux](), [linux-kernel](), [memory-corruption](), [patch](), [race-condition](), [vulnerabilities](), [vulnerability]() ### AI overview Security agencies warned that three exploited Linux kernel vulnerabilities can cause denial of service, disclose memory, or modify memory. CISA directed federal agencies to patch them within three days. ### Source excerpt Attackers could exploit the flaws to cause denial-of-service conditions, disclose memory, or modify memory. The post Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities appeared first on SecurityWeek. ## Building Distributed Sliding-Window Rate Limiters in TypeScript and Redis DevFeed: [Building Distributed Sliding-Window Rate Limiters in TypeScript and Redis]() Original publisher: [Read original article]() Author: SitePoint Team Published: 2026-09-20T14:38:55Z Content type: tutorial Language: en Sources: [SitePoint]() Topics: [distributed-systems](), [rate-limiting](), [Redis](), [TypeScript](), [Concurrency](), [implementation](), [Lua](), [Express](), [middleware](), [k6]() Tags: [atomic](), [concurrency](), [databases](), [distributed](), [express](), [javascript](), [k6](), [limit](), [middleware](), [programming](), [quotas](), [race-condition](), [rate-limiting](), [redis](), [typescript]() ### AI overview A practical guide to building a distributed sliding-window rate limiter with TypeScript and Redis. It uses sorted sets and an atomic Lua script to enforce RPM and TPM quotas under concurrency, integrates with Express and Hono middleware, generates rate-limit headers, and tests behavior with k6. ### Source excerpt Implement an atomic sliding-window rate limiter in TypeScript with Redis sorted sets and Lua, enforcing dual RPM/TPM quotas with standard rate-limit headers. Continue reading Building Distributed Sliding-Window Rate Limiters in TypeScript and Redis on SitePoint. ## Debugging in My First Language: A Bilingual Developer's Accidental Discovery DevFeed: [Debugging in My First Language: A Bilingual Developer's Accidental Discovery]() Original publisher: [Read original article]() Author: Valeria Castro-Yoskovich Published: 2026-09-19T12:00:08Z Content type: opinion Language: en Sources: [Atomic Object]() Topics: [debugging](), [codex](), [CRUD](), [race-condition](), [Large Language Model]() Tags: [ai-for-developers](), [codex](), [crud](), [debugging](), [developer](), [race-condition]() ### AI overview A bilingual developer describes using Codex while debugging a CQRS architectural issue and unexpectedly switching to Spanish. The experience leads to a reflection on how working in a first language may reduce the mental effort required to understand complex software concepts, including race conditions. ### Source excerpt I was working with Codex on a CQRS architectural issue, which was new for me, when something unexpected happened. Most of my experience has been in CRUD-style applications, where you read and write to the same model and the mental model is fairly straightforward: one source of truth, one path in and out. CQRS splits [...] The post Debugging in My First Language: A Bilingual Developer's Accidental Discovery appeared first on Atomic Spin. ## ZDI-26-681: Linux Kernel FUSE Subsystem Race Condition Local Privilege Escalation Vulnerability DevFeed: [ZDI-26-681: Linux Kernel FUSE Subsystem Race Condition Local Privilege Escalation Vulnerability]() Original publisher: [Read original article]() Published: 2026-09-14T05:00:00Z Content type: news Language: en Sources: [Zero Day Initiative]() Topics: [Linux Kernel](), [race-condition](), [Kernel]() Tags: [kernel](), [linux](), [linux-kernel](), [local](), [local-privilege-escalation](), [privilege-escalation](), [race-condition](), [vulnerability]() ### AI overview The Linux Kernel FUSE flaw (CVE-2026-64265) is a race condition in handling fuse_req objects, caused by missing locking during object operations. A local attacker must first be able to run low-privileged code on an affected system; successful exploitation can escalate privileges and execute arbitrary code in the kernel context. The advisory says Linux issued an update to correct the issue. ### Source excerpt This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-64265. ## ZDI-26-688: Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability DevFeed: [ZDI-26-688: Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability]() Original publisher: [Read original article]() Published: 2026-09-14T05:00:00Z Content type: news Language: en Sources: [Zero Day Initiative]() Topics: [Linux Kernel](), [race-condition](), [Kernel]() Tags: [2026](), [condition](), [kernel](), [linux](), [linux-kernel](), [local](), [local-privilege-escalation](), [privilege-escalation](), [race-condition](), [vulnerability]() ### AI overview The advisory reports a local privilege escalation flaw in Linux Kernel's OpenvSwitch handling of dp_meter objects. The race condition stems from missing locking during object operations; an attacker needs low-privileged code execution on the target and could then execute arbitrary code in the kernel context. ZDI assigned CVSS 7.8 and lists CVE-2026-74465. Linux issued an update, with a corrective commit linked in the advisory. ### Source excerpt This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-74465. ## ZDI-26-693: Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability DevFeed: [ZDI-26-693: Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability]() Original publisher: [Read original article]() Published: 2026-09-14T05:00:00Z Content type: news Language: en Sources: [Zero Day Initiative]() Topics: [Linux Kernel](), [race-condition](), [Kernel](), [code security]() Tags: [authentication](), [code-execution](), [linux](), [linux-kernel](), [race-condition](), [remote](), [remote-code-execution](), [share](), [vulnerability]() ### AI overview On Linux installations with ksmbd enabled, an authenticated remote attacker can exploit a race condition in handling share_conf objects to execute code in the kernel context. The advisory attributes the flaw to missing locking during object operations, gives it a CVSS rating of 8.5, and says Linux has issued an update to correct it. ### Source excerpt This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability. Furthermore, only systems with ksmbd enabled are vulnerable. The ZDI has assigned a CVSS rating of 8.5. ## ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability DevFeed: [ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability]() Original publisher: [Read original article]() Published: 2026-09-14T05:00:00Z Content type: news Language: en Sources: [Zero Day Initiative]() Topics: [Linux Kernel](), [race-condition](), [Linux]() Tags: [code-execution](), [kernel](), [linux](), [linux-kernel](), [race-condition](), [remote](), [remote-code-execution](), [vulnerability]() ### AI overview Authenticated remote attackers may execute code in the Linux kernel on affected systems with nfsd enabled. The flaw is a race condition in handling nfs4_openowner objects, caused by missing locking during object operations. Linux issued an update to correct it. The advisory assigns CVE-2026-89688 and a CVSS rating of 8.5. ### Source excerpt This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability. Furthermore, only systems with nfsd enabled are vulnerable. The ZDI has assigned a CVSS rating of 8.5. The following CVEs are assigned: CVE-2026-89688. ## ZDI-26-689: Linux Kernel SCTP Subsystem Race Condition Information Disclosure Vulnerability DevFeed: [ZDI-26-689: Linux Kernel SCTP Subsystem Race Condition Information Disclosure Vulnerability]() Original publisher: [Read original article]() Published: 2026-09-14T05:00:00Z Content type: news Language: en Sources: [Zero Day Initiative]() Topics: [Linux Kernel](), [race-condition](), [Vulnerabilities](), [Linux](), [exploit chaining]() Tags: [2026](), [code](), [condition](), [disclosure](), [information](), [kernel](), [linux](), [linux-kernel](), [race-condition](), [vulnerability]() ### AI overview CVE-2026-46227 is a race condition in Linux Kernel's SCTP message-buffer initialization that can disclose sensitive information. Exploitation requires an attacker to first run low-privileged code on the affected system. The flaw stems from missing locking on an object; combined with other vulnerabilities, it may enable arbitrary code execution in the kernel. Linux issued an update to fix the issue. The ZDI assigned a CVSS rating of 6.4. ### Source excerpt This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.4. The following CVEs are assigned: CVE-2026-46227. [Next page]()