# race-condition Published articles for race-condition. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## The Thumb That Ran Ahead of the Finger: Anatomy of a Compose Slider Bug DevFeed: [The Thumb That Ran Ahead of the Finger: Anatomy of a Compose Slider Bug]() Original publisher: [Read original article]() Author: Vitaliy Gribko Published: 2026-09-14T04:19:34Z Content type: article Language: en Sources: [ProAndroidDev - Medium]() Topics: [bug](), [Compose](), [Android](), [Design system](), [Code]() Tags: [android](), [bug](), [code](), [compose](), [debugging](), [design-system](), [jetpack-compose](), [kotlin](), [qa](), [race-condition](), [ui]() ### AI overview This article examines a deterministic bug in a custom Compose slider where the thumb moves ahead of the user's finger during a drag. It traces the issue to a design-system slider forked from the AOSP Material implementation and discusses debugging and code simplification. ### Source excerpt A bug report sat in the backlog for seven months. The fix took a day, deleted a third of the slider's logic, and was almost shipped with a second bug inside -- until a machine read my diff better than I did. This is the whole story: the ported behavior that never made sense, the race nobody reported, and why the best fixes remove code. The report The bug report was seven months old when it reached me. A QA engineer had filed it in December, with a screen recording and three steps: Open the people search filters. Grab the right-hand thumb of the age range slider. Drag it slowly to the left. The recording showed the problem in two seconds. The thumb does not follow the finger. It sprints ahead -- you are still crossing the gap between two ticks, and the thumb is already standing on the next one, waiting for you, like a dog that runs to the park while you are still tying your shoes. Expected: the thumb moves with the finger. Actual: it escapes. On a budget phone, on two Android versions, every time. Not a race condition, not a flake -- a perfectly deterministic lie, filmed in December, assigned to a fix-day in July. Seven months is not negligence. It is the natural half-life of a visual glitch filed as minor against a screen nobody dies on. The age filter works. You tap a tick, the value applies. Only the drag -- the one gesture the slider exists for -- feels wrong in a way that is hard to screenshot and easy to deprioritize. When the ticket finally landed on my desk, a colleague glanced at it and asked whether it had already been fixed once. It had not. But I understood his confusion later, when I opened the slider's source and found a comment that explained everything -- including why this bug felt so old. The comment that confessed The slider is not the framework's slider. Our design system ships its own Compose slider, forked from the AOSP Material one, because design needed three knobs the framework does not expose: a custom thumb radius, a custom track height, a differ ## How to Prevent Race Conditions in Django DevFeed: [How to Prevent Race Conditions in Django]() Original publisher: [Read original article]() Author: Mari Published: 2026-09-11T21:50:46Z Content type: tutorial Language: en Sources: [freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More]() Topics: [Concurrency](), [Database](), [SQLite](), [Docker]() Tags: [backend](), [concurrency](), [database](), [django](), [how-to](), [postgresql](), [python](), [race-condition](), [sqlite](), [transactions]() ### AI overview A Django tutorial that demonstrates a credit-spending race condition and explains how database transactions and row locks prevent concurrent requests from using the same credit. ### Source excerpt Let's say you have enough credit left to generate one more image in an AI app. You submit a request in one browser tab, then submit another in a second tab before the first finishes. The app accepts b ## MSVC Build Tools Preview updates - September 2026 DevFeed: [MSVC Build Tools Preview updates - September 2026]() Original publisher: [Read original article]() Author: Eric Brumer Published: 2026-09-09T21:26:30Z Content type: release Language: en Sources: [C++ Team Blog]() Topics: [C++](), [Visual Studio 2026]() Tags: [c](), [c-plus-plus](), [diagnostics](), [msvc](), [race-condition](), [release](), [september-2026](), [updates](), [visual-studio](), [visual-studio-2026]() ### AI overview MSVC Build Tools Preview v14.52 adds C and C++ compiler conformance, diagnostics, and stability fixes, including fixes for compiler errors and C++ modules. ### Source excerpt The MSVC Build Tools Preview is updated regularly with the latest features and fixes from the MSVC development team. This post covers updates from the past month, currently targeting the v14.52 release. This encompasses changes across the compiler frontend, backend, linker, standard library, and related tools. Although you can acquire the MSVC Build Tools Preview [...] The post MSVC Build Tools Preview updates - September 2026 appeared first on C++ Team Blog. ## OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock. DevFeed: [OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock.]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-31T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [race-condition](), [Authorization](), [Auth0](), [Redis]() Tags: [auth0](), [authorization](), [concurrent](), [oauth](), [race-condition](), [redis](), [the-result]() ### AI overview This article explains how concurrent OAuth token refreshes can cause two distinct failures: stale tokens from lost updates and user disconnection when refresh-token rotation treats concurrent reuse as replay. It recommends layered defenses, including conditional writes, and explains why a Redis lock does not address both problems. ### Source excerpt Concurrent refreshes don't just fail. They can disconnect the user entirely. Here are four layers of defense, cheapest first, and why the Redis lock everyone reaches for isn't the one keeping you safe. ## Cypress Ambassador Spotlight: Boris Selivanov DevFeed: [Cypress Ambassador Spotlight: Boris Selivanov]() Original publisher: [Read original article]() Published: 2026-07-24T13:43:32Z Content type: opinion Language: en Sources: [Cypress Blog]() Topics: [Cypress](), [Test automation](), [Testing](), [selectors](), [race-condition](), [Network](), [npm]() Tags: [ambassador](), [automation](), [cypress](), [flaky](), [how-to](), [npm](), [race-condition](), [selectors](), [testing]() ### AI overview This Cypress Ambassador Spotlight presents Boris Selivanov's advice on sharing reusable testing patterns, choosing stable selectors, and building scalable test automation. It highlights cy.intercept() for controlling network traffic and reducing flaky tests, recommends retry-ability and aliases instead of arbitrary cy.wait(ms), and suggests starting with a real application test after installing Cypress. ### Source excerpt What motivates you to be a Cypress Ambassador? I see being an Ambassador as the ultimate form of asynchronous collaboration. My goal is to share things that move the needle for other engineers. By comparing how different teams solve the same testing problems, we can turn isolated project victories into shared wins. How do you currently help others that are either using Cypress or interested in using Cypress? I'm the person teammates ping when a test goes flaky or they're not sure how to appro ## Earning taste and judgment DevFeed: [Earning taste and judgment]() Original publisher: [Read original article]() Author: Addy Osmani Published: 2026-07-14T00:00:00Z Content type: opinion Language: en Sources: [Addy Osmani]() Topics: [Artificial Intelligence](), [coding](), [Code]() Tags: [ai](), [developer](), [junior](), [junior-developer](), [microsoft](), [race-condition]() ### AI overview An opinionated analysis argues that AI coding agents automate the repetitive work through which junior developers traditionally developed taste and judgment, weakening the path from entry-level to senior roles. It discusses labor-market evidence and suggests that choosing what to build and evaluating its quality are increasingly durable skills. ### Source excerpt Taste used to be a byproduct of the reps. Agents took the reps. So if you're junior you now have to go get the taste and judgment on purpose. A builder's look at the weakening entry level, the two debts we now owe, and concrete ways to build judgment when the machine writes the code. ## OpenAI identified a race condition in a 100-picosecond window DevFeed: [OpenAI identified a race condition in a 100-picosecond window]() Original publisher: [Read original article]() Author: Byte-Sized Design Published: 2026-07-06T19:05:51Z Content type: article Language: en Sources: [Byte-Sized Design]() Topics: [race-condition](), [debugging](), [bug](), [OpenAI]() Tags: [bug](), [debugging](), [openai](), [race-condition]() ### AI overview The article describes how OpenAI identified a race condition occurring within a 100-picosecond window. ### Source excerpt How OpenAI stopped debugging like a doctor and started thinking like an epidemiologist and caught a race condition in the process. ## Cloudflare Found a Race Condition in a Widely Deployed Rust Library DevFeed: [Cloudflare Found a Race Condition in a Widely Deployed Rust Library]() Original publisher: [Read original article]() Author: Byte-Sized Design Published: 2026-06-30T17:31:07Z Content type: article Language: en Sources: [Byte-Sized Design]() Topics: [race-condition](), [Rust](), [Cloudflare]() Tags: [bug](), [cloudflare](), [race-condition](), [rust]() ### AI overview Cloudflare found a race condition in one of Rust's most-deployed libraries. The reported fix was four lines. ### Source excerpt Cloudflare found a race condition buried in one of Rust's most-deployed libraries, and the fix was four lines ## Core dump epidemiology: fixing an 18-year-old bug DevFeed: [Core dump epidemiology: fixing an 18-year-old bug]() Original publisher: [Read original article]() Published: 2026-06-30T00:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [bug](), [OpenAI](), [Rockset](), [C++](), [Data Infrastructure](), [Azure](), [Hardware](), [race-condition](), [Open Source](), [Streaming]() Tags: [azure](), [bug](), [c-plus-plus](), [data-infrastructure](), [engineering](), [hardware](), [open-source](), [openai](), [race-condition](), [software]() ### AI overview OpenAI engineers analyzed a large population of core dumps to investigate rare crashes in the Rockset service. The investigation uncovered two unrelated causes: silent CPU corruption on an Azure host and an 18-year-old race condition in GNU libunwind. ### Source excerpt OpenAI engineers used large-scale core dump analysis to debug rare infrastructure crashes, uncovering both a hardware fault and a long-standing software bug. ## CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler DevFeed: [CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler]() Original publisher: [Read original article]() Published: 2026-05-20T00:00:00Z Content type: news Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [vulnerability](), [race-condition](), [Security]() Tags: [2026](), [cve](), [race-condition](), [ruby](), [security](), [vulnerability]() ### AI overview Ruby discloses CVE-2026-46727, a use-after-free vulnerability in the pthread-based getaddrinfo timeout handler. A race condition may cause a Ruby process to crash when an attacker delays DNS responses near the specified timeout. Ruby 4.0.5 fixes the issue. ### Source excerpt A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727. This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:). A remote attacker who can delay DNS responses near the specified timeout may cause the Ruby process to dereference freed memory and crash. Recommended action Please update to Ruby 4.0.5 or later. Workaround If you cannot upgrade immediately, avoid passing timeout: to Addrinfo.getaddrinfo and resolv_timeout: to Socket.tcp. Affected versions Ruby 4.0.0 through 4.0.4 Ruby 4.1.0-dev (master) before the fix Ruby 3.4 series and earlier are not affected. Credits Thanks to cantina-security for discovering this issue. Also thanks to shioimm for creating the patch. History Originally published at 2026-05-20 00:00:00 (UTC) Posted by hsbt on 20 May 2026 ## Safe Optimistic Lock Coupling DevFeed: [Safe Optimistic Lock Coupling]() Original publisher: [Read original article]() Author: Thomas Neumann (noreply@blogger.com) Published: 2026-04-29T10:22:56Z Content type: article Language: en Sources: [Database Architects]() Topics: [Concurrency](), [Concurrent Programming](), [Data structures](), [Scalability](), [race-condition]() Tags: [concurrent](), [cpu](), [data-structures](), [locking](), [locks](), [mutex](), [performance](), [race-condition](), [scalability](), [synchronization](), [thread](), [typesafety]() ### AI overview The article explains how lock coupling can limit the scalability of concurrent binary-tree lookups because readers contend on locks, especially at the root. It presents Optimistic Lock Coupling, in which readers validate version numbers without writes, and discusses the race-condition risk when values are used before validation. ### Source excerpt As the number of CPU cores keeps growing, the scalability of concurrent data structures becomes increasingly important. A data structure that works fine on 4 cores can become a bottleneck on 32, not because of algorithmic limitations, but because of how it synchronizes access. We illustrate that with a simple binary tree. Usually these data structures are protected by some kind of lock: struct Node { mutex lock; key_type key; value_type value; Node* left, *right; }; struct Tree { mutex lock; Node* root; }; When searching a value, we can traverse the data structure, lock the parts of the data we are currently touching, and release locks when we are done ("lock coupling"): option Tree::lookup(key_type key) { lock.lock_shared(); mutex* currentLock = &lock; Node* iter = root; option result; while (iter) { if (key == iter->key) { result = iter->value; break; } Node* next = (key < iter->key) ? iter->left : iter->right; if (next) next->lock.lock_shared(); currentLock->unlock(); currentLock = next ? &next->lock : nullptr; iter = next; } currentLock->unlock(); return result; } While conceptually simple, lock coupling has quite poor performance in practice. The problem is that it creates contention on the locks, in particular for the root node. Every lookup goes through the root node, thus the root node is constantly locked and unlocked. While there is no semantic contention between lookups, as all readers can read the root concurrently, there is physical contention on the lock itself, which limits scalability. This can be seen below, with concurrent lookups in a tree of 100,000 elements, executed on a 16-core / 32-thread 9950X3D. Lookup scalability: no locking vs lock coupling This contention problem can be solved by using Optimistic Lock Coupling, a synchronization technique where readers do not perform any writes. The key idea here is that writers lock as usual, and increase a version number when they are done updating. Readers read the version numb ## Keycloak 26.5.6 released DevFeed: [Keycloak 26.5.6 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-03-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [Authentication]() Tags: [2026](), [access-control](), [authentication](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [race-condition](), [release](), [saml](), [security](), [spiffe](), [sso]() ### AI overview Keycloak 26.5.6 was released on March 19, 2026. The release includes security fixes for issues including SSRF, refresh-token reuse bypass, improper access control, privilege escalation, authorization bypass, and information disclosure, along with other bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc #45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc #45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting #45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure #46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission #46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core #46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile #47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations Bugs #45889 Federated user disabled when external DB unavailable, never re-enabled storage #46239 AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication authentication #46296 UsersResource.search briefRepresentation started to return user attributes admin/api #46379 Unexpected error when logging out with offline session and external IDP oidc #46459 Operator-built DB config: targetServerType=primary not applied / connection validation not working after master-replica failover (26.5.0) operator #46588 Partial LDAP sync duration does not follow the defined value in user federation ldap #46605 26.5.4 startup regression with many realms: RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm (O(N²)) core #46656 Em-Hyphens in SPI options on cache configuration page docs #46663 JGroups bind port configuration ignored when --cache-embedded-network-bind-port set infinispan #46669 SPIFFE Clie ## Ctrl-C in psql gives me the heebie-jeebies DevFeed: [Ctrl-C in psql gives me the heebie-jeebies]() Original publisher: [Read original article]() Author: George MacKerron Published: 2026-03-05T16:32:34Z Content type: article Language: en Sources: [Blog -- Neon Docs]() Topics: [SQL](), [client](), [Protocol (disambiguation)](), [race-condition](), [TLS (Transport Layer Security)](), [Process](), [Command-line interface]() Tags: [command-line](), [postgres](), [process](), [race-condition](), [sql](), [tls]() ### AI overview Explains how Ctrl-C cancels a PostgreSQL query in psql: the client opens a separate connection and sends a CancelRequest targeting the original connection, which can create a race condition. It also examines the security implications of sending this request unencrypted despite TLS on the query connection. ### Source excerpt There are a few different reasons to hit the brakes on a Postgres query. Maybe it's taking too long to finish. Maybe you realised you forgot to create an index that will make it orders of magnitude quicker. Maybe there's some reason the results are no longer needed. Or maybe you,... ## How LLMs Feed Your RE Habit: Following the Use-After-Free Trail in CLFS DevFeed: [How LLMs Feed Your RE Habit: Following the Use-After-Free Trail in CLFS]() Original publisher: [Read original article]() Author: clearbluejar Published: 2026-02-03T06:15:00Z Content type: tutorial Language: en Sources: [clearbluejar]() Topics: [Reverse Engineering](), [Large Language Model](), [vulnerability](), [race-condition](), [Windows](), [Kernel](), [Logging]() Tags: [ghidra](), [kernel](), [llms](), [macos](), [race-condition](), [reverse-engineering](), [vulnerability]() ### AI overview This article describes how LLMs and pyghidra-mcp support reverse engineering by tracing a use-after-free vulnerability in Windows Common Log File System (CLFS) through a patch diff. It explains CLFS, its Win32 and kernel-driver interfaces, and how a race condition can trigger the vulnerability. ### Source excerpt Dive into how LLMs and pyghidra-mcp accelerate reverse engineering by tracing a UAF vulnerability in CLFS through a patch diff. ## Fast FRR Container Configuration DevFeed: [Fast FRR Container Configuration]() Original publisher: [Read original article]() Published: 2026-02-02T06:47:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [Docker](), [Containers](), [Ansible](), [Bash](), [configuration](), [race-condition]() Tags: [ansible](), [bash](), [configuration](), [container](), [docker](), [infrastructure](), [netlab](), [race-condition]() ### AI overview This article describes netlab's effort to configure FRR containers by executing generated Linux scripts through docker exec. It explains using shebangs to select vtysh or another interpreter, and reports integration-test issues including timing problems and a race condition involving parallel VLAN configuration. ### Source excerpt After creating the infrastructure that generates the device configuration files within netlab (not in an Ansible playbook), it was time to try to apply it to something else, not just Linux containers. FRR containers were the obvious next target. netlab uses two different mechanisms to configure FRR containers: Data-plane features are configured with bash scripts using ip commands and friends. Control-plane features are configured with FRR's vtysh I wanted to replace both with Linux scripts that could be started with the docker exec command. Read more ... ## Blog: Introducing Falco 0.43.0 DevFeed: [Blog: Introducing Falco 0.43.0]() Original publisher: [Read original article]() Published: 2026-01-26T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [eBPF](), [Kernel](), [Maintainability]() Tags: [ebpf](), [falco](), [improvements](), [kernel](), [legacy](), [maintainability](), [race-condition](), [release](), [version]() ### AI overview Falco 0.43.0 is a stabilization release that consolidates changes from 0.42.0, adds deprecations, and fixes issues across Falcoctl, plugins, and libraries. It includes updates to Falco libraries and drivers, signature verification fixes, plugin fixes, and the reintroduction of the evt.arg.filename field. The release deprecates the legacy eBPF probe and gVisor engine while directing users toward modern alternatives. ### Source excerpt Dear Falco Community, we are happy to announce the release of Falco 0.43.0 today! This is a stabilization release that consolidates the changes introduced in 0.42.0, including the drop-enter initiative and the capture recording feature. It also introduces several deprecations to improve maintainability and fixes minor issues across falcoctl, plugins, and libs. During this release cycle, we merged: 31 PRs on Falco, including 11 release note-worthy changes 48 PRs on Falco libs, including 17 release note-worthy changes 8 PRs on Falco drivers, including 3 release note-worthy changes We upgraded libs to version 0.23.1 and drivers to 9.1.0+driver. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Deprecations GPG key rotation Container plugin improvements Falcoctl tweaks and improvements Key fixes: evt.arg.filename field reintroduction Falcoctl signature verification fixes overflow and NULL pointer dereferences fixes for the container plugin, shipped with plugins/container/0.6.1 race condition fix for the k8smeta plugin, shipped with plugins/k8smeta/0.4.1 This release also comes with breaking changes that you should be aware of before upgrading. Latest updates Deprecations In Falco 0.43.0, we are announcing the deprecation of three significant components to streamline the project, reduce maintenance burden, and focus on modern, more efficient alternatives. All these components are stable, and considering that the deprecation is first enforced in this version, they could be removed at any future version starting from 0.44.0. Legacy eBPF probe deprecation The "legacy" eBPF probe (configured via engine.kind=ebpf) was the original eBPF implementation in Falco. It required compiling a specific probe for each kernel version, often necessitating the dynamic usage of the falco-driver-loader or pre-built drivers. The Modern eBPF probe (engine.kind=m ## How to Prevent Race Conditions in Coroutines DevFeed: [How to Prevent Race Conditions in Coroutines]() Original publisher: [Read original article]() Author: author@typealias.com (Dave Leeds) Published: 2025-11-24T00:00:00Z Content type: tutorial Language: en Sources: [Dave Leeds on Kotlin - typealias.com]() Topics: [Coroutines](), [kotlin-coroutines](), [Kotlin](), [Concurrency]() Tags: [actor](), [atomicint](), [atomics](), [concurrency](), [coroutine](), [coroutines](), [how-to](), [kotlin](), [kotlin-coroutines](), [limitedparallelism](), [mutex](), [programming](), [race-condition](), [shared-mutable-state](), [state](), [stateflow](), [structured-concurrency]() ### AI overview This tutorial explains that Kotlin coroutines and structured concurrency do not automatically protect shared mutable state from race conditions. It introduces the issue using an example that creates 100,000 random bakery orders. ### Source excerpt Thanks to structured concurrency, there are a lot of concerns that we don't have to handle manually when working with Kotlin coroutines. For example, parent coroutines automatically wait for their children to complete before completing themselves. And when a parent coroutine is cancelled, its children are automatically cancelled, too. But when it comes to shared mutable state - mutable data that multiple coroutines could update at the same time - there's nothing magical in the design of coroutines to ensure that the state is updated properly. ## Node.js 22.21.0 (LTS) DevFeed: [Node.js 22.21.0 (LTS)]() Original publisher: [Read original article]() Published: 2025-10-20T23:51:44Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [Command-line interface](), [HTTP](), [npm](), [Benchmark](), [Security](), [WebAssembly]() Tags: [benchmark](), [command-line](), [http](), [javascript](), [lts](), [node-js](), [npm](), [openssl](), [race-condition](), [security](), [webassembly]() ### AI overview Node.js 22.21.0 is an LTS release adding command-line and HTTP proxy capabilities, server-controlled HTTP upgrades, and built-in proxy support. It also includes dependency updates, OpenSSL upgrades, npm 10.9.4, performance changes, diagnostics fixes, documentation improvements, and security-policy documentation. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Keycloak 26.4.1 released DevFeed: [Keycloak 26.4.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-10-16T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [releases](), [Release notes](), [Security]() Tags: [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [race-condition](), [release](), [release-notes](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.4.1 is released with a new security-related feature, enhancements, and fixes across authentication, authorization, administration, user profiles, LDAP, documentation, sessions, and other components. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues New features #43020 Secure Client-Initiated Renegotiation - disable by default dist/quarkus Enhancements #42990 Hide read-only email attribute in update profile context with update email enabled user-profile #43357 JDBC_PING should publish its physical address on startup Bugs #40965 Group permission denies to view user admin/fine-grained-permissions #41292 openid-connect flow is missing response type on language change authentication #42565 Standard Token Exchange: chain of exchanges eventually fails token-exchange #42676 Security Defenses realm settings lost when switching between Headers and Brute Force Detection tabs (v25+) admin/ui #42907 Race condition in authorization service leads to NullPointerException when evaluating permissions during concurrent resource deletion authorization-services #43042 Avoid NPE in FederatedJWTClientAuthenticator when checking for supported assertion types core #43070 Update email page with pending verification email messages prefilled with old email user-profile #43096 keycloak-operator 26.4.0 missing clusterrole permissions docs #43104 Release notes fix for update email docs #43161 Restarting an user session broken for persistent sessions infinispan #43164 Keycloak docs state that only TLSv1.3 is used docs #43218 Cannot revoke access token generated by Standard Token Exchange oidc #43254 Make sure username and email attributes are lower cased when fetching their values from LDAP object ldap #43269 Keycloak 26.4 returns a different error response on a token request without Client Assertion (private_key_jwt client authentication) from Keycloak 26.3 does oidc #43270 Keycloak 26.4 returns a different error response on a CIBA backchannel authentication request without Client Assertion (private_key_jwt client authentication) from Keycloak 26.3 does oidc #43286 Broken links on DB s ## Node.js 24.9.0 (Current) DevFeed: [Node.js 24.9.0 (Current)]() Original publisher: [Read original article]() Published: 2025-09-25T19:49:30Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [SQLite](), [WebAssembly]() Tags: [cross-platform](), [http](), [javascript](), [node-js](), [race-condition](), [security](), [sqlite](), [webassembly]() ### AI overview Node.js 24.9.0 is a current release with semver-minor additions and fixes across HTTP, SQLite, workers, cryptography, dependencies, diagnostics, documentation, and networking. Notable changes include server-controlled HTTP upgrades, a worker heap profile API, SQLite session and tagged-template support, OpenSSL 3.5.3 updates, and fixes involving IPv6 proxies and diagnostics-channel race conditions. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## exploits.club Weekly Newsletter 85 -Fuzzing KSMBD, Kernel-Hack-Drill, Vibe-Crashing, And More DevFeed: [exploits.club Weekly Newsletter 85 -Fuzzing KSMBD, Kernel-Hack-Drill, Vibe-Crashing, And More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-09-04T15:00:32Z Content type: article Language: en Sources: [exploits.club]() Topics: [Fuzzing/Fuzz testing](), [Linux Kernel](), [vulnerability](), [Security](), [race-condition](), [Exploit](), [Ubuntu]() Tags: [exploits](), [fuzzing](), [kernel](), [linux-kernel](), [race-condition](), [security](), [vulnerability]() ### AI overview The 85th exploits.club weekly newsletter highlights work on fuzzing improvements and vulnerability discovery in ksmbd, including 23 reported bugs. It also covers Kernel-Hack-Drill research on exploiting CVE-2024-50264, a Linux kernel socket race condition resulting in use-after-free, and related exploitation constraints. ### Source excerpt New idea - let AI submit a different, buzzwordy talks to every CFP. What could go wrong? Annnnnnnnyways 👇 In Case You Missed It... 0-day Hunting Strategy with Eugene "Spaceraccoon" Lim - Following the release of his recent No Starch Press book, @spaceraccoonsec will be on tomorrow' ## exploits.club Weekly Newsletter 84 - Stealing Exploits, Competition Misconfigs, Android Physical Memory, And More DevFeed: [exploits.club Weekly Newsletter 84 - Stealing Exploits, Competition Misconfigs, Android Physical Memory, And More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-08-28T15:00:41Z Content type: article Language: en Sources: [exploits.club]() Topics: [Vulnerabilities](), [Exploit](), [ctf](), [race-condition](), [HTTP]() Tags: [analysis](), [ctf](), [cve](), [exploits](), [http](), [race-condition](), [rce]() ### AI overview This newsletter highlights a reproduced in-the-wild CrushFTP exploit involving a race condition triggered by two HTTP requests, a HITCON CTF challenge involving AARCH64 PAC and BTI mitigations and exploitation, and a postmortem of Shellphish's AIxCC submission. ### Source excerpt Someone recently reached out any said it was supposed to be "anyway" instead of....Annnnnnyways 👇 In Case You Missed It... BSides London CFP Open Now - get-em in! Honestly...nothing else really happened this week. I finished Sword Of Kaigen Resources And Write-Ups From This Week: ## exploits.club Weekly Newsletter 83: Windows Kernel and Xbox Exploit Research, Plus an LLM-Assisted Security Tool DevFeed: [exploits.club Weekly Newsletter 83: Windows Kernel and Xbox Exploit Research, Plus an LLM-Assisted Security Tool]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-08-21T15:00:46Z Content type: article Language: en Sources: [exploits.club]() Topics: [Hacking](), [Windows](), [Linux Kernel](), [Large Language Model](), [Code]() Tags: [exploit](), [hacking](), [kernel](), [linux-kernel](), [llms](), [race-condition](), [vulnerability](), [windows]() ### AI overview This issue of the exploits.club weekly newsletter highlights a Phrack anniversary release, a Phrack CTF, research into a Windows kernel vulnerability that was adapted to target Xbox One, and a new LLM-related security analysis tool. The supplied text ends before the tool's details are complete. ### Source excerpt We are getting dangerously close to hacking fueled by PSLs. Get your cozy VS Code color schemes ready...Annnnnnyways 👇 In Case You Missed It... Phrack 4oth Anniversary Release - If you weren't lucky enough to get snag a physical copy from one of the recent cons, the digital ## Scaling Nextdoor's Datastores: Part 2 DevFeed: [Scaling Nextdoor's Datastores: Part 2]() Original publisher: [Read original article]() Author: Tushar Singla Published: 2025-03-19T15:08:32Z Content type: article Language: en Sources: [Nextdoor]() Topics: [Database](), [Replication](), [Django](), [Object-relational mapping](), [consistency](), [race-condition](), [Transactions]() Tags: [consistency](), [database](), [database-scalability](), [django](), [orm](), [race-condition](), [rdbms](), [read-replica](), [replication](), [transactions]() ### AI overview The second installment of Nextdoor's datastore-scaling series examines the consistency problems caused by database read replicas. It describes how routing decisions became obscured by Django ORM abstractions, leading to read-after-write races, and explains how transactions were used as a workaround with negative effects on database load. ### Source excerpt In the second installment of Nextdoor's "Scaling Nextdoor's Datastores" blog series, the Core-Services team discusses challenges faced after implementing database read replicas. Adding read replicas to an existing database is a very common pattern as applications or products evolve to handle increased demand. Typically, the implementation details are hand waved and it's assumed that this strategy will work. However, that is rarely the case, and we'll dive into some more of the intricacies around the implementation. Initial Attempt When replicas were first introduced in the Nextdoor stack, we gave the product engineers latitude to choose when they wanted to have their query routed to a read replica or to the primary. This was done by leveraging the existing routing mechanism in our ORM, Django. This seemed like the right idea at the time because the product engineers had the most context around consistency requirements within their changes and load characteristics of their product feature. Therefore, they would have the best ability to judge which node to send their query to. However, as our business logic evolved and became more feature-rich, product engineers began to add abstraction layers to help abstract complex operations away from business logic. In this design evolution there is a high frequency read, followed by a low frequency conditional write, followed by a read. The read performed after the write should be routed to the primary, but that may get buried in abstractions and this requirement regressed. The explicit routing decisions engineers made became buried and subsequently created a serious problem for users of these abstractions. If one abstraction method was performing a write and another a read, they could not safely be used together due to read-after-write consistency issues. Due to replication lag between the primary and replica databases, a race condition arises when the application attempts to read data from a replica after performing a write. W [Next page]()