IBM released a major security bulletin, resolving twenty-five security flaws. These critical IBM DataStage vulnerabilities allow authenticated attackers to write files and execute arbitrary code. The advisory states, "Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data." Why It Matters Industry estimates show thousands of global organizations use IBM Cloud Pak for Data to run enterprise analytics pipelines.

TL;DR PHP Composer, the main dependency manager for the language, patched three security flaws. The most serious, CVE-2026-59948, is an arbitrary file write rated CVSS 7.0. A malicious package can write files outside your project and run code outside the Composer project's context. The fixes ship in Composer 2.10.2 and 2.2.29. The maintainers report no evidence of exploitation. Why it matters…

A critical flaw in the Feast Feature Server carries a CVSS score of 9.1. The bug, tracked as CVE-2026-23537, sits in the /save-document endpoint. It lets an unauthenticated attacker write arbitrary JSON files to disk. Why This Feast Feature Server Flaw Matters Feast is a widely used open-source feature store for machine learning. Teams rely on it to serve data for model training and online inference.