Project
Docker container packaging Chromium and LibreOffice behind an HTTP API for self-hosted document conversion.
Gotenberg's 8.30.1 patch validated metadata keys but not values, so CVE-2026-40281 lets unauthenticated callers move files as root. The dev.to write-up of the bug does not name a fixed release, so operators have no confirmed version to move to.
Reality
Lumen's Black Lotus Labs found a cryptominer on more than 3,400 servers, mostly running vulnerable AI services. Each poem edit moves the hosts to a new control server, so patching and closing public ports are the controls a server owner holds.
Reality
Lumen's Black Lotus Labs says the PoeLLM cryptomining botnet has compromised more than 2,100 servers, many running exposed LiteLLM or Ollama. Each host it takes then mines and scans for the next, so an AI server left open to the internet is attack surface to lock down.
Perspective Coverage
6 publishersReality
The renderer was archived in January 2023 and last packaged in May 2023 for Debian 12 and Ubuntu 22.04. The bill arrives on your next base-image bump, disguised as three unrelated bugs.
Reality
An archived binary with an SSRF advisory and no fixed version turns a patch ticket into a template re-approval project. Picking the replacement engine is the cheap part.
Reality