… In this case, reducing the exposure of passwords in memory is a practical step in that direction." The fix is already live in the Edge Canary channel and will be included in the next update for all supported Edge releases build 148 and newer . …
… Successful exploitation enables them to access data beyond the memory buffer via heap corruption, exposing sensitive information or triggering a crash. …
… Instead of sending a response, the server periodically sends tiny WINDOW UPDATE frames to avoid timeouts. In this scenario, the requests are never fully completed, and the allocated memory keeps growing without being freed. …
… In the long term, to mitigate the risk from similar attacks, consider enforcing lockfile-only installs, which should prevent auto/silent package updates. UPDATE 08:36 EST : Added information from Microsoft Threat Intelligence's analysis of a payload delivered via a compromised Mistral AI package. …
… This rotation will require macOS users to update their OpenAI desktop applications before June 12, 2026, as applications signed with the older certificates may not launch or receive updates due to Apple's notarization process. …