← All security news
SecurityPatchHIGH

Update Git: 2.56.1 fixes six flaws, including CVE-2026-111760, which lets a malicious repository run code when you clone it with submodules

· 1 min read

Git 2.56.1 and backports for 2.50–2.55 fix six vulnerabilities released on 10 November 2026. The worst can run attacker code during a recursive clone. GitHub.com is patched; Enterprise Server needs an upgrade. No exploitation is reported.

Git

The Git project released Git 2.56.1 on 10 November 2026 to fix six security vulnerabilities, with backports in 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. GitHub says the fixes are already deployed on github.com and GitHub Enterprise Cloud, and that GitHub Desktop, the GitHub Copilot app, Codespaces and Actions are getting the patched Git. GitHub Enterprise Server admins should upgrade to 3.19.15, 3.20.11, 3.21.9 or 3.22.4.

The most serious bug, CVE-2026-111760 (CVSS 8.0 according to SecurityOnline), is in index handling: an overlong path passes validation under one name and is written under a shorter one. An attacker can use this to replace a submodule's .git file with a symlink to a directory holding malicious config or hooks, so code can run during a recursive clone (git clone --recurse-submodules).

The other five:

  • CVE-2026-113408: when you clone an empty repository over protocol v2, a malicious server can send a HEAD target with path-traversal parts and make Git write outside the refs directory.
  • CVE-2026-114467: merging a tag with more than two GPG signatures can corrupt the stack; hosting services that merge for users are affected too.
  • CVE-2026-105437: a size overflow in very large merges with many conflicts can corrupt the heap (CVSS 7.5 per SecurityOnline).
  • CVE-2026-114469: a small compressed binary patch can expand past Git's ~1 GiB limit and crash Git.
  • CVE-2026-114466: three git fast-import features could read or write arbitrary files from an untrusted stream; they are now refused unless you pass --allow-unsafe-features.

No exploitation in the wild and no public exploit code have been reported. The advisories do not name who found the bugs.

More news

PHP
VulnerabilityCRITICALEXPLOITED IN THE WILD

CISA confirms PHP2Shell is exploited; US agencies must patch by 29 October

The two PHP core flaws fixed on 21 October are now in CISA's Known Exploited Vulnerabilities catalog, and JPCERT/CC reports public exploit code and attack traffic.

· CVE-2026-109618 · CVE-2026-109619
Microsoft Windows, Office, Exchange
PatchHIGHEXPLOITED IN THE WILD

November Patch Tuesday: Microsoft fixes 1,093 flaws, including an Outlook zero-day that leaks your NTLM hash and is already exploited

Microsoft's 10 November updates fix 1,093 CVEs, 63 of them critical. One, Outlook spoofing flaw CVE-2026-124194, was exploited as a zero-day to expose NTLMv2 hashes. Exchange, Active Directory, SharePoint and VS Code also get serious fixes.

· CVE-2026-124194 · CVE-2026-118207 · CVE-2026-118146 · CVE-2026-119952 · CVE-2026-120002 · CVE-2026-121662 · CVE-2026-121663
Notion / Fireworks AI
IncidentMEDIUM

Notion AI chats exposed in a breach at its AI vendor Fireworks; under 1% of workspaces affected, and pasted keys should be rotated

Notion says some Notion AI chat sessions may have been exposed after attackers got into Fireworks AI, which ran models for it. Fewer than 1% of workspaces are affected; Notion has cut Fireworks off and paused its Insights feature.