The Node.js Project plans to publish security updates on or shortly after Wednesday, November 11, 2026, for the 26.x, 24.x, and 22.x release lines. The notice identifies the highest-severity issue addressed in each of the three lines as HIGH, but does not describe the vulnerabilities or provide technical details about their fixes. Its central message is that users of these supported release lines should expect updates and install them when available. The release timing is approximate: packages may appear on November 11 or shortly afterward.
The notice also stresses that end-of-life Node.js versions are affected whenever a security release occurs. Users relying on older versions should therefore move to an up-to-date release, following the project’s published release schedule, rather than assuming unsupported versions are safe. It directs people seeking details on security practices to Node.js’s security policy and explains that vulnerability reports should follow the process in the project’s SECURITY.md file. For ongoing alerts, it recommends the low-volume, announcement-only nodejs-sec mailing list, which covers security vulnerabilities and security-related releases for Node.js and projects maintained in the Node.js GitHub organization.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Brazil’s Credit Guarantee Fund (FGC) reported unauthorized access to personal data in systems used for guarantee payments, but has found no evidence of disclosure, misuse, or financial loss. It restricted access, blocked unauthorized accounts, notified Brazil’s data protection authority, and continues investigating the incident. (fgc.org.br)
Data collected through ads in popular apps gives police a way to track users’ phones. The surveillance relies on advertising technology rather than direct access to a device. (bloomberg.com)
Mark Cuban says Facebook knowingly runs scam ads featuring AI-generated deepfakes. Documents reportedly estimate the platform earns $16 billion from fraudulent ads. (finance.yahoo.com)
Claude Code allegedly sends users’ email addresses to third-party websites in the User-Agent header during web searches. The reported privacy issue prompted a request to remove the behavior entirely. (github.com)
CVE-2026-83844 is listed as a remote code execution vulnerability in MS Paint. The provided page contains no details about affected versions, exploit conditions, or fixes. (cve.org)
A remote code execution vulnerability affects Microsoft Paint. An attacker can exploit it by getting a user to open a specially crafted file in the app. (msrc.microsoft.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.