TAG
#web-security
Stories connected through a shared idea, actor, technology or theme.
Next.js ships a coordinated security release for supported branchesThe fixes affect both current and previous maintained release lines. The advisories cover image optimisation, App Router metadata image routes and self-hosted SSG or ISR deployments.→DOMPurify 3.4.15 strengthens XML clobbering defencesThe release adds better clobbering hardening when XML content is involved and includes several smaller hardening and edge-case improvements. It also updates dependencies where possible.→Cloudflare opens BotBase controls for bot and agent operatorsThe update adds a dashboard home with a bot directory, submission history, status explanations, and controls to edit or cancel submissions. It also expands classification around behaviour, content use, and identity while leaving site owners in control of how traffic is handled.→Ars Technica reports a new web-based supply-chain risk for coding agentsArs Technica reported 227 installation commands across more than 100 websites that pointed to unowned executable content in files such as llms.txt and llms-full.txt. The report said Claude, Codex and Hermes agents installed the code, exposing a new route from web documentation to developer workstations and corporate networks.→