Digest · Wednesday

Security digest: October 1, 2025

2 critical advisories.

Take stock

crates.io (Rust): 1 critical advisory (risc0-zkvm-platform, risc0-zkos-v1compat, risc0-aggregation, risc0-zkvm). Check with cargo audit.
PyPI: 1 critical advisory (pyfory, pyfury). Check with pip-audit (or: pip show <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: pip-audit (or: pip show <package>)

Apache Pyfory python is vulnerable to deserialization of untrusted data CVE-2025-61622 CVSS 9.8 Critical
pyfory >= 0.12.0, < 0.12.3 → fixed in 0.12.3; pyfury >= 0.1.0, <= 0.10.3 → no fix listed

Check: cargo audit

risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read` CVE-2025-61588 CVSS 9.3 Critical
risc0-zkvm-platform < 2.1.0 → fixed in 2.1.0; risc0-zkos-v1compat < 2.1.0 → fixed in 2.1.0; risc0-aggregation < 0.9 → fixed in 0.9; +2 more packages