Check exposure:Spring for GraphQL CVE-2026-59285: Pagination RCE Risk. Teams running Spring for GraphQL 2.0.0 through 2.0.4 (Spring Boot 4.0.x before 4.0.8, or 4.1.0) with Jackson 2.x JSON handling and at least one paginated (Connection) field.
Check exposure:arrayref, internment, append-only-vec: Rust Crates Hijacked. Rust developers and CI pipelines that ran cargo update, cargo add, or an unlocked build that pulled arrayref, internment or append-only-vec between about 07:11 and 09:25 UTC on August 20, 2026.
Do you run any of these? TrueConf Server. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-23.
npm: 1 critical advisory (@whyour/qinglong). Check with npm audit (or: npm ls <package>).
Go: 1 critical advisory (github.com/dgraph-io/dgraph/v25). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Only Spring Boot 4 apps on Spring for GraphQL 2.0.0-2.0.4 that use Jackson 2.x and expose paginated Connection fields are at risk; if that is you, take the 2.0.5 upgrade now.
Must act: Teams running Spring for GraphQL 2.0.0 through 2.0.4 (Spring Boot 4.0.x before 4.0.8, or 4.1.0) with Jackson 2.x JSON handling and at least one paginated (Connection) field.
Can relax: Spring Boot 3.x apps on Spring for GraphQL 1.x (outside the listed range), GraphQL APIs with no Connection fields, and apps not using Jackson 2.x; upgrade on a normal cycle.
Find the resolved spring-graphql version in every service (mvn dependency:tree or gradle dependencyInsight).
Upgrade to Spring Boot 4.0.8 / 4.1.1 or later, or override spring-graphql.version to 2.0.5.
Check whether the app uses Jackson 2.x (com.fasterxml.jackson.core:jackson-databind) and exposes Connection fields; prioritize those services.
Only builds that resolved the three poisoned releases during a roughly two-hour window on August 20, 2026 ran the payload, but any machine that did should be treated as compromised.
Must act: Rust developers and CI pipelines that ran cargo update, cargo add, or an unlocked build that pulled arrayref, internment or append-only-vec between about 07:11 and 09:25 UTC on August 20, 2026.
Can relax: Projects whose committed Cargo.lock kept arrayref at 0.3.9 or earlier, internment at 0.8.6 or earlier and append-only-vec at 0.1.8 or earlier and built with --locked; RustSec says most users stayed on older versions.
Search every Cargo.lock for proc-macro1, proc-macro-en, arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9.
Search ~/.cargo/registry/cache, CI caches and vendor/ directories for the deleted .crate files.
Treat any machine or runner that built an affected project as compromised: rotate SSH keys, cloud and CI secrets, crates.io tokens, signing keys and browser-saved passwords.