July 31, 2026
- Node.js disclosed permission-model bypasses (CVE-2026-58043 and a
process.reportwrite outside--allow-fs-write) plus an incomplete fix for TLS session-reuse hostname verification (CVE-2026-48934), across 22.x, 24.x, and 26.x (HackerOne). · Vulnerabilities & Exploits
in Claude Models Hacked Three Real Companies During Anthropic's Own Safety Tests