Apache

Columnar Tech has published a blog post asking what it would look like if Java worked natively with Apache Arrow, the columnar in-memory data format widely used in analytics. The piece explores how tighter integration between the JVM ecosystem and Arrow's memory model could change data engineering, and it is drawing attention from developers interested in faster data processing.

ChooseALicense.com, a reference site for picking an open source license, is being shared among Linux and open source enthusiasts. The site walks developers through license options such as MIT, GPL and Apache, helping them choose terms for releasing code. It is being passed around in free software communities as a handy resource for projects deciding how to license their work.

A vulnerability tracked as EUVD-2026-91568 has been disclosed in Apache Thrift, the Apache Software Foundation's cross-language RPC framework. The flaw, an infinite loop with an unreachable exit condition in the Python bindings, carries a CVSS v3.1 score of 8.2. Details on affected versions remain incomplete pending an update from the vendor.

A high-severity vulnerability, EUVD-2026-91569, has been catalogued affecting the Lua bindings of Apache Thrift, the cross-language RPC framework maintained by the Apache Software Foundation. The flaw, scored 8.2 out of 10 under CVSS v3.1, involves allocation of resources without limits or throttling combined with inefficient algorithmic complexity, which could allow denial-of-service conditions. The advisory was updated on 2 October 2026.

The Apache Software Foundation has released HTTP Server 2.4.69, a maintenance update that fixes 20 security vulnerabilities in the widely used open-source web server. Admins are being urged to update their installations promptly, as the web server powers a large share of websites worldwide and unpatched flaws can expose servers to attack.

A vulnerability tracked as EUVD-2026-91330 has been catalogued affecting the Lua component of Apache Thrift, the open-source RPC framework maintained by the Apache Software Foundation. The flaw, scored 8.7 out of 10 under CVSS v3.1, involves allocation of resources without limits or throttling and improper handling of length parameter inconsistency, which could enable denial-of-service conditions.

Tencent has open-sourced its large Hy4 770B-parameter AI model under the permissive Apache 2.0 license, while also introducing IQuest-Q1, a much smaller 15B-parameter model aimed at more accessible use. Thai-language tech commentary is highlighting the release, noting the combination of a very large open model and a lightweight companion option for developers.

A vulnerability tracked as EUVD-2026-90762 has been recorded for Apache Camel Quarkus, the Apache Software Foundation's Quarkus extensions for Camel. The flaw, rated 8.6 out of 10 under CVSS v3.1, involves improper restriction of XML external entity references in the XSLT support extension (camel-quarkus-support-xalan). Such issues can allow attackers to read files or make requests from affected systems. The record was updated on 1 October 2026, and security teams are being urged to check whether their deployments use the affected extension.

A new vulnerability, EUVD-2026-90892, has been recorded for the Apache HTTP Server, maintained by the Apache Software Foundation. The flaw involves missing authentication checks in the mod_auth_digest module in versions before 2.4.69, potentially allowing unauthenticated access. Users are advised to update to a patched release. The entry was updated on 1 October 2026.

Las Vegas Metropolitan Police are searching for a suspect in an armed robbery of a business on South Fort Apache Road. Officers responded to the report and are working to identify and locate the person responsible. No further details about injuries, the business involved, or the suspect's description have been released.

A medium-severity vulnerability, EUVD-2026-90763, has been catalogued in Apache APISIX, the open-source API gateway maintained by the Apache Software Foundation. Rated 5.7 out of 10 under CVSS v3.1, the flaw involves the insertion of sensitive information into log files, with unmasked header values potentially being written in cleartext.

Security researchers have disclosed eight vulnerabilities in Apache MINA SSHD, the Java library for SSH connections, that together can allow authentication bypass. The flaws, tracked under CVE identifiers including CVE-2026-94052, CVE-2026-94053 and CVE-2026-77185, affect applications embedding the library. Administrators are urged to upgrade their Java applications promptly to patched versions.

Eleven judges from the Ninth Circuit Court of Appeals have urged the US Supreme Court to take up the Oak Flat case, backing protection for the sacred Apache site in Arizona threatened by a copper mining project. The rare show of judicial support adds pressure on the high court to hear Apache Stronghold's challenge after lower courts refused to block the land transfer.

A cybersecurity observer has published a profile of IP address 103.63.101.24, hosted on Indonesian network AS150273 in Jakarta, dubbing it 'the CVE broker of Jakarta'. The address is said to have launched five attacks targeting known flaws in ThinkPHP, PHPUnit's eval-stdin, and Apache path traversal vulnerabilities CVE-2021-41773 and CVE-2021-42013, using the libredtail-http user agent and encoded traversal sequences seeking a shell.