Found that some send confirmations time out on the new version because Store nodes run out of connections, which comes from the new Store backfill. Confirmed with two follow-up runs.
bork triage advise --all runs the advisor across all audits in parallel
Each filed finding gets a proof branch bork/proof/<handle>, linked from the issue
Optional incremental mode for spec and security audits, reusing proofs and coverage from earlier runs. Could speed up the audit when changes are small.
Wrote Android e2e tests for 8 user flows (login, seed import, community join and post, contact request, block, pin, group chat); the second user is a status-go instance with no app. 9 PRs close to ready to send upstream
Wrote a script that lists which mobile features have e2e tests and which do not
Open: status-im/status-app#23038 test(e2e): expose login error, composer buttons and join button to accessibility
other notes
Tried an AI code reviewer in GitHub Actions on 5 already-merged PRs; about $0.50 per review (first measurement)
ift-ts:sec:
ift:2026q4-ir-vulma:security-incidents
Keycloak account takeover (2026-11-05) via CVE-2026-18963 (GHSA-4gv3-mc9p-5wqc, unauthenticated reset-credentials bypass). We ran 26.6.2; the fix had shipped in 26.7.2 on 2026-10-19. Worked it with jakubgs, tracked in infra-office#123:
Containment: Keycloak and the oauth proxies shut down; prod BI DB credentials rotated; Keycloak DB to be restored from the pre-attack backup
Gap found: admin-events logging was off in all three realms (logos-co, master, status-test). Admin-side changes can only be found by diffing against a snapshot
ift:2026q4-ir-vulma:vulnerability-management
SSHole (CVE-2026-123158, CVSS 8.1): OpenSSH password-auth bypass on musl builds without PAM
A password of 257–1,024 bytes logs into any account that has no password
Affected: Alpine openssh-server, plus OpenWrt, Buildroot and Yocto. Not affected: glibc distros and Dropbear
Exploit code appeared ~4 h after the 10.6p2 release (2026-11-05); in-the-wild root on a honeypot came within 9 h
Assessed our exposure
Linux kernel TCP/MPTCP use-after-free now has an ID: CVE-2026-98432 (CVSS 9.8)
status-go #8027 (merged 2026-11-02) sets godebug multipathtcp=0, so no status-go binary opens MPTCP listeners (go-waku libp2p host on 0.0.0.0, torrent client, pairing/media/connector servers)
That is defense in depth only. Fixed kernels: 6.1.190 / 6.6.159 / 6.12.113 / 6.18.56 / 5.15.223 / 5.10.272
Three status-go draft advisories. Fixes are by glitchminer in private advisory forks, opened 2026-11-03:
GHSA-3hv7-ccjm-g3hm: community descriptions were stored and cached before the signer was checked. A first-seen community without an owner token now needs the community key as signer
GHSA-j236-6wgg-mxq2: album IDs are set by the sender, so reusing one let a user delete another user’s images. Deletes are now scoped to the same author, and DeletedBy comes from the verified sender
GHSA-53rj-p599-92fp: the connector websocket exposed every connector method. Now:
only connector_callRPC is served
non-web origins are rejected
the dApp url must match the Origin
WCSession.SymKey is no longer serialized
Reviewed:
“Save password” auto-login using platform secure storage: status-app #23020, plus its Keycard conversion cleanup #23065
Glamsterdam fork readiness for gas estimation and signing: status-go #8044, status-app #23080
status-web wallet extension: revoked dApp permissions no longer restored (#1351); full values shown in signing approvals (#1357)
logos-web: CMS user management limited to admins (#276); content PRs verified before save and merge (#271); interactive embeds isolated from the site origin (#278)
logos-tor-module v0.2.0 (2026-11-05): SOCKS port now on by default (#5); modules reach Tor over IPC (#3)
Open: Added Keycloak token verification before admin authentication, including signature, expiry, issuer and client validation: PR
Investigated the Next.js upgrade dependencies: portfolio’s Contentlayer dependencies are unused, while status.app still uses Contentlayer for document metadata and search indexes: Issue
Open: Created the Status security audit tracking issue with 24 findings, separating reproduced issues from findings requiring further verification: Issue
Open: Created the Logos security audit tracking issue with 14 findings and a remediation checklist: Issue
Closed: Prepared a contract fix and regression test for repeated token counting during split-vote finalisation, then closed the PR without merging: PR
The deployed contract remains unchanged; deployment and Directory migration require a separate plan.