Snyk: Trust page changed
Snyk added an advisory about an OpenSSH password authentication bypass affecting sshd on musl-based Linux systems without PAM; Snyk says its environments are not impacted. Customers running affected systems should upgrade to OpenSSH 10.6p2 or higher, or set PasswordAuthentication no and restart sshd if they cannot update immediately.
Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.
What changed
Struck in red is what Snyk removed; blue is what they added. Muted text is unchanged context.
2 noise-only block(s) hidden (dates, counters, testimonials, tokens).
Compared with the previous archived version (#13843 to #16314). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).
Archive proof
Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
How the archive is checked, and what it cannot prove.
Before captured
In the 2026-11-03 checkpoint, timestamped by FreeTSA and DigiCert on . Record hash
3bb618ab6c56f20a…After captured
In the 2026-11-06 checkpoint, timestamped by FreeTSA and DigiCert on . Record hash
ec7bb732bfbae47c…
History of this page
Friday, November 6
1 page change
- Content changedPage change
Trust pagechangedthis change
Snyk added an advisory about an OpenSSH password authentication bypass affecting sshd on musl-based Linux systems without PAM; Snyk says its environments are not impacted. Customers running affected systems should upgrade to OpenSSH 10.6p2 or higher, or set PasswordAuthentication no and restart sshd if they cannot update immediately.
Tuesday, November 3
1 page change
- Content changedPage change
Trust pagechanged
Snyk announced it is standardizing repository file retrieval on Workspaces, using temporary Git cloning instead of fetching individual files through SCM providers' HTTP APIs. This changes how Snyk accesses repository contents for analysis; the Trust page also removed detailed text from its Keyv / Cacheable supply-chain compromise update.
Saturday, October 31
1 page change
- Content changedPage change
Trust pagechanged
Snyk’s Trust page now says it is assessing potential impact to its environments and will prioritize remediation of any findings if necessary. The statement does not confirm whether Snyk is affected, so customer exposure remains unconfirmed in this update.
Thursday, October 29
1 page change
- Content changedPage change
Trust pagechanged
Snyk added a security advisory for Brotli CVE-2026-111497 (CVSS 9.2), recommending updates, restarts and container rebuilds. It clarifies that Open Source scanning misses runtimes; customers should also use Unmanaged scanning and Snyk Container to find affected copies. The Klue/Salesforce investigation closing notice and documentation-on-request text were removed.
Thursday, October 22
1 page change
- Content changedPage change
Trust pagechanged
Snyk added a PHP zero-day notice covering CVE-2026-109618 / CVE-2026-109619: critical vulnerabilities (CVSS 9.2) that can allow unauthenticated remote code execution, with PHP security updates released October 21. This is relevant to customers running PHP installations serving web requests. The page also removed the Klue incident summary preview, without indicating resolution.
Cite this
Trust page changed on Snyk’s Trust page, changed 2026-11-06 08:57 UTC (change 5 of 5).
- Title
- Trust page changed
- Vendor
- Snyk
- Date
- URL
- https://rewindex.com/change/p16314