Apache

A new essay asks 'What if Jev spoke Arrow?', playing on the Jevons paradox — the idea that making a resource more efficient increases its total consumption — and Apache Arrow, the open in-memory columnar data format. The piece suggests that faster, more efficient data movement through Arrow may fuel rather than curb data processing demand.

A vulnerability tracked as EUVD-2026-91568 has been disclosed in Apache Thrift, the Apache Software Foundation's cross-language RPC framework. The flaw, an infinite loop with an unreachable exit condition in the Python bindings, carries a CVSS v3.1 score of 8.2. Details on affected versions remain incomplete pending an update from the vendor.

A high-severity vulnerability, EUVD-2026-91569, has been catalogued affecting the Lua bindings of Apache Thrift, the cross-language RPC framework maintained by the Apache Software Foundation. The flaw, scored 8.2 out of 10 under CVSS v3.1, involves allocation of resources without limits or throttling combined with inefficient algorithmic complexity, which could allow denial-of-service conditions. The advisory was updated on 2 October 2026.

A vulnerability tracked as EUVD-2026-91330 has been catalogued affecting the Lua component of Apache Thrift, the open-source RPC framework maintained by the Apache Software Foundation. The flaw, scored 8.7 out of 10 under CVSS v3.1, involves allocation of resources without limits or throttling and improper handling of length parameter inconsistency, which could enable denial-of-service conditions.

The Apache Software Foundation has released HTTP Server 2.4.69, a maintenance update that fixes 20 security vulnerabilities in the widely used open-source web server. Admins are being urged to update their installations promptly, as the web server powers a large share of websites worldwide and unpatched flaws can expose servers to attack.