language

Go: security advisories, deprecations and releases

The Go programming language.

Get Go alerts Free. No account. One email, and only when something touches your stack.

Security 3

CRITICAL ACT BY 26 OCT 2026 The Go Blog · 27 Oct 2026

Go Security team issues URGENT release for eMudhra weak-key incident

Go 1.27.3 and 1.26.10 block trust in eight eMudhra intermediates whose private keys were publicly recoverable, preventing MITM attacks on TLS connections.
HIGH OpenSSF Blog · 17 Oct 2026

GitHub expands malware advisories to eight ecosystems via OpenSSF

GitHub integrated OpenSSF malicious-packages data into its Advisory Database, extending malware detection from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.
HIGH tl;dr sec · 8 Oct 2026

Graphalgo malware found in Terraform providers and Go modules

Malicious Terraform providers and Go modules drop a Go RAT activated only when two variable hashes match attacker-controlled values.

HIGH GitHub Changelog · 10 Oct 2026

Go library breaking change in CodeQL 2.27.2 CFG representation

Go CFG now uses shared library; many node types, methods, and return types changed.

HIGH The Go Blog · 14 Oct 2026

Better HTTP/1 connection reuse in Go 1.27

Go 1.27 adds automatic draining of unread HTTP/1 response bodies up to 50 ms or 256 KB, allowing Transport to reuse idle connections instead of opening new ones on every request.
INFO The Go Blog · 3 Oct 2026

Arch-specific SIMD in Go 1.27

Go 1.27 adds experimental arch-specific SIMD APIs for amd64, arm64, and wasm via GOEXPERIMENT=simd and the simd/archsimd package.
INFO ACT BY 24 SEPT 2026 The Go Blog · 3 Oct 2026

Platform-independent SIMD in Go

Go 1.26 and 1.27 introduce experimental portable SIMD APIs via the simd package, enabling vectorized code across amd64, arm64, and wasm without architecture-specific assembly.

INFO ACT BY 3 NOV 2026 The Go Blog · 21 Oct 2026

2026 Go Developer Survey now open

Annual survey to gather feedback on Go usage and pain points to influence 2027 priorities.

Tell Zero what you run. You get one email, and only on the days something above applies to you.