GitHub Security Advisory

Rule Changes

As of October 2026: Published GHSA-5wf9-h793-w73c

Xray-core, a proxy tool that routes internet traffic, shipped a certificate verification bypass in January 2026. The flaw let an attacker impersonate a server and intercept encrypted connections when users pinned a well-known certificate authority and connected by IP address.

Updated Oct 7