live wire
▸AI · EAGLE-4 0.1.4 fixes multi-GPU vLLM collective ordering during startupEAGLE-4▸SECURITY: Apache Camel 4.23.0, 4.22.2 and 4.18.5 fix eight component vulnerabilitiesApache Camel▸AI · Red Hat shows DRA doubles llm-d KV-cache throughput by aligning GPUs and RDMA NICsRed Hat Developer▸Red Hat Developer Hub 1.9.10 ships as a Critical security updateRed Hat errata▸OpenShift Dev Spaces 3.31 adds live editor switching and DevWorkspace Operator 1.0Red Hat documentation▸OpenShift Pipelines 1.24.1 tightens Manual Approval Gate RBAC and approval integrityRed Hat release notes▸AI · Red Hat survey: 97% of UK CIOs trust agent security, but 43% can trace data flowsRed Hat▸JAVA · IBM and Kaggle launch a living benchmark for agentic Java framework migrationsIBM Research▸AI · Red Hat tests policy-derived data controls for AI agentsRed Hat▸Apache Camel pattern turns routes into bounded LLM tools and MCP servicesRed Hat Developer▸Atos tunes small models on OpenShift AI for structured German-language analysisRed Hat Developer▸Red Hat publishes checklist for evaluating third-party OpenShift applicationsRed Hat Developer▸SECURITY · OpenShift 4.21.40 patches OpenSSL, OpenSSH and PCRE2 flawsRed Hat Product Security▸SECURITY · Apache Camel fixes A2A webhook SSRF gap in 4.22.2 and 4.23.0 (Oct. 23)Apache Camel▸AI · EAGLE-4 0.1.4 fixes multi-GPU vLLM collective ordering during startupEAGLE-4▸SECURITY: Apache Camel 4.23.0, 4.22.2 and 4.18.5 fix eight component vulnerabilitiesApache Camel▸AI · Red Hat shows DRA doubles llm-d KV-cache throughput by aligning GPUs and RDMA NICsRed Hat Developer▸Red Hat Developer Hub 1.9.10 ships as a Critical security updateRed Hat errata▸OpenShift Dev Spaces 3.31 adds live editor switching and DevWorkspace Operator 1.0Red Hat documentation▸OpenShift Pipelines 1.24.1 tightens Manual Approval Gate RBAC and approval integrityRed Hat release notes▸AI · Red Hat survey: 97% of UK CIOs trust agent security, but 43% can trace data flowsRed Hat▸JAVA · IBM and Kaggle launch a living benchmark for agentic Java framework migrationsIBM Research▸AI · Red Hat tests policy-derived data controls for AI agentsRed Hat▸Apache Camel pattern turns routes into bounded LLM tools and MCP servicesRed Hat Developer▸Atos tunes small models on OpenShift AI for structured German-language analysisRed Hat Developer▸Red Hat publishes checklist for evaluating third-party OpenShift applicationsRed Hat Developer▸SECURITY · OpenShift 4.21.40 patches OpenSSL, OpenSSH and PCRE2 flawsRed Hat Product Security▸SECURITY · Apache Camel fixes A2A webhook SSRF gap in 4.22.2 and 4.23.0 (Oct. 23)Apache Camel
upstreambeat.ai
newsSECURITY

Developer Hub 1.9.10 security update replaces hub and operator images

Red Hat’s Critical advisory covers 32 CVEs and publishes new digests for the Developer Hub application, operator and operator bundle.

By The News Desk· Oct 28, 2026the quick take — two AI hosts go live when you do

Red Hat has issued a Critical security advisory for Red Hat Developer Hub 1.9.10, replacing the application image and both operator artifacts used to install and manage the product.

RHSA-2026:91651, issued October 28, lists 32 CVE identifiers. The fixed artifacts are rhdh-hub-rhel9, rhdh-rhel9-operator and rhdh-rhel9-operator-bundle; Red Hat publishes a new SHA-256 digest for each image in the advisory.

What operators need to change

The scope matters because this is not only an application-container refresh. The advisory replaces the Developer Hub hub image, the operator image and the operator bundle. Administrators updating affected deployments should therefore verify that their supported update path has pulled the new digest for all three artifacts rather than checking only the running hub image.

Red Hat identifies the product build as Developer Hub 1.9.10 and describes the update as containing security fixes. The advisory’s CVE list spans dependencies used across the shipped application and operator images, which is why the artifact-level replacement information is more actionable than treating the notice as a single-component patch.

The Critical label applies to the Red Hat product advisory as a whole; it should not be read as a claim that every listed CVE has an individual Critical rating. For example, Red Hat’s record for CVE-2026-111943, one of the listed issues, rates that Go crypto/x509 certificate-validation flaw Important and assigns it a CVSS 3.1 base score of 6.8. Red Hat says the flaw could allow a network-positioned attacker with certificates derived from distrusted intermediate authorities to conduct a man-in-the-middle attack.

Practical next step

Developer Hub administrators should use Red Hat’s listed image digests as the verification point after updating. That check should cover the hub deployment and the operator installation state, including its bundle, because the advisory supplies fixed builds for each.

This is the second step in the desk’s coverage of the release: the wire carried the advisory when it landed, while this report spells out the deployment scope and the distinction between the product-level severity and the ratings of individual included flaws.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk