PGSTY SILO Blog
-
Silo 20260417 Released
Published: 2026-04-17 · Version: RELEASE.2026-04-17T00-00-00Z This release focuses on security hardening and compatibility tightening. It bundles fixes across OIDC, LDAP STS, S3 Select, replication metadata handling, unsigned-trailer flows, the …
Published: 2026-04-17 · Version: RELEASE.2026-04-17T00-00-00Z This release focuses on security hardening and compatibility tightening. It bundles fixes across OIDC, LDAP STS, S3 Select, replication metadata handling, unsigned-trailer flows, the …
-
MinIO Fork, Promise Kept
Two months ago in “MinIO is Dead, Long Live MinIO,” I promised I’d keep the MinIO fork patched. The recurring objection on HN is fair: can one person actually maintain something like this? The real answer isn’t clicking fork. It’s what happens when …
Two months ago in “MinIO is Dead, Long Live MinIO,” I promised I’d keep the MinIO fork patched. The recurring objection on HN is fair: can one person actually maintain something like this? The real answer isn’t clicking fork. It’s what happens when …
-
CVE-2026-41145: Unsigned-Trailer Query Authentication Bypass
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: f444b6f37 GitHub advisory: GHSA-hv4r-mvr4-25vw Before f444b6f37, query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER upload while the …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: f444b6f37 GitHub advisory: GHSA-hv4r-mvr4-25vw Before f444b6f37, query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER upload while the …
-
CVE-2026-40344: Snowball Auto-Extract Authentication Bypass
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: efb6e5b00 GitHub advisory: GHSA-9c4q-hq6p-c237 Snowball’s PutObjectExtractHandler (X-Amz-Meta-Snowball-Auto-Extract: true) previously omitted the …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: efb6e5b00 GitHub advisory: GHSA-9c4q-hq6p-c237 Snowball’s PutObjectExtractHandler (X-Amz-Meta-Snowball-Auto-Extract: true) previously omitted the …
-
CVE-2026-39414: Oversized S3 Select Records and a SIMD Bypass
Status: Released; second-round fix completed in June Initial fix release: RELEASE.2026-04-17T00-00-00Z Complete fix release: RELEASE.2026-06-18T00-00-00Z Fix commits: 3252d5b, 5dc705936 (fd69c89) GitHub issue: pgsty/silo#25 Our initial April patch …
Status: Released; second-round fix completed in June Initial fix release: RELEASE.2026-04-17T00-00-00Z Complete fix release: RELEASE.2026-06-18T00-00-00Z Fix commits: 3252d5b, 5dc705936 (fd69c89) GitHub issue: pgsty/silo#25 Our initial April patch …
-
CVE-2026-34204: Replication Metadata Injection
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: 56fa63b GitHub issue: pgsty/silo#24 Before 56fa63b, ordinary PutObject and CopyObject requests could smuggle client-supplied X-Minio-Replication-* headers into …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: 56fa63b GitHub issue: pgsty/silo#24 Before 56fa63b, ordinary PutObject and CopyObject requests could smuggle client-supplied X-Minio-Replication-* headers into …
-
CVE-2026-33419: LDAP STS Enumeration and the Throttling Chain
Status: Released, followed by two rounds of hardening First containing release: RELEASE.2026-04-17T00-00-00Z Complete correction: RELEASE.2026-06-18T00-00-00Z Fix commits: 3b950f8, 18b712d, 9e10f6d, f441108, 5e40665 GitHub issue: pgsty/silo#23 The …
Status: Released, followed by two rounds of hardening First containing release: RELEASE.2026-04-17T00-00-00Z Complete correction: RELEASE.2026-06-18T00-00-00Z Fix commits: 3b950f8, 18b712d, 9e10f6d, f441108, 5e40665 GitHub issue: pgsty/silo#23 The …
-
CVE-2026-33322: OIDC JWT Algorithm Confusion
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Affected entry points: AssumeRoleWithWebIdentity, AssumeRoleWithClientGrants Fix commit: d24f449 GitHub issue: pgsty/silo#22 The previous OIDC implementation in …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Affected entry points: AssumeRoleWithWebIdentity, AssumeRoleWithClientGrants Fix commit: d24f449 GitHub issue: pgsty/silo#22 The previous OIDC implementation in …
-
CVE-2026-32285: The jsonparser Advisory That Required No Patch
Status: Closed without a code change GitHub issue: pgsty/silo#26 Referenced upstream commit: c1a49490 (CVE-2025-62506) The initial assessment of CVE-2026-32285 assumed that the repository might still carry a vulnerable version of …
Status: Closed without a code change GitHub issue: pgsty/silo#26 Referenced upstream commit: c1a49490 (CVE-2025-62506) The initial assessment of CVE-2026-32285 assumed that the repository might still carry a vulnerable version of …
-
Silo 20260325 Released
Published: 2026-03-25 · Version: RELEASE.2026-03-25T00-00-00Z This is a maintenance release centered on packaging, stability, and security disclosure. It improves the shipping artifacts, fixes an LDAP TLS regression, and explicitly documents the …
Published: 2026-03-25 · Version: RELEASE.2026-03-25T00-00-00Z This is a maintenance release centered on packaging, stability, and security disclosure. It improves the shipping artifacts, fixes an LDAP TLS regression, and explicitly documents the …
-
Silo 20260321 Released
Published: 2026-03-21 · Version: RELEASE.2026-03-21T00-00-00Z This maintenance release is built around the Go 1.26.1 upgrade and a broad dependency refresh. Beyond stricter compiler and linter compatibility fixes, it also delivers the most …
Published: 2026-03-21 · Version: RELEASE.2026-03-21T00-00-00Z This maintenance release is built around the Go 1.26.1 upgrade and a broad dependency refresh. Beyond stricter compiler and linter compatibility fixes, it also delivers the most …
-
Silo 20260314 Released
Published: 2026-03-14 · Version: RELEASE.2026-03-14T12-00-00Z This release switches the project to the community-maintained Console fork and performs a sizeable dependency refresh to establish the base for the later Go 1.26.x maintenance releases. …
Published: 2026-03-14 · Version: RELEASE.2026-03-14T12-00-00Z This release switches the project to the community-maintained Console fork and performs a sizeable dependency refresh to establish the base for the later Go 1.26.x maintenance releases. …
-
Silo 20260214 Released
Published: 2026-02-14 · Version: RELEASE.2026-02-14T12-00-00Z This early infrastructure-focused community release restores the embedded Console, introduces GitHub CI/CD, and lifts the Go baseline to 1.26.0, which also absorbs a batch of security …
Published: 2026-02-14 · Version: RELEASE.2026-02-14T12-00-00Z This early infrastructure-focused community release restores the embedded Console, introduces GitHub CI/CD, and lifts the Go baseline to 1.26.0, which also absorbs a batch of security …
-
MinIO Is Dead, Long Live MinIO
MinIO’s open-source repo has been officially archived. No more maintenance. End of an era — but open source doesn’t die that easily. I created a MinIO fork, restored the admin console, rebuilt the binary distribution pipeline, and brought it back to …
MinIO’s open-source repo has been officially archived. No more maintenance. End of an era — but open source doesn’t die that easily. I created a MinIO fork, restored the admin console, rebuilt the binary distribution pipeline, and brought it back to …
-
Silo 20251203 Released
Published: 2025-12-15 · Version: RELEASE.2025-12-03T12-00-00Z This is the earliest traceable community release, establishing the community packaging and distribution baseline. Major Changes Build the community packaging flow around minio/pkger. …
Published: 2025-12-15 · Version: RELEASE.2025-12-03T12-00-00Z This is the earliest traceable community release, establishing the community packaging and distribution baseline. Major Changes Build the community packaging flow around minio/pkger. …
-
MinIO Is Dead. Which Next?
MinIO announced maintenance mode two days ago. I ranted in “MinIO Is Dead” and immediately got flooded with “so what now?” The usual suspects: Ceph, RustFS, SeaweedFS, Garage. I packaged all of them for Linux (RPM/DEB) and ran them through the …
MinIO announced maintenance mode two days ago. I ranted in “MinIO Is Dead” and immediately got flooded with “so what now?” The usual suspects: Ceph, RustFS, SeaweedFS, Garage. I packaged all of them for Linux (RPM/DEB) and ran them through the …
-
MinIO is Dead
December 3, 2025 was a day to mark in open-source software history. MinIO’s team updated the project status on GitHub, announcing the MinIO open-source project was entering “maintenance mode.” This basically declared the death of MinIO as an …
December 3, 2025 was a day to mark in open-source software history. MinIO’s team updated the project status on GitHub, announcing the MinIO open-source project was entering “maintenance mode.” This basically declared the death of MinIO as an …
-
CVE-2025-62506: Session-Policy Privilege Escalation
Status: Inherited and released First SILO community release: RELEASE.2025-12-03T12-00-00Z Upstream fixed release: RELEASE.2025-10-15T17-29-55Z GitHub advisory: GHSA-jjjj-jwhf-8rgr Upstream fix: minio/minio#21642 A service account or STS account …
Status: Inherited and released First SILO community release: RELEASE.2025-12-03T12-00-00Z Upstream fixed release: RELEASE.2025-10-15T17-29-55Z GitHub advisory: GHSA-jjjj-jwhf-8rgr Upstream fix: minio/minio#21642 A service account or STS account …