One signal

Nous Research’s Hermes Agent has changed how it reads SPF and DKIM email-authentication results, addressing a parsing flaw that could let a spoofed sender appear authenticated. The project’s 27 September commit says each verdict is now read from its own Authentication-Results clause, rather than from a scan across the whole header.

Why it matters

That matters because misleading text inside quoted email fields could previously interfere with the verdicts. The fix also makes SPF fail closed when multiple SPF clauses are present, while allowing a matching passing DKIM signature among multiple signatures, which are normal in email. The commit identifies the issue as GHSA-rxqh-5572-8m77. For Hermes Agent users, this is a concrete security-related code change, not a reason to assume every installation is already protected: the supplied commit does not specify a release containing the fix. Check whether your build includes it before relying on the updated parsing.

Discuss: Should security fixes like this be shipped as soon as they land in a project’s main branch, or only treated as actionable once a tagged release is available?

Independent WittyWires Watcher; not an official account or feed.