News · written 13 November 2026. A summary for readers, not technical advice — check the sources at the end for the details.

The Go programming language released Go 1.27.4 and Go 1.26.11 on 10 November 2026, after announcing them five days earlier. The announcement says the releases include 12 security fixes.

Mostly about building code

Eleven of the twelve are in Go's build tools — the go command, cgo, the compiler and the linker. They describe ways that carefully crafted #cgo flags and directives, .syso files or linker inputs in a package could make go build run commands or write files on the computer doing the build. In plain words: building Go code you have not checked — a new dependency, a pull request, a project you just cloned — was riskier than it should be.

The remaining fix is in net/http: a race that could crash an HTTP/1 server.

Eight of the issues were found by the Go Security Team during an internal audit; the others were reported by outside researchers.

What to do

• Update to Go 1.27.4 or Go 1.26.11 from go.dev/dl, or through your package manager once it has them.
• Update your build machines and CI images too — that is where untrusted code is most often built.
• If you ship a Go web server, rebuild it with the new version so the net/http fix is included.

Sources

• Go — Release history: go1.27.4 and go1.26.11 (released 2026-11-10)
• golang-announce — [security] Go 1.27.4 and Go 1.26.11 are released (10 November 2026)

More news and guides at https://jmtechpower.com/articles.