Go 1.27.4 security release: the cgo build fixes and the net/http crash
Go 1.27.4 and Go 1.26.11 came out on 2026-11-10 with 12 security fixes, and they ask for two different jobs. Eleven of the fixes are in the toolchain: building a malicious package could run code on the machine doing the build. The twelfth is in net/http and can crash an HTTP/1 se…