Cyber and security
Filter by type: All140
Prototype pollution in Tampermonkey via the internationalized @antifeature tag
The post by tmctmt describes a prototype pollution flaw in Tampermonkey, tied to how the i18n-enabled @antifeature tag is handled. The impact is limited and requires user interaction.
Ruby regular expression compilation fixes tied to GitLab CVEs
The Ruby project published, on 23 October 2026, fixes to regular expression compilation linked to GitLab CVEs, shared on the oss-sec list.
FCC bans two devices with Huawei-linked HiSilicon chips: how to trace these components in your fleet
The FCC banned a wireless video transmitter and a panel camera made with HiSilicon chips, a Huawei subsidiary. See how to inventory and monitor these components across your infrastructure.
Linux 7.4 merge window: 6,753 changesets already merged
The LWN article reports that the first part of the Linux 7.4 merge window has brought in 6,753 changesets, including new features, cleanups and kernel security fixes, with many more expected.
SANS ISC returns to Infocon Green after PHP-related alert
The SANS ISC raised its Infocon over an emerging situation involving PHP and, on 23 October 2026, returned to Green. Companies running PHP should review versions and update processes.
Smaller kernel stacks for Linux: memory scarcity revives the debate over RAM use
Discussion presented at the 2026 Linux Plumbers Conference on reducing the space used by kernel stacks, amid a global shortage of memory chips.
- 1 day ago seclists.org
Incident with eMudhra/emSign CA certificate: what changes for Python on Linux distributions
Post by Eli Schwartz on the oss-sec list, dated 22 October 2026, explains how certifi packages from Linux distributions use the system certificate store and why this affects the trust path of Python applications.
- 2 days ago ubuntu.com
Ubuntu advisory USN-8954-1: zlib flaw with heap buffer overflow risk
Ubuntu Security published advisory USN-8954-1 on a flaw in how the zlib library handles non-blocking write operations, which can lead to heap buffer overflow, denial of service or arbitrary code execution.
- 2 days ago therecord.media
Toronto Crime Stoppers suspends operations after tip data breach
The Toronto unit of Crime Stoppers has suspended operations, broken with its national association and published a timeline of what it knew about the data breach, according to the article by The Record.
- 2 days ago seclists.org
QPACK amplification attacks against HTTP/3 servers (Header Accordions)
The post by Fox-IO, relayed on the oss-sec list by Alan Coopersmith on 21 October 2026, describes QPACK amplification attacks against HTTP/3 servers, called Header Accordions.
- 2 days ago blog.talosintelligence.com
eMudhra intermediate certificates with weak private keys enable certificate forgery
Cisco Talos, in its advisory on eMudhra, reported eight intermediate certificates with low-entropy private keys, allowing forgery of TLS and code-signing certificates. Some were blocked by Chrome, Mozilla, Apple and Microsoft.
- 2 days ago seclists.org
CVE-2026-109619: remote code execution in PHP and the affected version range
Advisory on remote code execution in PHP 8.2 to 8.5, fixed in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A reply on the oss-sec list warns not to read the affected range as limited to versions 8.2 to 8.5.
LWN.net: eMudhra CA compromise, PHP RCEs and Node.js and musl vulnerabilities in focus
The weekly LWN.net edition of October 22, 2026 covers the eMudhra CA compromise, remote code execution flaws in PHP, vulnerabilities in Node.js and musl, and kernel, Rust and NFS topics. Companies can turn these alerts into inventory, patching and monitoring controls.
Node.js fixes Brotli RCE and musl discloses out-of-bounds write
Node.js security updates fix a remote code execution flaw tied to Brotli compression. The musl libc project disclosed a potentially exploitable out-of-bounds write.
- 3 days ago therecord.media
US$ 10 million initiative aims to strengthen cybersecurity of resource-limited utilities
Three technology companies launched a US$ 10 million private-sector initiative to support up to 500 resource-limited utilities in strengthening their cybersecurity, according to the report from The Record.
- 3 days ago therecord.media
Meta faces a US$ 25 billion penalty over privacy ruling in New Mexico
The Record reports that Meta faces a US$ 25 billion penalty after a privacy decision in New Mexico, a case that renews the financial effects of the Cambridge Analytica scandal.
PHP fixes vulnerabilities after months of delay and exposes flaws in its decision process
The PHP Foundation published an analysis of the vulnerabilities disclosed in the security release and explains why the fix took months, citing technical deadlocks, a small team and consensus-based decisions.
- 3 days ago ubuntu.com
Ubuntu advisory USN-8951-1 covers c-ares DNS flaws that lead to denial of service
The Ubuntu advisory groups four vulnerabilities in c-ares, a DNS resolution library, that can cause denial of service and, in one case, arbitrary code execution on affected LTS releases.
- 3 days ago ubuntu.com
Ubuntu removes two root certificates from NSS after intermediate compromise
The USN-8947-1 advisory from Ubuntu Security updates NSS to remove the emSign ECC Root CA - G3 and Comodo AAA Services root certificates, after intermediate certificates issued under them were compromised.
- 3 days ago isc.sans.edu
Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): what to do now
The SANS ISC raised its infoCon to yellow after PHP announced a critical update, with CVSS 9.4 and preliminary proof-of-concept exploits available before the patch.
- 3 days ago seclists.org
Auditing private keys of certificate authorities after the eMudhra incident
Discussion on the oss-sec mailing list about auditing private keys of root and intermediate certificates after the compromise of eMudhra intermediaries, focusing on potentially weak keys.
- 3 days ago seclists.org
eMudhra intermediate certificates still present in NSS 3.131.1
A reply on the oss-sec list by Solar Designer asks whether compromised eMudhra intermediate certificates are still cross-signed and notes they remain in NSS 3.131.1, which removes the emSign certificates.
- 3 days ago ubuntu.com
Ubuntu removes CA certificates after eMudhra intermediate compromise
Ubuntu published advisory USN-8944-2, which removes two certificate authority certificates from ca-certificates packages on LTS releases and updates the CA list to Mozilla's version 2.90.
- 4 days ago seclists.org
eMudhra intermediate certificate compromise and removal of the Comodo AAA Services root
A post on the oss-sec list by Jeffrey Walton states that the browser removal of the Comodo AAA Services root is unrelated to the eMudhra incident. The root, issued in 2004, exceeds the 15-year maximum in current CA/Browser Forum Baseline Requirements.
- 4 days ago therecord.media
FBI warns: SafePay ransomware ranks among the most active, with over 600 victims since 2024
The FBI, UK and German agencies say the SafePay group targets companies and critical infrastructure through guessed passwords, vulnerability exploitation and phishing.
- 4 days ago seclists.org
Upcoming critical PHP security release announced: prepare inventory and updates
An advisory posted to the oss-sec list by Alan Coopersmith on 20 October 2026 announces an upcoming critical security release of PHP, referencing the project's official archive. Teams running PHP should prepare before the release is published.
SUSE moves to disable setuid binaries across the whole Linux system
The SUSE security team is working to disable setuid system-wide, a measure that still faces obstacles, according to the LWN article on Thorsten Kukuk's talk at All Systems Go! 2026.
- 4 days ago therecord.media
Breach at ETS exposes data of public school students in California
The California Department of Education alerted public school students that data was stolen in a months-long breach at the assessment provider ETS, Educational Testing Service.
- 5 days ago therecord.media
ConnectWise suspends Cloud Backup after unauthorized access tied to supply chain attack
ConnectWise suspended its Cloud Backup service after confirming unauthorized access to the service environment. Companies relying on third-party managed backup need to review dependencies, credentials and recovery plans.
- 5 days ago seclists.org
Cpanel::JSON::XS for Perl: 15 CVEs fixed from version 4.80 onward
The oss-sec advisory, published on 19 October, describes flaws in Cpanel::JSON::XS for Perl before version 4.80, including data leakage, stack exhaustion and type confusion during JSON decoding.
- 5 days ago seclists.org
CVE-2026-86467: CSRF in the SAML login of the Apache Airflow Amazon provider
The moderate advisory, published on October 19, 2026, describes a CSRF flaw in the SAML login flow of the AWS auth manager in Apache Airflow Amazon provider versions before 9.38.0. An unauthenticated attacker can log a victim into the attacker's account.
- 5 days ago therecord.media
Judge rejects WhatsApp request to hold spyware maker in contempt
According to The Record's article, a federal judge denied WhatsApp's request to hold NSO Group in contempt for allegedly violating a 2025 injunction barring use of the messaging app to spread spyware, ruling that the company had not provided enough information.
Kernel 7.3 sets records with LLM-assisted contributions
The LWN article on the kernel 7.3 development cycle, released on October 18, reports record-breaking statistics, the weight of LLM-assisted contributions and an analysis of automated patch review.
- 5 days ago research.checkpoint.com
Check Point report: breaches, attacks and AI risks
The October 19, 2026 report covers data breaches, attacks on connected systems and AI security risks, including two patched vulnerabilities in the LiteLLM gateway.
- 6 days ago ubuntu.com
Ubuntu advisory fixes several RabbitMQ Server flaws, including TLS client authentication bypass
The USN-8933-1 advisory from Ubuntu Security fixes RabbitMQ Server flaws ranging from XSS and CORS issues to a TLS client authentication bypass and denial-of-service conditions. See what a team can do to reduce exposure.
- 6 days ago isc.sans.edu
YARA Rule for Detecting Orphaned VBA Projects in DWG Files
On 18 October 2026, the SANS Internet Storm Center published a YARA rule for identifying orphaned VBA projects inside DWG files, a check that can be built into the intake of engineering files.
Vendor hooks in the Android kernel and the divergence from mainline
LWN article on the 2026 Linux Plumbers Conference session that discussed vendor hooks, the preferred way to keep Android changes outside the mainline kernel tree.
- 6 days ago ubuntu.com
Azure Linux kernel: 11 CVEs fixed by Ubuntu advisory USN-8922-2
Ubuntu Security published advisory USN-8922-2 with fixes for the Azure Linux kernel, covering eleven CVEs in subsystems such as IPv6 networking, Netfilter, NFS, Overlay and VFIO. Companies running cloud workloads need inventory and traceable patch application.
- 6 days ago isc.sans.edu
Smaller AI agents, smaller impact: limiting what AI can do
The SANS ISC post argues that the cybersecurity sector may be approaching AI security the wrong way and proposes narrowing agents' scope to contain the impact of failures.
- 6 days ago therecord.media
Attack on a service provider halts bankruptcy notices at federal courts
According to The Record's article, published on October 15, 2026, a cyberattack on a government service provider stopped all production of bankruptcy notices at federal bankruptcy courts. The case shows the risk of third-party dependencies in critical processes.
Let's assess your project
I reply with scope and a proposal.