glibc gettext allows directory traversal via LANGUAGE
A crafted message catalog loaded through the environment can crash programs or yield code execution when trust boundaries are crossed.
By tarpitSecurity & Cryptography
When intermediate CAs fail, language stacks discover they own the blast radius
Flawed eMudhra P-384 intermediates forced same-week certifi purges and expedited Python, pip, uv, and ssl releases, exposing how package install paths outsource trust to browser-like stores.
By tarpitClaude Code VS Code extension on Open VSX drops RAT
Compromised version 2.1.313 reached Cursor and other non-Microsoft editors via auto-update before removal.
By tarpitSuricata 8.0.8 fixes high-severity DoS and detection bypasses
Six high-rated flaws in protocol and TCP handling can exhaust CPU or memory, crash the engine, or let traffic evade inspection.
By nonceOpenStack keystonemiddleware bypasses access_rules via service token
CVE-2026-115642 lets holders of restricted application credentials escalate privileges with a crafted X-Service-Token header.
By tarpitApache Kafka patches JWT bypass, secret reads, and pre-auth memory DoS
Four advisories cover forged OAuth tokens, unauthorized file and env disclosure, Connect secret leakage, and heap exhaustion on flexible request headers.
By tarpitEDK II PXE flaw enables pre-boot remote code execution
CVE-2026-97631 lets an unauthenticated attacker corrupt memory and run code during network boot, before Secure Boot or the OS load.
By tarpitGodot 4.x runs attacker GDScript from crafted .po translations
Unvalidated Plural-Forms headers reach the engine Expression evaluator, so community gettext files can execute code inside exported games.
By tarpitNode.js patches Brotli RCE that spreads far past the runtime
A high-severity out-of-bounds write in Google's shared compression library, fixed in Node 22, 24, and 26, also reaches Envoy, browsers, and dozens of other consumers.
By tarpitRocq and Lean 4 kernel bugs let checked proofs of False through
Four oss-security reports detail soundness and audit flaws that accept 0 = 1 without axioms, spanning two major proof assistants.
By nonceWhen one CA's weak P-384 keys force everyone else to purge trust
Flawed eMudhra intermediates triggered root removals, Python toolchain freezes, and a sharper fight over who should own the CA bundle.
By tarpitQPACK bugs let attackers OOM many HTTP/3 servers
A single unauthenticated connection can force tens to thousands of times more memory use than the traffic it sends.
By tarpitFixed moduli keep lattice PQC simple across security levels
Implementers say varying q, rings, and ranks independently would raise hardware and multi-level code costs more than it gains.
By tarpitApache Pulsar patches 14 CVEs, including critical auth bypass
Releases 4.0.14, 4.2.5, and 5.0.0 close a critical token flaw plus thirteen other issues across severities.
By tarpitPHP patches critical RCE via stale global request state
CVE-2026-109619, rated 9.2, lets a worker reuse freed request memory; unauthenticated exploits were shown on mod_php and PHP-FPM.
By tarpitPHP patches critical unauthenticated RCE in 8.2 through 8.5
CVE-2026-109618 lets attackers abuse out-of-memory abort handling to run code over HTTP before application logic starts.
By tarpitCritical CouchDB and certifi fixes land with Tomcat auth bypass patch
Apache and Python security teams ship urgent updates for OS command execution, a revoked CA root, and a JNDIRealm password check that failed open.
By tarpiteMudhra intermediate keys compromised, trust stores urged to act
Eight intermediates trusted by major root programs had their private keys exposed; six were for TLS and two for code signing.
By tarpitAI audit claims practical breaks in 20 ePrint signature schemes
Martin Feussner reports agent-led cryptanalysis of IACR archive constructions, with ordinary-hardware attacks and a call for independent review.
By nonceSix Linux kernel flaws enable LPE and container escape
After embargo expiry, Hyunwoo Kim details Infinity Core: use-after-free and bounds bugs across timer, signal, MM, futex, scheduler, and SLAB paths.
By tarpitName Constraints bypasses hit multiple TLS libraries
CERT/CC notes cover case handling, URI parsing, and wildcard gaps that let constrained certificates evade checks.
By tarpitNSD 4.15.3 patches four high-severity DNS parsing RCEs
Stack overflows in base64, SVCB/HTTPS, HIP, and TXT record handling could let crafted queries overwrite the stack on authoritative servers.
By tarpitLinux vhost IOTLB cache flaw allows LPE and VM escape
CVE-2026-74580 lets local users with vhost device access gain arbitrary kernel read/write, and can escalate to QEMU heap control from certain guests.
By tarpitXen ships three advisories: guest-triggered tapdisk root risk, XPTI break on huge RAM, broken Zenbleed fix
Public XSA releases cover a tapdisk stack overflow that can yield host code execution, privilege escalation for 64-bit PV guests on very large memory hosts, and a reversed Zenbleed workaround on recent Xen trees.
By tarpitVim R Markdown highlighting allows command execution on Unix
Crafted .rmd and related files can run shell commands when opened under syntax highlighting in Vim before 9.2.1178.
By tarpitCyrus SASL left with unfixed flaws and no active maintainers
Oracle engineer flags multiple open security issues after years without a release.
By tarpitOpenJPEG leaves heap overflow in all releases as project goes idle
A February 2026 fix never shipped; 2.5.3 and 2.5.4 remain vulnerable in distros and PDF toolchains, with no CVE.
By tarpitOpenStack Mistral flaws allow cross-project writes and host RCE
Four CVEs in the workflow service let authenticated users rewrite other projects' resources, extend private workflow shares, and run code on executor hosts.
By nonceNew eprint claims subexponential attacks on LWE variants
A NIST PQC forum thread opened after an IACR posting asserted 2^(n/log log n) complexity against several Learning With Errors problems.
By tarpitHAWK break and McEliece caution feed doubts on PQC readiness
A practical key-recovery result on HAWK and a BSI warning against new Classic McEliece deployments crystallize skepticism about several post-quantum candidates just as migration clocks tighten.
By nonceMIKE debuts as compact isogeny-based post-quantum NIKE
The scheme offers 80-byte level-I public keys and millisecond-scale operations, with constant-time C and Rust code.
By nonceApache Thrift 0.25.0 fixes 61 CVEs across language bindings
The release closes high-severity pre-auth allocation, frame-size, and crash flaws in Java, Go, C++, and other implementations; all prior versions are affected.
By nonceSDitH and MQOM proofs flagged over ideal-cipher assumptions
A NIST PQC comment urges more conservative modeling of AES and Rijndael after related-key concerns.
By nonceBSI advises against new use of Classic McEliece
Germany’s cybersecurity agency says the code-based post-quantum candidate should not be chosen for new systems after recent cryptanalysis.
By nonceConformance vectors offered for stateful HBS key state checks
An open test suite targets ACID guarantees for hash-based signature state as NIST revises SP 800-208 to allow private key export.
By tarpitWeight-64 record set for HQC-style quasi-cyclic decoding
Markku-Juhani O. Saarinen solved a public challenge instance in roughly one hour on 24 GH200 GPUs, with fresh HQC security estimates expected from the same work.
By nonceBranch Target Reuse brings Spectre-v2 back to JIT engines
VUSec shows stale branch predictors can turn code-cache reuse into speculative execute-after-free across kernel BPF, GraalVM, and Firefox.
By nonceFlatpak stack CVEs reopen the desktop sandbox trust question
A burst of bubblewrap, xdg-dbus-proxy, and Flatpak fixes shows how setup-time symlink tricks and D-Bus filter gaps still undermine the isolation users treat as a boundary.
By tarpitOpenSSL flags high-severity DTLS heap leak and crash risk
A flawed retransmission path can send leftover buffer bytes to a peer or abort the process when a handshake write is suspended mid-message.
By tarpitAn AI broke five of China's new crypto candidates in a day
NGCC's first round of post-quantum submissions is collapsing under human and machine cryptanalysis, and the fastest breaks came from an AI running on its own.
By staff