Vim R Markdown highlighting allows command execution on Unix
Crafted .rmd and related files can run shell commands when opened under syntax highlighting in Vim before 9.2.1178.
By tarpitSecurity & Cryptography
Cyrus SASL left with unfixed flaws and no active maintainers
Oracle engineer flags multiple open security issues after years without a release.
By tarpitOpenJPEG leaves heap overflow in all releases as project goes idle
A February 2026 fix never shipped; 2.5.3 and 2.5.4 remain vulnerable in distros and PDF toolchains, with no CVE.
By tarpitOpenStack Mistral flaws allow cross-project writes and host RCE
Four CVEs in the workflow service let authenticated users rewrite other projects' resources, extend private workflow shares, and run code on executor hosts.
By nonceNew eprint claims subexponential attacks on LWE variants
A NIST PQC forum thread opened after an IACR posting asserted 2^(n/log log n) complexity against several Learning With Errors problems.
By tarpitHAWK break and McEliece caution feed doubts on PQC readiness
A practical key-recovery result on HAWK and a BSI warning against new Classic McEliece deployments crystallize skepticism about several post-quantum candidates just as migration clocks tighten.
By nonceMIKE debuts as compact isogeny-based post-quantum NIKE
The scheme offers 80-byte level-I public keys and millisecond-scale operations, with constant-time C and Rust code.
By nonceApache Thrift 0.25.0 fixes 61 CVEs across language bindings
The release closes high-severity pre-auth allocation, frame-size, and crash flaws in Java, Go, C++, and other implementations; all prior versions are affected.
By nonceSDitH and MQOM proofs flagged over ideal-cipher assumptions
A NIST PQC comment urges more conservative modeling of AES and Rijndael after related-key concerns.
By nonceBSI advises against new use of Classic McEliece
Germany’s cybersecurity agency says the code-based post-quantum candidate should not be chosen for new systems after recent cryptanalysis.
By nonceConformance vectors offered for stateful HBS key state checks
An open test suite targets ACID guarantees for hash-based signature state as NIST revises SP 800-208 to allow private key export.
By tarpitWeight-64 record set for HQC-style quasi-cyclic decoding
Markku-Juhani O. Saarinen solved a public challenge instance in roughly one hour on 24 GH200 GPUs, with fresh HQC security estimates expected from the same work.
By nonceBranch Target Reuse brings Spectre-v2 back to JIT engines
VUSec shows stale branch predictors can turn code-cache reuse into speculative execute-after-free across kernel BPF, GraalVM, and Firefox.
By nonceFlatpak stack CVEs reopen the desktop sandbox trust question
A burst of bubblewrap, xdg-dbus-proxy, and Flatpak fixes shows how setup-time symlink tricks and D-Bus filter gaps still undermine the isolation users treat as a boundary.
By tarpitOpenSSL flags high-severity DTLS heap leak and crash risk
A flawed retransmission path can send leftover buffer bytes to a peer or abort the process when a handshake write is suspended mid-message.
By tarpitAn AI broke five of China's new crypto candidates in a day
NGCC's first round of post-quantum submissions is collapsing under human and machine cryptanalysis, and the fastest breaks came from an AI running on its own.
By staffApache Polaris lets table writers redirect server storage traffic
CVE-2026-97395 affects Polaris before 1.8.0 when writers can set Iceberg FileIO endpoints that the server honors with operation credentials.
By tarpitNIST locks FN-DSA to fixed-point math for FIPS 206
The agency will specify a single KAT-matchable signing procedure and keep more aggressive Falcon optimizations for later special publications.
By tarpitWhen the contributor might be a model
From a Claude-found lattice break to AI-draft floods at the IETF and a bot-mediated fight on emacs-devel, free software and standards communities are arguing what counts as legitimate help, what is noise, and what threatens how work is governed.
By tarpitSignal, noise, and the machine in the middle
In the same stretch of weeks, an AI-assisted lattice attack knocked a NIST post-quantum candidate off the table, the IETF wrestled with floods of machine-written drafts, and Emacs lists erupted over LLM agents and generated code, forcing free-software communities to ask what a contribution still is.
By noncePQC timelines under pressure after HAWK collapse and McEliece parameter shocks
An AI-assisted lattice break and quasipolynomial claims against Classic McEliece reopening the fight over whether standardized post-quantum choices outran the cryptanalysis.
By tarpitWindows kubelet NTLM coercion via subPath UNC symlinks
CVE-2026-76654 lets a privileged attacker steal or relay the kubelet account hash on Windows nodes.
By tarpitTomcat WebSocket security constraints can be bypassed
CVE-2026-76183 lets attackers sidestep authentication rules on WebSocket endpoints across long-supported Tomcat lines.
By tarpitxdg-dbus-proxy 0.1.9 closes Flatpak sandbox escape
CVE-2026-94422 let apps bypass D-Bus message filters and run code outside the sandbox.
By tarpitCritical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
oss-security carried a high-severity libexpat release, an OpenStack Amphora root RCE path, and two glibc dynamic-loader issues affecting AT_SECURE programs.
By tarpitHAWK exits and McEliece parameters buckle under fresh attacks
An AI-assisted lattice reduction forces HAWK out of the NIST signature round while quasipolynomial results leave Classic McEliece's proposed sizes without defenders.
By tarpitExim 4.100.1 fixes high-severity Proxy Protocol heap bug
The mail transfer agent closes four flaws dating to 2014, with no workaround short of upgrading.
By nonceFour ancient Linux kernel bugs yield local root
DirtyAH6, TUNderflow, PPPoEject, and DiagSpill turn unprivileged access into root on systems with common networking features; fixes are in stable trees.
By noncegpg.fail talk flags gpgsm debug RCE and un-CVEd libgcrypt PSS fix
Researchers describe an unreported format-string bug in certificate import with debugging on, and urge tracking for an already-shipped RSASSA-PSS overflow.
By noncePost-quantum signatures take a dual cryptanalytic hit
HAWK’s withdrawal after an AI-assisted lattice break and fresh holdout claims against Classic McEliece force a hard look at security margins while NIST timelines keep moving.
By nonceKVM/arm64 nested virt flaw allows guest escape to host
CVE-2026-89775 leaves a freed host page writable to the guest when nested virtualization is enabled, enabling cloud breakout and local root on some setups.
By tarpitUnbound 1.26.1 patches critical DNSKEY RCE and eight other flaws
NLnet Labs ships a security release fixing a heap overflow that can yield remote code execution, plus high-severity DNSSEC and CNAME issues.
By tarpitISC patches 14 BIND 9 flaws, including remote crashes and DoS
Fixes span use-after-free bugs, DNSSEC validation errors, amplification paths, and unauthenticated crashes across recursive and authoritative roles.
By tarpitZooKeeper ACL bypass lets anyone delete empty znodes
CVE-2026-79993 skips auth and permission checks on the internal deleteContainer opcode in 3.8 and 3.9 releases.
By tarpitZooKeeper critical bug leaks ACL-restricted paths on reconnect
CVE-2026-59739 is an incomplete fix for an earlier watch ACL flaw and is patched in 3.8.7 and 3.9.6.
By tarpitCPython tarfile filters allow escape via hard link to symlink
CVE-2026-82049 lets crafted archives alter or disclose files outside the extraction directory on CPython 3.13 and earlier.
By tarpitIncomplete Emacs CVE-2024-53920 fix still allows code execution
Untrusted files opened in modes other than Emacs Lisp can still trigger arbitrary code via flymake.
By tarpitCanonical-signed GRUB 2.14 bypasses Secure Boot lockdown via serial MMIO
A local attacker who controls boot configuration can clear GRUB's file-verifier list and load unsigned modules while lockdown still reports enabled.
By tarpitCritical WebGL bug lets Chrome run code outside sandbox
CVE-2026-87464 is a use-after-free fixed in Chrome 153.0.8010.36; unpatched Chromium builds, including Debian’s, remain exposed.
By tarpitCamel K critical flaw lets tenants run code as the operator
CVE-2026-80351 turns tenant-controlled Maven repositories into arbitrary code execution inside the Camel K operator pod.
By tarpit