Latest security news
Sat, October 24
DSA-6583-1 libheif - security update
https://security-tracker.debian.org/tracker/DSA-6583-1
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1 ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) remove their private .filelock- link directories with shutil.rmtree (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable /proc/self/fd (a Linux path that names the process's own open f…
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1 When a soft-lock stale break finds that the marker (the lock file at ) it renamed aside was a live one recreated by a successor, the restore branch of break_lock_file() checks the break name with lstat (a check that reads a name without following a symbolic link) and then calls os.link(break_path, lock_file) by name. On CPython 3.12 and later on Linux (and on macOS) that call follows a symbolic link (a file that redirects to another path). A local user (the other user below) who can write a sha…
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
影響: pip:filelock >= 3.20.4, <= 4.2.0 → 4.2.1 ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to /proc/self/fd/ , a Linux path that names the process's own open file n. SQLite turns that path back into a plain path and reopens it by name, following symlinks (a symlink is a file that points at another path). On every POSIX route SQL…
Fri, October 23
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw
DSA-6579-1 roundcube - security update
https://security-tracker.debian.org/tracker/DSA-6579-1
DSA-6580-1 erlang - security update
https://security-tracker.debian.org/tracker/DSA-6580-1
DSA-6581-1 unbound - security update
https://security-tracker.debian.org/tracker/DSA-6581-1
DSA-6582-1 brotli - security update
https://security-tracker.debian.org/tracker/DSA-6582-1
USN-8954-1: zlib vulnerability
Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial of service or arbitrary code execution.
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
影響: npm:next >= 10.0.0, <= 15.5.27 → 15.5.28, npm:next >= 16.0.0, <= 16.4.0 → 16.4.1 A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp. Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.
USN-8953-1: OpenVPN vulnerability
It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.
Thu, October 22
USN-8952-1: Tornado vulnerabilities
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)
Bun v1.4.4
Fixes 271 issues, addressing 544 👍. bun fmt, a Prettier-compatible formatter built into Bun that is 3x to 6x faster than oxfmt, bun check is 1.4x to 7.8x faster on large projects, bun install migrates Yarn Berry lockfiles, retries with exponential backoff and closes 133 issues, up to 3.2x faster hoisted installs from a warm cache on Linux, bun pm fetch, bun publish --recursive, packageExtensions, Bun.SQL uses up to 48% less CPU per query, query.cancel(), COPY streams, column name transforms, user-defined functions and update hooks in bun:sqlite, ws rewritten to behave like npm ws on Node.js,…
DSA-6534-3 webkit2gtk - regression update
https://security-tracker.debian.org/tracker/DSA-6534-3
DSA-6577-1 chromium - security update
https://security-tracker.debian.org/tracker/DSA-6577-1
DSA-6578-1 aide - security update
https://security-tracker.debian.org/tracker/DSA-6578-1
USN-8890-2: libsoup vulnerabilities
USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 2…
USN-8951-1: c-ares vulnerabilities
It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-22217) It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2022-4904) It was discovered that c-ares did not properly limit DNS compression p…
USN-8947-1: NSS update
This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised.
USN-8950-1: poppler vulnerability
It was discovered that poppler incorrectly handled the password length limit when decrypting certain encrypted PDF files. An attacker could possibly use this issue to cause a denial of service.
USN-8930-2: U-Boot vulnerabilities
USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the corresponding fix for U-Boot on Ubuntu 26.10. Original advisory details: Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker…
USN-8949-1: Ghostscript vulnerabilities
Rick de Jager discovered that Ghostscript incorrectly handled memory under certain circumstances when processing PostScript documents. If a user or automated system were tricked into processing a specially crafted document, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code. (CVE-2026-101258) It was discovered that Ghostscript incorrectly handled memory when converting certain fonts. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause Ghostscript to crash, or possibly ex…
USN-8948-2: PHP vulnerabilities
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-20…
Wed, October 21
DSA-6573-1 firefox-esr - security update
https://security-tracker.debian.org/tracker/DSA-6573-1
DSA-6574-1 php8.4 - security update
https://security-tracker.debian.org/tracker/DSA-6574-1
DSA-6575-1 nginx - security update
https://security-tracker.debian.org/tracker/DSA-6575-1
DSA-6576-1 bind9 - security update
https://security-tracker.debian.org/tracker/DSA-6576-1
Tue, October 20
DSA-6572-1 ca-certificates - security update
https://security-tracker.debian.org/tracker/DSA-6572-1
SLES 15.6 repositories are being retired
The SLES 15.6 repositories are being retired from the main PostgreSQL RPM repository, and are moved to the PostgreSQL ZYPP archive .General support for SUSE Linux Enterprise Server (SLES) 15 SP6 (15.6) ended on December 31, 2025 (by upstream). All PostgreSQL major versions that were built for these minor releases are available there, including PostgreSQL 18. If you are still on SLES 15.6 either update to a newer SP (SP7 at the time of this writing), or use the archive. The archived repositories section of the repository packages page generates the repository file and the install commands for…
RHEL 10.0 and 9.6 repositories are being retired
The RHEL 10.0 and RHEL 9.6 repositories are being retired from the main PostgreSQL RPM repository, and are moved to the PostgreSQL YUM archive . All PostgreSQL major versions that were built for these minor releases are available there, including PostgreSQL 18. The rolling EL-10 and EL-9 repository RPMs are not affected. If you are still on RHEL 10.0 or 9.6 (or on Rocky Linux / AlmaLinux 10.0 or 9.6), please either update to a newer minor release, or use the archive. The archived repositories section of the repository packages page generates the repository file and the install commands for ea…
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities
Sun, October 18
DSA-6567-2 cifs-utils - regression update
https://security-tracker.debian.org/tracker/DSA-6567-2
DSA-6570-1 haproxy - security update
https://security-tracker.debian.org/tracker/DSA-6570-1
DSA-6571-1 xen - security update
https://security-tracker.debian.org/tracker/DSA-6571-1
Fri, October 16
DSA-6565-1 spip - security update
https://security-tracker.debian.org/tracker/DSA-6565-1
DSA-6566-1 expat - security update
https://security-tracker.debian.org/tracker/DSA-6566-1
DSA-6567-1 cifs-utils - security update
https://security-tracker.debian.org/tracker/DSA-6567-1
DSA-6568-1 linux - security update
https://security-tracker.debian.org/tracker/DSA-6568-1
DSA-6569-1 apache2 - security update
https://security-tracker.debian.org/tracker/DSA-6569-1
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared
containerd CRI plugin: Checkpoint restore bypasses destination security context
影響: go:github.com/containerd/containerd/v2 >= 2.1.0, < 2.2.7 → 2.2.7, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.4 → 2.3.4 A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI image, CRIU restores process credentials, Linux capabilities, no_new_privs, and seccomp state directly from checkpoint data rather than enforcing the destination CRI ContainerConfig. An attacker who can ru…
Introducing dotnetup: A toolchain manager for .NET
Learn how the new dotnetup tool helps macOS and Linux developers install, manage, and update user-local .NET SDKs and runtimes. The post Introducing dotnetup: A toolchain manager for .NET appeared first on .NET Blog .
Thu, October 15
DSA-6562-1 chromium - security update
https://security-tracker.debian.org/tracker/DSA-6562-1
DSA-6563-1 mutt - security update
https://security-tracker.debian.org/tracker/DSA-6563-1
DSA-6564-1 jpeg-xl - security update
https://security-tracker.debian.org/tracker/DSA-6564-1
Wed, October 14
DSA-6558-1 curl - security update
https://security-tracker.debian.org/tracker/DSA-6558-1
DSA-6559-1 buildstream - security update
https://security-tracker.debian.org/tracker/DSA-6559-1