Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
CPAN Security Group advisory: a single request declaring a high Content-Length can crash the HTTP::Server::PSGI server, part of the Plack distribution, in versions before 1.0056.
Cyber ·
On 25 October 2026, a discussion on the oss-sec list covered a backported patch for the out-of-memory (OOM) flaw known as PHP2Shell, in the PHP 5.4 to 5.6 lines.
Cyber ·
A soundness flaw in the Rocq/Coq module system can let Print Assumptions report a proof of False as closed, with no visible axioms or unsafe flags. The advisory title states that no fix has existed since 2020.
Cyber ·
Security advisory on a soundness flaw in the Rocq proof assistant kernel: after a module is closed, the universe checking state is not restored, allowing a proof of 0 = 1 with no apparent axioms.
Cyber ·
A soundness flaw in the Rocq kernel guard checker lets a builder construct a verified proof of False, and of any proposition, without axioms, tactics, plugins or unsafe flags. The disclosure was posted to the oss-sec list on 25 October 2026.
Cyber ·
Security advisory on the Rocq kernel guard checker: after an inductive type parameter is rewritten, the recursive tree is not rechecked, and a proof of False may be accepted as valid.
Cyber ·
Security advisory on the Rocq kernel guard checker, which accepts a non-terminating fixed point through unchecked cross calls and allows proving False without declared axioms.
Cyber ·
Advisory from the oss-sec feed describes a Lean 4 kernel flaw that allows building a verified proof of False, including 0 = 1, without declared axioms or modified files.
Cyber ·
An oss-sec mailing list notice dated 24 October 2026 reports the release of Brotli 1.2.1 with the fix for CVE-2026-111497 and lists other software that already includes the correction.
Cyber ·
A security advisory dated October 24, 2026 states that Python's ssl module gained a blocklist of intermediate certificates known to be compromised, to protect users. The excerpt received is truncated and machine-translated.
Cyber ·
Web::Simple versions before 0.035 allocate a buffer based on the Content-Length header for URL-encoded body parameters. The advisory was published on October 24, 2026 on the oss-sec feed by the CPAN Security Group, with identifier CVE-2026-114629.
Cyber ·
A message posted to the oss-sec list on 24/10/2026 criticizes static linking of dependencies and cites the Node.js --shared-brotli option for distributions that use it.
Cyber ·
A message dated 24 October on the oss-sec feed clarifies that removing TLS trust from a root certificate did not necessarily prevent its use for S/MIME. The thread concerns intermediates linked to eMudhra and corrects details about the root's validity period.
Cyber ·
An oss-sec advisory describes memory faults in the jxrlib library, abandoned upstream, triggered by a damaged JPEG XR file a few hundred bytes long, including a heap buffer write past the end. Fixes are in fork 1.4.4, released on 9 October 2026.
Cyber ·
Report on prototype pollution in Tampermonkey, a userscript manager, through the internationalized antifeature tag. According to the text, the flaw can replace script code, but it requires user interaction or impractical circumstances.
Cyber ·
CPAN Security Group advisory on an out-of-bounds write in the Brotli library bundled with IO::Compress::Brotli. Versions from 0.004001 up to but not including 0.023 are affected.
Cyber ·
Security advisory on a heap out-of-bounds read in OptimizedTranslation message lookup in Godot 4.x, with the fix already merged upstream on 20 October 2026.
Cyber ·
Advisory from oss-sec on an out-of-bounds heap write in the Godot 4.x binary resource loader, caused by an invalid string length. The fix was merged upstream on 20 October 2026.
Cyber ·
oss-sec advisory on the fix, already merged upstream into Godot's master branch, for an out-of-bounds heap write when loading corrupted Radiance HDR images, referencing CVE-2026-110734.
Cyber ·
Advisory published on October 23, 2026 in the oss-sec feed by the CPAN Security Group. Perl HTTP::Headers::ActionPack versions before 0.10 match Accept-Language ranges as regular expressions, allowing CPU exhaustion.
Looking for something else?DocumentationContact
