Cyber ·
Remote code execution in nginx: CVE-2026-93479 and CVE-2026-15176
F5 advisory on open-source nginx issues. At least two may allow remote code execution in versions before 1.31.7 or 1.30.6.
Cyber
Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
Node.js: Google Brotli library flaw also affects other consumers, such as Envoy
On 23 October 2026, the oss-sec list published a reply stating that the problem behind a Node.js advisory lies in the Google Brotli library and propagates to other software, such as Envoy.
Cyber ·
php2shell: SANS ISC diary on the reaction to the vulnerability
A SANS Internet Storm Center diary entry dated Friday, 23 October, machine-translated, reports how many people rushed to respond to the php2shell vulnerability. The available excerpt gives no technical details on exploitability or affected versions.
Cyber ·
First part of the 7.4 kernel merge window brings 6,753 changes
As of October 23, 2026, the first part of the 7.4 kernel merge window had already taken 6,753 change sets, including new features, cleanups and security fixes.
Cyber ·
Ruby regular expression compilation fixes tied to GitLab CVEs
A post on the oss-sec feed dated October 23, 2026 points to Ruby regular expression compilation fixes related to GitLab CVEs. The excerpt contains no technical details.
Cyber ·
FCC bans two devices with surveillance chips linked to Huawei
The FCC banned a wireless video transmitter and a panel camera made with HiSilicon chips, a Huawei subsidiary. The item is a machine translation from The Record feed and describes the decision and the chip maker.
Cyber ·
PHP notice on session upload progress (CVE-2026-115560)
Informational PHP notice on session upload progress, identified as CVE-2026-115560, relayed by the oss-sec list on 23 October 2026. The received text does not describe the technical impact or the affected versions.
Cyber ·
Smaller kernel stacks under discussion at Linux Plumbers 2026
Translated LWN item: the global memory chip shortage has renewed interest in reducing memory use, including the memory consumed by kernel stacks, a topic Will Deacon presented at the memory management microconference.
Cyber ·
eMudhra/emSign CA certificate incident and the Python shift toward truststore
An oss-sec feed post dated October 23, 2026, by Sam Bull, on a security incident involving eMudhra/emSign CA certificates and the Python ecosystem's move to prioritize truststore over certifi.
Cyber ·
CVE-2026-115748: Apache Vysper authorization bypass in the XEP-0077 registration flow
Security advisory on an authentication flaw in the XEP-0077 in-band registration of Apache Vysper, rated important, with CVSS 3.1 score 8.8. Published on 23 October 2026 by Thomas Wolf on the oss-sec feed.
Cyber ·
CVE-2026-115721: Apache Vysper has unbounded allocation during XML parsing
Advisory dated October 23, 2026 on unbounded allocation during XML parsing in Apache Vysper, an XMPP server library. The issue can exhaust memory. Rated moderate, CVSS 3.1 score 7.5, and all versions are listed as affected.
Cyber ·
CVE-2025-60497: NULL pointer dereference in GetESD of GPAC/MP4Box via crafted MP4 input
Security advisory on a NULL pointer dereference in the GetESD function of MP4Box (GPAC), triggered by a specially crafted MP4 input. Severity is medium, with CVSS 3.1 score 5.5, per the assessment cited in the source.
Cyber ·
SANS ISC returns to Infocon Green after PHP alert
On 23 October 2026, the SANS Internet Storm Center returned to Infocon Green after raising the alert over a situation involving PHP. The original text does not detail the vulnerabilities in the message itself.
Cyber ·
CVE-2025-60494: invalid memory read in MP4Box from GPAC
Medium-severity advisory for GPAC (MP4Box): a specially crafted MP4 input can cause an invalid memory read in gf_props_equal_internal(). The affected version and the fix commit are reported.
Cyber ·
CVE-2025-60492: uncontrolled recursion in the GPAC/MP4Box BIFS decoder
Security advisory on uncontrolled recursion (CWE-674) in the GPAC/MP4Box BIFS decoder. A specially crafted MP4 input can exhaust the process stack during decoding. The reported severity is medium, with CVSS 3.1 of 5.5, and the fixed build is named in the original advisory.
Cyber ·
CVE-2025-60491: use-after-free in GPAC/MP4Box triggered by crafted MPEG-2 TS input (CVSS 8.8)
Advisory on the oss-sec list about a heap use-after-free in dasher_flush_segment in GPAC/MP4Box, triggered by a specially crafted MPEG-2 TS input. CVSS 3.1 score 8.8 (HIGH), CWE-416. The advisory names a fixed commit.
Cyber ·
CVE-2025-60490: use-after-free in GPAC/MP4Box via crafted MPEG-2 TS input
October 23 alert on a heap use-after-free in GPAC/MP4Box, triggered by a specially crafted MPEG-2 TS input. CVSS 3.1 score of 8.8, rated high, with a fix identified in the code.
Cyber ·
CVE-2025-60489: NULL pointer dereference in GPAC MP4Box via a specially crafted MP4 entry
Advisory from the oss-sec list dated October 23, 2026 describes a NULL pointer dereference in dasher_insert_timeline_entry in MP4Box (GPAC), classified as CWE-476, CVSS 3.1 5.5 (medium), with a fix commit published.
Cyber ·
CVE-2025-60487: NULL pointer dereference in MP4Box (GPAC) via crafted XML
Medium-severity flaw in GPAC's MP4Box: a specially crafted XML input can lead to a near-NULL pointer dereference in gf_isom_get_esd(). CVSS 3.1 score of 6.2.
Cyber ·
CVE-2026-101259: Apache Camel CoAP exposes information through unsilenced consumer errors
Advisory dated October 23, 2026 on the Apache Camel camel-coap component: unsilenced consumer exceptions can produce error messages containing sensitive information. Medium severity, CVSS 3.1 5.3. Fixed versions: 4.18.5 and 4.22.2.