Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
The British government wants to update the 1885 law on undersea cables, which now sets a maximum fine of £1,000 and up to five years in prison for deliberate damage, amid hybrid threats.
Cyber ·
Advisory on the Apache Camel AWS2-S3 component, which may interpret untrusted S3 object keys received in the CamelAwsS3Key header as Simple expressions. Medium severity, CVSS 3.1 score of 5.4.
Cyber ·
Security advisory published on October 23, 2026: cached introspection results do not respect token expiry, so the camel-keycloak component may accept expired access tokens. CVSS 3.1 score of 4.8 (medium), with affected versions stated in the source.
Cyber ·
Distributions including AlmaLinux, Debian, Fedora, Mageia, Oracle, Red Hat, SUSE and Ubuntu published security updates for several packages, according to the LWN feed record dated 23 October 2026. The source lists the affected packages per distribution.
Cyber ·
A comment dated 22 October 2026 on the oss-sec list describes how Linux distributions and pip can use the system certificate store instead of bundled certificates, in the context of the eMudhra/emSign CA incident.
Cyber ·
CISA published four CVE records and advisory VA-26-294-01 on flaws in HAPI FHIR, an open-source Java implementation of the HL7 FHIR standard. In the worst case, a user authorized for one tenant can read or write data in another tenant's partition.
Cyber ·
CPython security advisory on a flaw that lets attackers bypass the path traversal protection in tarfile.tar_filter and write files outside the extraction directory.
Cyber ·
Security notice dated 22 October 2026: unauthenticated users can list users and groups of Plone sites with the REST API enabled, including user ID and full name.
Cyber ·
On 22 October 2026, a participant on the oss-sec list recommended that Python packages stop bundling root certificates and default to the system trust store, except for certifi.
Cyber ·
On 22 October 2026, a discussion on the oss-sec list proposed investigating which email applications use the NSS/Thunderbird certificate store as a trust anchor for S/MIME and whether they correctly validate X.509 chains.
Cyber ·
Announcement of three Python versions, posted on October 22, 2026 to the oss-sec feed by Alan Coopersmith, based on a machine-translated text.
Cyber ·
The Toronto unit of Crime Stoppers, a criminal tip organization, broke with its national association and announced a pause in operations after a data breach. It also published a timeline of what it knew and when.
Cyber ·
On 22 October 2026, the oss-sec mailing list relayed a notice about a security incident involving a certificate from the eMudhra/emSign certificate authority, with information for Python users published on the language's official forum.
Cyber ·
A minimal fix for two PHP CVEs, concerning stale state after an out-of-memory bailout, was unofficially backported to PHP packages for Enterprise Linux 6 and 7, without a vendor update. The notice was posted on the oss-sec list on October 22, 2026.
Cyber ·
Public advisory on an out-of-bounds read (CWE-125) in GPAC/MP4Box when processing an AC-4 stream with an invalid frame rate index. CVSS 3.1 score of 5.4, rated medium. Published on October 22, 2026 on the oss-sec mailing list.
Cyber ·
Advisory from the oss-sec feed on a division by zero in MP4Box (GPAC) triggered by a truncated MP4 file. CVSS 3.1 score 5.5, with high impact on availability. The affected version and the fix are identified by commit.
Cyber ·
Security advisory on a NULL pointer dereference in GPAC/MP4Box, triggered by a specially crafted BIFS scene. CVSS 3.1 score of 5.5, medium severity, with a fix indicated by the project.
Cyber ·
Security advisory on a use-after-free flaw (CWE-416) in the MP4Box tool of the GPAC project, triggered by a crafted MPEG-2 TS file. CVSS 3.1 score of 7.8, rated high.
Cyber ·
Security advisory on a heap use-after-free in MP4Box (GPAC) during AC-4 descriptor cleanup, with CVSS 3.1 score of 8.8 and a fix identified in the project.
Cyber ·
Ubuntu Security advisory describes a flaw in how zlib handles certain non-blocking write operations, which may cause a heap buffer overflow, denial of service or arbitrary code execution. The flaw was reported by Ali Firas.
Looking for something else?DocumentationContact
