Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
A NULL pointer dereference (CWE-476) in the AC-4 parser of MP4Box, triggered by a specially crafted file. CVSS 3.1 score of 5.5, medium severity, published on the oss-sec list on October 22.
Cyber ·
A security item from the oss-sec feed, published on October 22, 2026, describes a remote code execution flaw in PHP 8.2 to 8.5 caused by stale global state. A reply in the same thread claims versions from 5.4.0 onward are also affected.
Cyber ·
A reply on the oss-sec list questions which PHP versions are affected by CVE-2026-109619, a remote code execution flaw tied to stale global state in versions 8.2 to 8.5.
Cyber ·
Radar security item: a message on the oss-sec list, dated 22 October 2026, cites CVE-2026-109619, a remote code execution flaw in PHP versions 8.2 to 8.5, attributed to stale global state. The received text gives no technical details and no fix information.
Cyber ·
A comment on the oss-sec list dated October 22, 2026 says CVE-2026-109618 and CVE-2026-109619 were found together but are two distinct vulnerabilities in PHP 8.2 to 8.5.
Cyber ·
A May-style oss-sec discussion dated 22 October 2026 describes remote code execution in PHP 8.2 to 8.5 tied to stale global state. A comment claims the linked article covers versions back to 5.4, a claim not yet confirmed by the official advisory.
Cyber ·
On 22 October 2026, a comment posted to the oss-sec list, republished by a feed with automatic translation, states that the issue cited in CVE-2026-109619 is unrelated to remote code execution in PHP 8.2 to 8.5 and has minimal impact.
Cyber ·
On October 22, 2026, a comment on the oss-sec list addressed CVE-2026-109619, reported as remote code execution in PHP 8.2 to 8.5 caused by obsolete global state. The PHP team said it is aware of the report and, for now, has no new plans.
Cyber ·
An oss-sec mailing list post dated October 21, 2026 describes remote code execution (RCE) in PHP caused by stale global state. The fixed versions listed are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A reply warns that the title may suggest that earlier versions are not affected.
Cyber ·
Radar records the announcement of an ISC Stormcast podcast episode dated October 22, 2026. The feed gives no description, topics or summary, so verification depends on the original page.
Cyber ·
Cyber radar: the LWN.net weekly edition of October 22, 2026 covers Android, kernel integrity, Rust, NFS and brief notes on vulnerabilities, including the eMudhra CA compromise and PHP RCEs.
Cyber ·
A post on the oss-sec feed, dated October 21, 2026, reports QPACK amplification attacks against HTTP/3 servers and points to a detailed technical analysis. Informational record only, not a usage guide.
Cyber ·
A thread on the oss-sec list dated 21 October 2026 asks why Firefox 153 ESR still trusts the Comodo AAA certificate, even though web trust was disabled in NSS last year.
Cyber ·
Security advisory from the CPAN Security Group for the Perl library Robots::Validate. Versions from 0.4.3 up to but not including 0.4.10 may reuse User-Agent comparator state across requests.
Cyber ·
CPAN Security Group advisory on the Net-LibSSH distribution: versions before 0.004 do not check the host key against known_hosts when connecting. The text was published on the oss-sec feed on October 21, 2026.
Cyber ·
Advisory published on the oss-sec list on October 21, 2026 states that Rex, up to version 1.16.1, disables strict SSH host key checking in remote rsync transfers. Rota Nacional does not patch third-party tools; the action rests with whoever runs Rex.
Cyber ·
CPAN Security Group advisory: Algorithm::UrataniTakeda versions from 0.1.5 up to before 0.1.7 can exhaust memory through an uncleared failure cache in the search function. The fix is in version 0.1.7.
Cyber ·
An Ubuntu Security notice, published on 21 October 2026, provides the libsoup3 update for Ubuntu 26.10. It complements USN-8890-1 and fixes flaws that may cause denial of service, information exposure, control bypass or code execution.
Cyber ·
SANS ISC raised its infoCon to yellow after PHP announced a critical update for two CVEs, with a CVSS of 9.4 and preliminary PoC exploits available before the patch.
Cyber ·
Apache Pulsar PMC advisory on Apache Pulsar Manager: missing authentication and authorization, disclosure of administrator credentials, and discontinuation with issues that will not be fixed.
Looking for something else?DocumentationContact
