Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
The CPAN Security Group advisory describes a type confusion in dbi_profile in the DBI module for Perl, in versions before 1.656. The flaw can crash the process when a database handle is destroyed under a Profile Path with an {attr} element.
Cyber ·
CPAN Security Group advisory on the Perl Mozilla-CA distribution. Versions before 20261020 ship a CA certificate bundle with a root linked to compromised intermediates. The text was posted to the oss-sec feed on 20 October.
Cyber ·
Two issues in the local WebSocket server of Textream, an open-source macOS teleprompter, were fixed in version 1.5.1: missing Origin checks and unlimited connections.
Cyber ·
Ubuntu advisory USN-8944-2 removes two certificate authority certificates and refreshes the ca-certificates package on LTS releases, aligned with Mozilla bundle version 2.90.
Cyber ·
The PHP security team announced a high-impact security update scheduled for October 21 at 14:00 UTC and recommends that users prepare to update as soon as it is released.
Cyber ·
US, UK and German agencies say the SafePay group targets companies and critical infrastructure using guessed passwords, vulnerability exploitation and phishing, with over 600 victims since 2024.
Cyber ·
An oss-sec feed item dated October 20, 2026 points to an advisory about an upcoming critical PHP security release. The source gives no version number, flaws or release date.
Cyber ·
An oss-sec mailing list message dated October 20, 2026 states that removing the Comodo AAA Services root from browser trust stores is unrelated to the eMudhra intermediate certificate compromise. The cited reason is the root's age, issued in 2004.
Cyber ·
Mozilla removed the restrictions on the tracking record for the compromise of eMudhra intermediate certificates and made it publicly visible. The notice was posted on the oss-sec list on 20 October 2026 by Alan Coopersmith.
Cyber ·
The California Department of Education reported that the assessment provider ETS suffered a data breach lasting months and published notices to students in the state public school system.
Cyber ·
The SUSE security team is working to disable setuid system-wide on Linux, a measure that still faces obstacles, according to a report on a talk at All Systems Go! 2026.
Cyber ·
The successor to 23andMe agreed to pay US$ 6 million to resolve claims that it did not adequately protect customer data before a 2023 breach, under a settlement announced by California's attorney general.
Cyber ·
On October 20, 2026, Jeffrey Walton relayed on the oss-sec feed a notice about compromised eMudhra intermediate certificates. Chrome and Firefox have already removed the eMudhra root from their trusted root programs, but the author does not know whether other browsers and tools have done the same.
Cyber ·
On October 20, 2026, a notice on the oss-sec feed announced NSS version 3.131.1 with important security updates, linked to CVE-2026-113470 for Mozilla products.
Cyber ·
Go 1.27.3 and Go 1.26.10 are released as minor point versions, with one security fix tied to CA certificate removal, according to the release message published on October 20, 2026.
Cyber ·
Important-severity advisory on an insufficient buffer read flaw in Apache Tomcat that can mix responses across requests on the same connection and possibly expose data. Affected versions 11.0.0-M25 through 11.0.26.
Cyber ·
According to a The Record report, a federal judge denied WhatsApp's request to hold NSO Group in contempt over an alleged violation of a 2025 injunction against using the messaging app to spread spyware.
Cyber ·
ConnectWise suspended its Cloud Backup service after confirming unauthorized access to the service environment, an incident the source describes as a supply chain attack.
Cyber ·
Recordings of the Linux Plumbers Conference 2026, held in Prague from 5 to 7 October, can be accessed through a YouTube playlist and links in the schedule.
Cyber ·
Researchers report that a phone belonging to the rector of the University of Belgrade was found infected with the Pegasus spyware, in a series of findings ahead of Serbia's national elections.
Looking for something else?DocumentationContact
