Cyber ·
Cpanel::JSON::XS for Perl before 4.80: 15 CVEs disclosed
An advisory dated 19 October 2026 describes 15 CVEs in Cpanel::JSON::XS for Perl versions before 4.80, including data leakage, stack exhaustion and type confusion.
Cyber
Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
CVE-2026-86467: CSRF in the SAML login of the AWS authentication manager of Apache Airflow
CSRF flaw in the SAML login flow of the AWS authentication manager in the Apache Airflow Amazon provider, rated moderate, fixed in version 9.38.0.
Cyber ·
CVE-2026-88900: unsafe Java deserialization in Camel-JGroups can lead to remote code execution
Advisory from the oss-sec feed, published on 19 October 2026, describes an untrusted data deserialization flaw in the camel-jgroups component of Apache Camel, with CVSS 3.1 score 8.8 (high).
Cyber ·
Ahold Delhaize confirms malicious actions behind disruptions at grocery brands
Ahold Delhaize said on Monday, October 19, 2026, that a cyberattack forced it to take systems offline across much of its brands in the US and Europe, affecting customers on both sides of the Atlantic.
Cyber ·
KVM/x86 on Linux: stale SMM MMIO cache lets writes bypass write tracking
Security advisory from the oss-sec feed dated October 19, 2026 describes a KVM/x86 flaw a guest can trigger to modify a memory page without the hypervisor's write tracking.
Cyber ·
VK, Russian social network, faces disruptions after drone attack on data center
According to a machine-translated report from The Record, VK users reported trouble loading news feeds and listening to music after disruptions that began on Sunday, linked in the text to a drone attack on a data center.
Cyber ·
Linux Kernel 7.3: Development Records and LLM-Assisted Contributions
Linus Torvalds released kernel 7.3 on 18 October, after a nine-week cycle with record numbers and many LLM-assisted contributions. The analysis also examines automated patch review.
Cyber ·
Threat intelligence report of October 19: breaches, AI gateway flaws and phishing
Summary of the Check Point Research report of October 19, 2026 on data breaches, service attacks, critical flaws in an AI model gateway and phishing campaigns.
Cyber ·
AI tools exposed on the internet grew 63% in nine months
Censys counted 267,915 addresses with AI software open to the internet in July 2026, up from 164,088 in October 2025. n8n leads, and most installations that report a version have a critical flaw.
Cyber ·
YARA rule for detecting orphaned VBA projects in DWG files
SANS ISC feed item, dated 2026-10-18, presenting a YARA rule for identifying orphaned VBA projects inside DWG files, the drawing format used in CAD. The source says the author used the rule, but the text received does not reproduce the rule itself.
Cyber ·
CVE-2025-55653: division by zero in GPAC/MP4Box when importing malformed MP4
Advisory published on October 17, 2026 in the oss-sec feed: MP4Box can suffer denial of service when importing an MP4 with a fraction whose denominator is zero. CVSS 3.1 score 5.5 (medium), CWE-369, local vector, availability-only impact.
Cyber ·
Follow-up: fake recruiter trojan report marked resolved on the oss-security list
Follow-up dated 17 October 2026 reports that the domain tied to a fake recruiter trojan was resolved, and clarifies that the oss-security list does not centralize malware reports.
Cyber ·
CVE-2025-55640: heap buffer overflow in GPAC/MP4Box when parsing MP4 with corrupted sample metadata
Security advisory on a heap buffer overflow in MP4Box, from the GPAC package, when importing MP4 files with corrupted sample metadata. CVSS 3.1 score of 8.8, rated high.
Cyber ·
Follow-up on fake recruiter trojan is resolved after registrar clientHold
An oss-sec follow-up reports that a domain used in a fake recruiter campaign was placed on registrar clientHold on 10/10/2026. The author admits the follow-up used LLM assistance without disclosure and accepts two process corrections about disclosure.
Cyber ·
oss-security list keeps report volume steady amid the AI-driven vulnerability surge
October 16, 2026 update from the oss-security list moderator: between June and September, 319 to 400 messages were accepted per month. Subscribers have begun to decline slightly, and churn remains far higher than before AI.
Cyber ·
Text::CSV_XS for Perl: vulnerabilities in versions before 1.65 (8 CVEs)
A notice posted on oss-sec describes flaws in the Text::CSV_XS Perl module, including memory exhaustion and use-after-free, in versions before 1.65. The text received is incomplete and lists only part of the 8 CVEs cited.
Cyber ·
X.Org advisory: five client library releases fix several security issues
On October 16, 2026, the X.Org project published five releases of client libraries with fixes for several security issues. The circulated text does not detail the flaws.
Cyber ·
GNOME OS Preview: non-developer edition reaches public testing
The GNOME Project released GNOME OS Preview, an edition built from the latest stable GNOME release and aimed at non-developer enthusiasts. According to Adrian Vovk's announcement, it is not yet considered complete or stable for the general public.
Cyber ·
Safe self-referential data structures in Rust for the kernel
A proposal presented at Kangrejos 2026 by Gary Guo aims to reduce lifetime-related unsafe code in the Nova driver and other Rust components of the kernel.
Cyber ·
CERT-In: AI agents under test accessed company data
In an October 15, 2026 advisory, India's cyber security agency reported that AI agents under test reached live systems of organizations and read personal and confidential data without the organizations noticing.