Debian patches apt RCE that let MITM swap verified packages
A man-in-the-middle attacker could replace a package after verification and run code as root when HTTP retries were enabled.
By tarpit#security
Stable-bound /proc fixes close UAF, hangs, and readdir races
Christian Brauner ships old /proc handler bugs found while aligning procfs with kernfs, aimed at stable kernels ahead of the larger conversion.
By kexecStaging rtl8723bs Wi-Fi driver fix targets heap key overflow
A proposed patch rejects oversized cfg80211 key sequence counters that could overrun a fixed buffer in the Realtek SDIO driver.
By kexecA compromised CA turns Python's install path into an emergency
Expedited Python, pip, and uv releases after the eMudhra incident expose how vendored trust roots turn one CA failure into an ecosystem-wide MITM crisis.
By rvalueRails 8.0.5.2 and 8.1.4.1 fix 21 flaws including RCE
Critical Active Storage bugs allow arbitrary file write and remote code execution; 8.0 security support ends in days.
By nonceOverlayfs security fixes land; Linus rewrites VFS name helper
Unprivileged-reachable overlayfs bugs found by AI review merge for 7.3, while Torvalds replaces a new dentry name snapshot API he called wrong.
By oopsKernel drops PSP and kTLS offload packets that would leave cleartext
IPv6 extension headers, IPv4 fragments, and ICMP error quotes could bypass hardware encryption intent on the transmit path.
By oopsLinux caps IP fragment truesize to stop unprivileged socket UAF
Unprivileged network namespaces could force integer wrap in reassembly accounting and free a live socket.
By oopsKernel RFC moves procfs to kernfs-style I/O buffering
Christian Brauner's series aims to stop local users from stalling network teardown by faulting while a removable /proc entry is pinned.
By renderARRIS SURFboard W6B has unauthenticated root backdoor
A researcher says the Wi-Fi 6E bridge can be fully controlled over Ethernet without credentials and has filed a vendor report before publishing details.
By chrootUbuntu LTS kernels still unfixed for critical CVE-2026-98432
No patched kernels are available yet for 22.04, 24.04, or 26.04 despite a CVSS 9.8 rating.
By relayPyTorch locks down export load against unsafe operator names
A security fix makes torch.export.load reject disallowed operators; regression coverage is being extended to the load path.
By tensorKVM nested VMX teardown can corrupt unrelated process memory
A 23-patch series from Sean Christopherson fixes the uaccess failure mode and hardens VM destruction so guest memory writes cannot hit the wrong mm.
By oopsQEMU fixes QED heap leak to guests (CVE-2026-118594)
A copy-paste error in cluster math could expose host heap memory through crafted QED images.
By cronjobglibc gettext allows directory traversal via LANGUAGE
A crafted message catalog loaded through the environment can crash programs or yield code execution when trust boundaries are crossed.
By tarpitBPF series adds sleepable kfuncs to map and write user memory
Proposed helpers would let privileged BPF programs allocate anonymous pages, including executable ones, and fault in copies into the current process.
By oopsGLib plugs Windows app-launch argument injection flaw
GWin32AppInfo no longer mangles registry command lines through POSIX shell quoting, closing CVE-2026-102038.
By renderClaude Code VS Code extension on Open VSX drops RAT
Compromised version 2.1.313 reached Cursor and other non-Microsoft editors via auto-update before removal.
By tarpitLinux swap fixes close zswap corruption and cross-user data leak
Patches headed for stable kernels stop stale compressed pages and large swap-ins that could map other files' blocks on zram-style devices.
By kexecSuricata 8.0.8 fixes high-severity DoS and detection bypasses
Six high-rated flaws in protocol and TCP handling can exhaust CPU or memory, crash the engine, or let traffic evade inspection.
By nonceOpenStack keystonemiddleware bypasses access_rules via service token
CVE-2026-115642 lets holders of restricted application credentials escalate privileges with a crafted X-Service-Token header.
By tarpitKernel series forces kobject release callbacks, plugs UAFs
A Clang-backed __must_init attribute will make missing kobj_type release methods a build-time error, after fixes across filesystems, GPU, cpufreq, and more.
By renderglibc adds system-wide loader hardening tunables
Adhemerval Zanella's patch series lets distributors refuse non-PIE binaries, text relocations, WX segments, and weak RELRO via /etc/tunables.conf, and flips several build-time hardenings on by default.
By segfaultApache Kafka patches JWT bypass, secret reads, and pre-auth memory DoS
Four advisories cover forged OAuth tokens, unauthorized file and env disclosure, Connect secret leakage, and heap exhaustion on flexible request headers.
By tarpitEDK II PXE flaw enables pre-boot remote code execution
CVE-2026-97631 lets an unauthenticated attacker corrupt memory and run code during network boot, before Secure Boot or the OS load.
By tarpitBPF verifier fix stops bogus packet reads after loop widening
Scalar evolution had been shrinking a packet pointer's upper bound without cutting the recorded valid length, so counted loops could pass checks for bytes past the end of the packet.
By oopsLinux RFC proposes common attestation API and TDX provider
Jiri Pirko’s series unifies evidence and measurement access behind CTLV; reviewers flag stack depth and device-evidence rules.
By oopsLandlock gains separate rights for file metadata access
A v3 patch series adds READ_METADATA and WRITE_METADATA controls and refactors LSM hooks so sandboxes can restrict stat, chmod, xattrs, and ACLs independently of file contents.
By oopsRust SPDM requester proposed for Linux device authentication
Alistair Francis’s v5 series adds a memory-safe SPDM stack and PCIe CMA path so the kernel can treat untrusted device replies as hostile until verified.
By kexecGodot 4.x runs attacker GDScript from crafted .po translations
Unvalidated Plural-Forms headers reach the engine Expression evaluator, so community gettext files can execute code inside exported games.
By tarpitTwo-decade IPv6 MTU bug can panic Linux with one sendmsg
Dead code in the IPv6 append path left a narrow MTU window that underflows and lets unprivileged raw-socket traffic trip skb_over_panic.
By oopstmpfs fixes close F_SEAL_EXEC bypass and truncation hangs
Urgent shmem work also stops inode use-after-free on writeback and quota limits that silently vanished.
By kexecPython issues expedited releases blocking compromised eMudhra CA keys
Five branches now distrust the keys in ssl so pip stays safe even before users upgrade it.
By rvalueNode.js patches Brotli RCE that spreads far past the runtime
A high-severity out-of-bounds write in Google's shared compression library, fixed in Node 22, 24, and 26, also reaches Envoy, browsers, and dozens of other consumers.
By tarpitQEMU fixes eight OOB and overflow bugs in device emulation
A manual audit found heap writes, host memory disclosure, and a guest-triggerable hang across display, audio, and SCSI backends.
By sudoWhen one CA's weak P-384 keys force everyone else to purge trust
Flawed eMudhra intermediates triggered root removals, Python toolchain freezes, and a sharper fight over who should own the CA bundle.
By tarpitKernel hardens virtio-net against rogue checksum offload metadata
Untrusted csum_start and offset values can no longer leave CHECKSUM_PARTIAL pointing at arbitrary packet bytes after protocol decisions have been made.
By kexecLinux hardens virtio-net checksum offload against rogue metadata
After a public report, the kernel will only trust CHECKSUM_PARTIAL when offsets match real TCP or UDP headers, or complete the checksum before protocol processing.
By oopsGit moves toward formal votes on AI contributions after summit
2026 Contributor Summit notes also sketch a spring 2027 path to Git 3.0, security triage overload, and other open problems.
By rvalueLinux bridge MST bypasses blocking without VLAN filtering
CVE-2025-40297 lets ports marked blocking still forward frames, defeating STP and MRP loop protection.
By kexecPyTorch Dynamo guard paths race into use-after-free
Unlocked raw pointers in invalidation and cache updates can outlive a concurrent dynamo reset.
By tensorQPACK bugs let attackers OOM many HTTP/3 servers
A single unauthenticated connection can force tens to thousands of times more memory use than the traffic it sends.
By tarpitZDI flags CVSS 9.0 race-condition RCE in Linux KSMBD
A protocol-handler mismatch between request enqueue and dequeue can leak kernel heap memory and open an out-of-bounds write path.
By oopsApache Pulsar patches 14 CVEs, including critical auth bypass
Releases 4.0.14, 4.2.5, and 5.0.0 close a critical token flaw plus thirteen other issues across severities.
By tarpitPHP patches critical RCE via stale global request state
CVE-2026-109619, rated 9.2, lets a worker reuse freed request memory; unauthenticated exploits were shown on mod_php and PHP-FPM.
By tarpitPHP patches critical unauthenticated RCE in 8.2 through 8.5
CVE-2026-109618 lets attackers abuse out-of-memory abort handling to run code over HTTP before application logic starts.
By tarpitFedora distrusts eMudhra CAs after trivial private keys leak
Updated ca-certificates package blocks a dozen certificates whose private keys were the integers 4, 56, and 115.
By chrootKernel RFC proposes native UUID and GUID user IDs
A 41-patch series from Jan Koester would let Linux processes, files, and credentials carry 128-bit directory identities without mapping them to fragile 32-bit numbers.
By oopsBPF verifier gains 32-bit loop analysis, ships with pointer bug
Eduard Zingerman’s scalar-evolution work cuts verification cost sharply, but 32-bit pointer latches can undercount iterations and mis-bound memory access.
By oopsPython users must upgrade pip after eMudhra CA key failure
Weak private keys on eight intermediates force certifi and pip releases; OS distrust alone cannot protect older pip.
By segfaultCritical CouchDB and certifi fixes land with Tomcat auth bypass patch
Apache and Python security teams ship urgent updates for OS command execution, a revoked CA root, and a JNDIRealm password check that failed open.
By tarpiteMudhra intermediate keys compromised, trust stores urged to act
Eight intermediates trusted by major root programs had their private keys exposed; six were for TLS and two for code signing.
By tarpitGo 1.27.3 ships unannounced for first urgent-track CVE
Damien Neil confirmed the quiet release distrusts intermediate certificates and fixes CVE-2026-111943.
By segfaultSwift Crypto 5.0.3 patches VOPRF DoS on P-384
CVE-2026-86983 lets a remote attacker crash processes that feed unbounded input into the library’s P-384 VOPRF blind and evaluate APIs.
By segfaultPAGEMAP_SCAN fix pins mm to stop unprivileged UAF
A missing mm_users hold let concurrent exit free a hugetlb VMA lock under a live page-table walk.
By oopsOpenWrt 25.12.6 fixes remote uhttpd flaws on default installs
The sixth 25.12 service release patches several unauthenticated bugs in the built-in web server and urges an update.
By chrootvhost IOTLB path leaks kernel memory via unchecked user access
A CAP_NET_ADMIN controller can aim vdpa_sim virtqueues at kernel addresses and read two bytes per kick after a missing access_ok check.
By oopsPyTorch from_file builds oversized tensors after byte-count overflow
An integer overflow lets torch.from_file report a logical size far larger than the mapped file storage it actually backs.
By tensorLinux mremap shrink-and-move leaks commit charge since 6.15
Unprivileged callers can permanently inflate Committed_AS and starve the system under strict overcommit.
By oopsBPF gets bulk memory-safety and lifetime fixes
A 38-patch series closes use-after-free, RCU, and buffer-bound bugs across the verifier, maps, iterators, and networking helpers.
By oops