vulnerability

Daniel Lockyer highlights a remarkably short fix for a critical CVSS 9.8 Linux kernel vulnerability, linking to further details.

Researchers found that Lenovo's purportedly encrypted fingerprint-protected USB drive is actually just a plain, unencrypted SD card inside a case, offering no real data protection.

Parameter Labs disclosed a complex attack chain against ChatGPT's HTML preview artifacts that allowed sandbox escape, JavaScript execution, and exfiltration of private user data via crafted share URLs. OpenAI patched the flaw and paid a $5,000 bug bounty, which was criticized as too low for such a severe vulnerability.

CVE-2026-116155 discloses a memory leak in ImageMagick's ParseInternalDoctype, where parameter-entity values from crafted XMP DOCTYPE internal subsets are never freed; users are advised to upgrade to ImageMagick 7.1.2-33 or 6.9.13-58 or block XMP profiles via policy.xml.

The Molly fork of Signal has not been updated in three months and remains vulnerable to security flaws already patched in mainline Signal, prompting recommendations to switch back to the official Signal app.

Akamai/Linode published a customer security advisory regarding CVE-2026-98432, a recently disclosed remote code execution vulnerability, stating that it is actively investigating and applying mitigations while monitoring its platform.

Go security team warns about CVE-2026-98432, a use-after-free bug in Linux kernel IPv4 TCP handling enabling RCE (exploit demonstrated by Anthropic via MPTCP listeners), recommending a patched kernel upgrade and detailing how to disable MPTCP defaults in Go programs.

CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP handshake path that could allow remote exploitation, with a Linux CNA CVSS of 9.8 and Red Hat's preliminary 8.1 score, while Anthropic's Frontier Red Team demonstrated remote root execution against an MPTCP listener; the article reviews patch validation and distribution-specific remediation steps.

A security researcher details a cross-site scripting (XSS) vulnerability in yarr, an open-source RSS reader written in Go, stemming from permissive iframe src sanitisation logic and same-origin domain checks that can be bypassed.

Alpine Linux reported a security incident in which an attacker attempted to exploit critical GitLab vulnerability CVE-2026-97229 (a CVSS 10.0 bug in Ruby's Onigmo regex engine affecting CI configuration parsing), prompting a full rebuild of its GitLab instance and password resets. The post warns that upgrading GitLab alone is insufficient because the fix lives in a bundled Ruby patch, requiring Ruby 3.3.13/3.4.12/4.0.9 or later.

A critical 9.5-rated memory-corruption vulnerability (CVE-2026-97631) in the TianoCore EDK II UEFI firmware codebase affects most servers worldwide, exposing the pre-boot chain of trust after an accidental premature disclosure via an AMI pull request.

As of October 28, Apple's macOS developer tools including git, curl and python3 still trust the compromised eMudhra certificates, and macOS 27.2 reverted manual workarounds, leaving HTTPS connections and credentials potentially interceptable while other projects shipped fixes earlier.

A tweet promoting a discussion with CrowdStrike on PHP2Shell, covering how the vulnerability was found, the disclosure process, and practical next steps for security teams including assessing exposure and applying fixes.

Tailscale is investigating serious privilege-escalation vulnerabilities in Tailscale SSH that could allow authorized users to exceed their configured permissions, with a patched client release targeted by the end of October 27.

Troy Hunt's weekly update reflects on the aftermath of the 'PHP2Shell' vulnerability hype, noting the predicted cyber apocalypse never materialized and attributions to real breaches were scarce despite widespread vulnerable sites.

一篇 TIL 博客指出 POSIX 的 wordexp(3) 默认启用命令替换，即使传入 WRDE_NOCMD，musl 和 macOS 的 libc 实现也可能被绕过，建议不要在不可信输入上使用它。

Security researchers disclosed a complete bypass of eMudhra's one-factor OTP-based login system, allowing unauthorized account access without the one-time password.

Muse disclosed a design flaw where shared artifact URLs were discoverable via passive DNS, prompting a temporary shutdown of sharing while the issue was fixed; old links now redirect to a notice requesting new URLs, and the Muse bug bounty program offers up to $300,000 for valid reports.

黑客在 PHP 两个严重漏洞（CVE-2026-109618、CVE-2026-109619）正式补丁发布前几天就已尝试利用，据 Amazon Threat Intelligence 报告，其蜜罐系统在 10 月 17 日即检测到 PHP2Shell 攻击活动。PHP Foundation 承认修复因兼容性问题被拖延，并表示将加快未来漏洞的处理流程。

Hackers had a four-day head start exploiting severe PHP vulnerabilities discovered by OpenAI, Calif, and Wiz, flaws affecting up to 70% of websites worldwide and prompting urgent alerts from the NSA, NCSC, and White House.