news
Security Leftovers
-
APNIC ☛ The delicate art of cryptographic maintenance: When small certs break big chains
Around mid-2026, we began receiving user complaints about certificate validation failures. The failure wasn’t a single bug, but the collision of optimization and slow distribution.
-
Qt ☛ Security advisory: CVE-2026-15037 - XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
An XML injection (improper output neutralization) vulnerability in the Qt XMLQDom comment, CDATA section, and processing-instruction serialization of the Qt Framework (QtXml module) has been discovered and has been assigned the CVE id CVE-2026-15037.
-
SANS ☛ When the "Autonomous Attacker" Is Your Own Hey Hi (AI) Model, (Thu, Jul 23rd)
-
LWN ☛ Security updates for Thursday
Security updates have been issued by AlmaLinux (acl, dogtag-pki, dovecot, glibc, go-toolset:rhel8, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, httpd:2.4, javapackages-tools:201801, libtiff, mariadb-connector-c, perl-HTTP-Daemon, pki-deps:10.6, and sssd), Debian (bind9, chromium, firefox-esr, and pdns-recursor), Fedora (chromium, collectl, fractal, kernel, libssh, llvm, nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, perl-DBI, perl-YAML-Syck, and srt), SUSE (7zip, GraphicsMagick, ImageMagick, multipath-tools, perl-YAML, python-sqlparse, python3-sqlparse, python313-bleach, and sssd), and Ubuntu (apache2, commons-beanutils, exim4, gawk, giflib, gst-plugins-good1.0, krb5, libapache-mod-jk, libarchive, libgphoto2, libhtml-parser-perl, linux-aws, linux-aws-5.15, linux-aws-fips, linux-fips, linux-ibm, linux-nvidia, linux-fips, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle, linux-ibm, linux-oracle, linux-ibm-5.15, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-nvidia-tegra, linux-nvidia-tegra-igx, linux-oem-6.17, linux-oracle-6.8, python-aiohttp, and tar).
-
AccessNow ☛ Oral statement at the United Nations Global Mechanism on ICT Security
-
Pen Test Partners ☛ Click. Click. Fake it until they make it… inside
TL;DR The Problem In this online world it’s been easier than ever to order what you need, when you need and to the exact specifications you want… mostly. The clothing world, alongside many other sectors, is plagued by fakes to the cost of billions, and these figures have increased year upon year for quite a while.
-
Security Week ☛ New Check Point Zero-Day Vulnerability Exploited in the Wild
The vulnerability tracked as CVE-2026-16232 has been exploited against customers with certain configurations.
-
Security Week ☛ Chick-fil-A Accounts Get Fried in Credential Stuffing Attack
Threat actors used credentials obtained from other companies to hack into Chick-fil-A One accounts.
-
Security Week ☛ Upbound Group Says Data Breach Led to $13 Million in Fraudulent Contract Losses
Hackers recently obtained non-sensitive customer information and other documents from the company.
-
Broadcom Inc ☛ 4 Application Control Updates That Help Teams Move Faster
Support for more devices, privileged access, simplified sign-ins, and keeping Linux environments current—all without loosening security