Security Leftovers

posted by Roy Schestowitz on Oct 23, 2026

LWN ☛ Security updates for Thursday

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, cockpit-files, cockpit-machines, fetchmail, glycin-loaders, go-toolset:rhel8, golang, hostapd, jackson-core, kernel, kernel-rt, librsvg2, lrzsz, mariadb11.8, openexr, openssh, openssl, perl-DBI:1.641, python-urllib3, python3.12-urllib3, qt5-qtbase, rust-sequoia-sq, and xorg-x11-server-Xwayland), Arch Linux (php and php-legacy), Debian (bind9, firefox-esr, nginx, php8.2, and php8.4), Fedora (ca-certificates, dolphin, gnome-shell-extension-gsconnect, libdigidocpp, linux-firmware, nicotine+, perl-ExtUtils-Typemaps-Default, php, python-cairosvg, qdigidoc, rust-rustls-webpki, rust-webpki-root-certs, and rust-webpki-roots), Gentoo (PHP), Mageia (php8.5, php8.4), Oracle (perl-URI), Red Hat (go-toolset:rhel8, golang, grafana-pcp, kernel, kernel-rt, nodejs-nodemon, nodejs22, nodejs24, nodejs:22, nodejs:24, rhc, and sudo), Slackware (php), SUSE (aliyun-cli, bouncycastle, buildah, ca-certificates-mozilla, chromedriver, cifs-utils, cyrus-sasl, docker, firefox, gimp, git-bug, GraphicsMagick, libheif, libpng16, libraw, libsoup-2_4-1, mutt, onefetch, openexr, openssh, openssl-certs, php7, php8, poppler, python-hpack, python310, python313-Django4, qemu, rootlesskit, tiff, xwayland, and yt-dlp), and Ubuntu (c-ares, ghostscript, libsoup3, libxs-parse-keyword-perl, nss, php5, php7.0, php7.2, php7.4, php8.1, php8.3, php8.5, poppler, pyjwt, u-boot, and unbound).

• Tom's Hardware ☛ 480,000 phishing emails sent from a PC hidden behind a fridge in a Japanese hotel room

  Almost 500,000 phishing emails were sent from a PC hidden behind a fridge in a Kobe, Japan, hotel room.

• New York Times ☛ What Is PHP? Why Are Government and Business Websites Going Offline?

  A critical security flaw in the programming language underpinning much of the web has prompted a global rush to patch vulnerable systems.

• New York Times ☛ PHP Security Flaw Sets Off Global Rush to Patch, Leaving Websites Offline

  Governments and businesses around the world scrambled to prevent hackers from exploiting a vulnerability in PHP, a popular programming language.

• The Straits Times ☛ Japan’s banks and airlines pull digital services offline in scramble to fix PHP flaws

  Japan is particularly vulnerable due to its heavy reliance on legacy software and outsourcing.

• The Straits Times ☛ Millions of hacking attempts as companies, governments rush to patch critical PHP flaws

  PHP developers released urgent fixes on Oct 21 for vulnerabilities that had lurked in the software for years.

• Security Week ☛ PHP2Shell Exploitation Started Days Before Patches

  Initial attempts were observed on October 17, and mass activity began shortly after patches were released.

• Bruce Schneier ☛ New Serious PHP Vulnerabilities Released and Patched

  PHP maintainers have released fixes for two critical vulnerabilities: [...]

• LRT ☛ Around 100 Lithuanian websites vulnerable to critical PHP flaw, cybersecurity chief says

  Around 100 websites in Lithuania have been identified as vulnerable to a critical flaw in PHP, a programming language used by an estimated 80% to 90% of websites in the country, the head of the National Cyber Security Centre said Thursday.

• Latvia ☛ Preventing risks or quick response – what matters most in the age of cyberattacks?

  The temporary shutdown of several Latvian government and municipal websites, along with restrictions on access to certain digital services, has raised concerns about the security of information systems. These measures were prompted by two critical vulnerabilities in the widely used PHP programming language, potentially affecting thousands of digital resources in Latvia and millions worldwide.

• OpenSSF (Linux Foundation) ☛ Who Checked It? Attestations, Gemara, and CRA Due Diligence

  Discover how the OpenSSF Gemara project clarifies the complex world of security attestations, streamlines software supply chain evaluations, and helps organizations confidently meet EU Cyber Resilience Act (CRA) due diligence requirements.

• Security Week ☛ Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU

  Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches.

• Security Week ☛ Cisco Patches 34 Vulnerabilities Across Multiple Products

  Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.

• Security Week ☛ Splunk, SolarWinds Release Fresh Security Updates

  Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.

• Web Browsers/Web Servers/Feed Readers

  • Daniel Stenberg ☛ “ignore the slop”

    Lots of people who are against the use of Hey Hi (AI) for all its ethical and inherent issues tell me this. Just ignore it. Don’t let big Hey Hi (AI) control us. The “slop” they refer to is anything created that involved an AI, and in our case (the curl project) it is in particular vulnerability reports.

  • Andrew Nesbitt ☛ Trust Stores Are Dependencies Too

    eMudhra generated eight of its intermediate CA certificates incorrectly, so their private keys can be recovered from the certificates themselves. Firefox (OneCRL and CRLite) and Chrome (CRLSets) blocked the intermediates on 17 October, Apple on the 19th, and Microsoft on the 20th through Windows’ automatic trust list updates. The disclosure page states that “many other clients do not consume revocation information and require software updates”, and its fix table lists the packages that carry their own copy of the roots: [...]