news
Security Leftovers
-
Qt ☛ Security advisory: CVE-2026-107472 Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt
QTextCodec TSCII encoding of the Qt 5 Compatibility Hey Hi (AI) module (Qt Core in Qt 5 and earlier) has been discovered and has been assigned the CVE id CVE-2026-107472.
-
Qt ☛ Security advisory: CVE-2026-105946 Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt
An out-of-bounds read vulnerability in the Qt NTLM authentication handling of the Qt Network module has been discovered and has been assigned the CVE id CVE-2026-105946. Applications using QNetworkAccessManager or QTcpSocket that authenticate with NTLM, including through a proxy, are affected.
-
Qt ☛ Security advisory: CVE-2026-107590: Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt [Ed: Add slop hype, get holes]
An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility Hey Hi (AI) module (Qt Core in Qt 5 and earlier) has been discovered and has been assigned the CVE id CVE-2026-107590.
-
Gentoo ☛ The next circle of security hell
A few years back I wrote “The modern packager’s security nightmare”. Have things improved since? On the contrary, I feel like we’re slipping down a well-oiled slope with no end in sight. Vulnerabilities are reported at unprecedented rates. A lot of people are doing everything they can to patch them up, which doesn’t necessarily mean they’re not making things even worse. Complex software involves complex trees of dependencies, and every branch on that tree needs tending to. When they stop being reliable, people further down the tree start taking more weight. And there’s a limit of how much a single person can do, so what started as an effort to resolve an issue upstream may quickly become a weakness.
-
LWN ☛ Security updates for Tuesday
Security updates have been issued by AlmaLinux (bind, bind9.18, brotli, buildah, container-tools:4.0, container-tools:rhel8, firefox, flatpak, freeipmi, gcc, golang, grafana, httpd, kernel, kernel-rt, libreswan, libX11, lrzsz, nodejs:14, nodejs:18, oci-seccomp-bpf-hook, podman, python-urllib3, python3.9, python38:3.8 and python38-devel:3.8, skopeo, thunderbird, xorg-x11-server, and xz), Debian (inkscape, swupdate, thunderbird, and valkey), Fedora (brotli, dolphin, helix, kernel, libical, mingw-python3, nsd, perl-Alien-Brotli, perl-Plack, perl-Plack-Middleware-ReverseProxy, rust-dua-cli, rust-gengo-bin, rust-gitui, stgit, unshield, and webkitgtk), Mageia (evolution, freetype2, ghostscript, kronosnet, libde265, libical, libjxl, packages, perl-DBI, perl-ExtUtils-Typemaps-Default, perl-Imager, vim, and webkit2), Oracle (bind, bind9.18, brotli, buildah, ca-certificates, firefox, flatpak, freeipmi, grafana, httpd, kernel, libreswan, libX11, lrzsz, nodejs22, nodejs24, nodejs:22, oci-seccomp-bpf-hook, perl-DBI:1.641, perl:5.32, postfix, postgresql16-pgvector, postgresql18-pgvector, python3.9, skopeo, unbound, xorg-x11-server, and xz), Red Hat (grafana, grafana-pcp, python3.12-urllib3, and python3.14-urllib3), SUSE (ca-certificates-mozilla, chromium, gn, cifs-utils, containerd, cpupower, cyrus-sasl, gcc13, gcc7, go1.26, go1.27, google-osconfig-agent, kernel, kubernetes-old, libsoup, libX11, libXi, openssh, podman, python-nltk, python-PyJWT, python-social-auth-core, rekor, runc, suseconnect-ng, and unbound), and Ubuntu (brotli and nginx).
-
Federal News Network ☛ CISA gives agencies days to patch critical PHP bugs
CISA says hackers are actively exploiting the critical PHP vulnerabilities, as agencies have until Thursday to apply patches.
-
BBC ☛ How one man became the unsung hero of the internet during a cyber-security scramble
For more than 20 years, Ondřej Surý has been quietly helping to keep websites around the world running securely, largely in his spare time.
He voluntarily maintains software for two of the most popular versions of Linux, a free operating system similar to Windows, which are often used on web servers.
Typically, this involves keeping them up-to-date with the latest version of PHP, a programming language which underpins a significant number of the world's websites.
-
Security Week ☛ Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Blue Initiative indexes nearly 30,000 IT and OT vulnerabilities relevant to ships and ports, 37 of them in maritime-specific products.
-
Security Week ☛ Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges.
> -
Security Week ☛ Unexplained DreamHost Incident Prompts Email, FTP Password Resets
The company says it reacted to an issue affecting some of its systems, including DreamHost webmail.
-
Security Week ☛ HPE Patches Dozens of Critical Flaws in Networking Products
Eight max-severity security defects could lead to remote code execution and authentication bypass.
-
Security Week ☛ Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
A leaked SquareML access key could have been used to access a database containing personal and health information.
-
Scoop News Group ☛ What happens when security tools go dark before the ransomware
A China-linked ransomware crew disabled the security tools at a critical infrastructure operator before it launched the encryptor. Most security budgets never priced that in.
-
Security Week ☛ Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released.