Security Leftovers

posted by Roy Schestowitz on Oct 31, 2026

• LWN ☛ Security updates for Friday

  Security updates have been issued by AlmaLinux (aspell, cjose, curl, gcc-toolset-15-gcc, httpd:2.4, ignition, java-21-openjdk, libX11, libXi, libXrender, libXtst, mariadb:10.11, nodejs:24, python-pillow, python3.12-urllib3, and webkit2gtk3), Debian (imagemagick, libdatetime-timezone-perl, python-git, tor, tzdata, vlc, and wordpress), Fedora (accessibility-inspector, akonadi-calendar, akonadi-calendar-tools, akonadi-contacts, akonadi-import-wizard, akonadi-mime, akonadi-search, akonadi-server, akonadiconsole, akregator, alligator, analitza, angelfish, applet-window-buttons, arianna, ark, artikulate, audex, audiocd-kio, audiotube, aurorae, baloo-widgets, blinken, bluedevil, bomber, bovo, breeze-gtk, brotli, bup, calendarsupport, calindori, calligra, cantor, colord-kde, cxx-rust-cssparser, dolphin, dolphin-plugins, dragon, elisa-player, eventviews, falkon, fcitx-configtool, ffmpegthumbs, filelight, firefox, flatpak-kcm, francis, ghostwriter, granatier, grantlee-editor, grantleetheme, grub2-breeze-theme, gwenview, incidenceeditor, isoimagewriter, itinerary, juk, k3b, kaccounts-integration, kaccounts-providers, kactivitymanagerd, kaddressbook, kajongg, kalarm, kalgebra, kalk, kalm, kalzium, kamera, kamoso, kanagram, kapman, kapptemplate, kasts, kate, katomic, kbackup, kblackbox, kblocks, kbounce, kbruch, kcachegrind, kcalc, kcalutils, kcharselect, kclock, kcolorchooser, kcron, kde-cli-tools, kde-connect, kde-dev-scripts, kde-dev-utils, kde-gtk-config, kde-inotify-survey, kde-partitionmanager, kdebugsettings, kdecoration, kdeedu-data, kdegraphics-mobipocket, kdegraphics-thumbnailers, kdenetwork-filesharing, kdenlive, kdepim-addons, kdepim-runtime, kdeplasma-addons, kdesdk-kioslaves, kdesdk-thumbnailers, kdevelop, kdevelop-php, kdevelop-python, kdf, kdialog, kdiamond, kdnssd, kdominate, keditbookmarks, keepsecret, keysmith, kf6-baloo, kfind, kfourinline, kgeography, kget, kglobalacceld, kgoldrunner, kgpg, kgraphviewer, khangman, khealthcertificate, khelpcenter, kidentitymanagement, kig, kigo, killbots, kimagemapeditor, kimap, kinfocenter, kio-admin, kio-extras, kio-gdrive, kirigami-gallery, kiriki, kiten, kitinerary, kjournald, kjumpingcube, kldap, kleopatra, klettres, klickety, klines, kmag, kmahjongg, kmail, kmail-account-wizard, kmailtransport, kmbox, kmenuedit, kmines, kmix, kmousetool, kmouth, kmplot, knavalbattle, knetwalk, knights, knighttime, knot, koko, kolf, kollision, kolourpaint, kompare, kongress, konqueror, konquest, konsole, kontact, kontactinterface, kontrast, konversation, kopeninghours, korganizer, kosmindoormap, kpat, kpimtextedit, kpipewire, kpkpass, kpmcore, kpublictransport, kqtquickcharts, krdc, krdp, krecorder, kreversi, krfb, kruler, ksanecore, kscreen, kscreenlocker, kshisen, ksirk, ksmtp, ksnakeduel, kspaceduel, ksquares, ksshaskpass, ksudoku, ksystemlog, ksystemstats, kteatime, ktimer, ktnef, ktorrent, ktouch, ktrip, ktuberling, kturtle, kubrick, kunifiedpush, kup-backup, kwalletmanager5, kwave, kwayland, kwayland-integration, kweather, kweathercore, kwin, kwin-zones, kwordquiz, kwrited, layer-shell-qt, libgravatar, libkcddb, libkdcraw, libkdegames, libkdepim, libkeduvocdocument, libkexiv2, libkgapi, libkleo, libkmahjongg, libkomparediff2, libksane, libkscreen, libksieve, libksysguard, libktorrent, libplasma, libquotient, lokalize, lskat, mailcommon, mailimporter, marble, markdownpart, massif-visualizer, mbox-importer, merkuro, messagelib, mimetreeparser, mingw-python-certifi, minuet, neochat, ocean-sound-theme, okular, oxygen-sounds, palapeli, pam-kwallet, parley, perl-Alien-Brotli, picmi, pim-data-exporter, pim-sieve-editor, pimcommon, plasma-activities, plasma-activities-stats, plasma-bigscreen, plasma-breeze, plasma-browser-integration, plasma-camera, plasma-desktop, plasma-dialer, plasma-discover, plasma-disks, plasma-drkonqi, plasma-firewall, plasma-integration, plasma-keyboard, plasma-login-manager, plasma-milou, plasma-mobile, plasma-nano, plasma-nm, plasma-oxygen, plasma-pa, plasma-phonebook, plasma-print-manager, plasma-sdk, plasma-settings, plasma-setup, plasma-systemmonitor, plasma-systemsettings, plasma-thunderbolt, plasma-union, plasma-vault, plasma-wayland-protocols, plasma-welcome, plasma-workspace, plasma-workspace-wallpapers, plasma5support, plasmatube, plymouth-kcm, plymouth-theme-breeze, polkit-kde, powerdevil, poxml, qmlkonsole, qqc2-breeze-style, qrca, rocs, sddm-kcm, signon-kwallet-extension, skanlite, skanpage, skladnik, spacebar, spectacle, step, svgpart, sweeper, tokodon, trafficserver, umbrello, xdg-desktop-portal-kde, yakuake, and zanshin), Mageia (cfitsio, libsolv, tomcat, and xrdp), Oracle (bind, cjose, curl, dogtag-pki, expat, gcc-toolset-15-gcc, ignition, kernel, libX11, libXrender, libXtst, php, python3.12-urllib3, and webkit2gtk3), SUSE (389-ds, aws-nitro-enclaves-binaryblobs-upstream, brotli, chromium, firefox, flatpak, gnutls, google-osconfig-agent, haproxy, hawk2, kernel, libapr1, libtcnative-1-0, tomcat, liboath-devel, libpcre2-16-0, librecad, libXi-devel, libXtst-devel, python311, python313, python313-markdown2, python313-xhtml2pdf, rabbitmq-server, roundcubemail, rust-keylime, and xen), and Ubuntu (dotnet8, dotnet10, dotnet11).

• NVISO Labs ☛ Detection Engineering: Implementing Detection-as-Code in an Existing Environment: Part 1 – Introduction and Concept

  How do you introduce Detection-as-Code into an environment where detections are already being developed and deployed? This customer case study examines the technical challenges and migration steps involved in improving detection engineering while keeping existing operations running.

• Canonical ☛ Why embargoes matter for open source security

  Open source is built on a foundation of transparency, collaboration, and speed. We share code, we share ideas, and together, we build better software. But when it comes to discovering and patching security vulnerabilities, that standard model of immediate, public sharing has to temporarily shift. A security embargo is a temporary agreement to keep a software vulnerability private so that vendors and maintainers can create and release a security patch before malicious actors learn how to exploit it.

• Security Week ☛ Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

  Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.

• Qt ☛ Security advisory: CVE-2026-105924 NULL pointer dereference vulnerability in QCborValue to JSON conversion impacts Qt

  A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module has been discovered and has been assigned the CVE id CVE-2026-105924.

• Security Week ☛ TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

  An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.

• Security Week ☛ In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Clownflare Hey Hi (AI) Data Leak

  Noteworthy stories that might have slipped under the radar: Iran eyed in military freezer hacks, Copenhagen University breach, AI-powered malware.

• Scoop News Group ☛ Apple notifications alert victims in 99 countries about mercenary spyware infections

  The notifications come shortly before the Pall Mall Process is nearing final negotiations on guidelines for the use of commercial hacking tools.

• Security Week ☛ $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack

  Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds.

• Security Week ☛ Drupal Commerce Core Vulnerability Exploited Against Online Stores

  Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.

• Security Week ☛ Fresh WordPress Vulnerability in Attackers’ Crosshairs

  Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

• Security Week ☛ PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

  Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

• Federal News Network ☛ ‘Dangerous:’ CISA official criticizes company’s decision to release PHP bug early

  Security firm Chainguard broke an embargo on a critical vulnerability. A CISA official says that's "dangerous" as Hey Hi (AI) creates more chaos for cyber defenders.

• Qt ☛ Security advisory: CVE-2026-107457 Memory corruption vulnerability in QMqttClient impacts Qt MQTT

   A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module has been discovered and has been assigned the CVE id CVE-2026-107457.

• Qt ☛ Security advisory: CVE-2026-111487: Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework

  An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module has been discovered and has been assigned the CVE id CVE-2026-111487.

• Science Alert ☛ Scientists Identified Hundreds of New Vulnerabilities in Cars, And They're Not Mechanical

  Here's what you should know.