Security and Windows TCO Leftovers

posted by Roy Schestowitz on Nov 06, 2026

• LWN ☛ Security updates for Thursday

  Security updates have been issued by AlmaLinux (dpdk, httpd:2.4, kernel, kernel-rt, mysql:8.0, php:7.4, php:8.0, qt5, ruby:2.7, ruby:3.0, tesseract, webkit2gtk3, and xorg-x11-server-Xwayland), Debian (imagemagick, puppet-agent, symfony, trapperkeeper-authorization-clojure, and xen), Fedora (3proxy, bind, bind-dyndb-ldap, curl, dhcpcd, erlang-jose, forgejo, freetype, laszip, libical, libmongocrypt, markdownlint-cli2, mongo-c-driver, openbao, pipx, python-boto3, python-botocore, python-crate-ingredients, python-lxml-html-clean, python3.11, python3.13, python3.14, python3.15, roundcubemail, rply, ruby-build, rust-app-store-connect, rust-qemu-rdp, rust-redlib, scribus, and valkey), Mageia (minetest, python-pypdf, stunnel, znc, and zvbi), Oracle (.NET 10.0, bind, brotli, cockpit, dpdk, fence-agents, freerdp, gimp, glibc, grafana, gvfs, host-metering, kernel, python-dns, qemu-kvm, raptor2, tesseract, webkit2gtk3, and xorg-x11-server-Xwayland), Red Hat (grafana and pcs), Slackware (rsync), SUSE (amazon-cloudwatch-agent, apache2, aws-efs-utils, brotli, cephfs, coredns, cramfs-tools, firefox-esr, fuse-overlayfs, ghostscript, GraphicsMagick, libpolkit-agent-1-0-128, libsoup, nvidia-open-driver-G07-signed, perl-Dancer2, python-PyJWT, python313-joserfc, rsyslog, switcheroo, trivy, valkey, vexctl, and xdg-desktop-portal), and Ubuntu (apt, libphp-adodb, net-snmp, pillow, squid, and twisted).

• OpenSSF (Linux Foundation) ☛ Case Study: Kubescape Completes All Six Security Slam Badges with OpenSSF

  Kubescape completed all six project-level badges in the Fall 2026 Security Slam, bringing maintainers and community contributors together to strengthen security across its open source Kubernetes platform. Learn how 150+ hours of community contribution helped achieve OSPS Baseline Level Two status and harden 12+ repositories.

• Tom's Hardware ☛ PHP vulnerability post-mortem reveals bug was known two years ago

  PHP has a harvest season to remember — AI-automated bug hunting reaps what years of technical debt have sown.

• SANS ☛ Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)

  This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for CVE-2023-20198.

• Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 337 released

  The diffoscope maintainers are pleased to announce the release of diffoscope version 337. This version includes the following changes:

  * Mark that the test_nupkg_compressed_files test requires the tlsh Python

  * module. (Closes: #1151752)

• Qt ☛ Security Issue CVE-2026-114366: Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework

  An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module has been discovered and has been assigned the CVE id CVE-2026-114366.

• Security Week ☛ Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day

  Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests.

• Security Week ☛ The Agent Smith Dilemma: Governing Agentic Identities

  Every autonomous Hey Hi (AI) agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.

• Security Week ☛ Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws

  Cisco patched an RCE in UCS Central Software; WatchGuard fixed authentication and MitM flaws.

• Security Week ☛ Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns

  More than 200 sites were seen serving phishing content to first-time visitors but not to those who revisit.

• Bleeping Computer ☛ Hackers backdoor Linux servers using trojanized CWP web server

  A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.

• Linux Kernel IPv4 TCP Use-After-Free Vulnerability (CVE-2026-98432) Advisory

  Recently, NSFOCUS CERT monitored that Linux released a security update to fix the Linux Kernel IPv4 TCP use-after-free vulnerability (CVE-2026-98432). Due to a race condition issue in the Linux kernel IPv4 network subsystem when concurrently handling TCP connection requests or socket migration, an unauthenticated attacker can trigger a use-after-free by sending specially crafted TCP packets. This can result in kernel information disclosure, memory corruption, or denial of service, and under specific conditions, achieve remote code execution. The CVSS score is 9.8. Currently, vulnerability details and PoC have been publicly disclosed; relevant users are advised to take protective measures as soon as possible.

• Windows TCO / Windows Bot Nets

  • Tom's Hardware ☛ Hackers target French blood service fridges following supermarket attacks

    Following the string of cyberattacks on supermarket freezers, blood banks in France were recently attacked. Luckily, no biomaterial was lost as the attack triggered the EFS' alerts.

  • France24 ☛ French bank hit by cyberattack, hackers steal $100 million

    French regional bank Crédit Mutuel Arkéa said Wednesday it had been hit by a cyberattack that led to fraudulent transfers worth around 100 million euros ($112 million). The bank said the attack, which has since been "contained", allowed hackers to access its own accounts and transfer funds to other banks. Customer accounts were not affected, and no losses were reported by clients.

  • Security Week ☛ Cyberattack Hits French Blood Bank Site but No Blood Products Are Compromised

    The incident comes after supermarkets in a number of European countries reported this week that their fridges and freezers warmed up after they were remotely hacked.