Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Solar Designer says oss-security volume and subscriber churn remain elevated amid AI vulnerability-report floods.
28
Organization
oss-security
- Mentions · 7d0
- Mentions · 30d1
- All mentions18
- First seenSep 8, 2026
- Last mentioned14d ago
Timeline
18 articles · newest firstRe: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
oss-security thread proposes hashing sorted Module.symvers CRCs under CONFIG_MODVERSIONS to fix four Linux local root vulnerabilities without breaking module ABI.
45
CVE-2026-78030: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
Perl DBI before 1.653 loads arbitrary modules via unvalidated DBD::DBM dbm_type and dbm_mldbm attributes, enabling code execution with attacker-controlled attributes.
52
Exim Security Release 4.100.1
Exim released security update 4.100.1 addressing vulnerabilities in the widely used open-source mail transfer agent; details remain sparse.
45
Re: Removing dead code (was: Retrospective by 'gpg.fail' authors)
oss-security thread on removing dead code after the gpg.fail retrospective, with Peter Gutmann describing a decade-long deprecation and removal process.
10
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
Follow-up on four Linux local root vulnerabilities dubbed DirtyAH6, PPPoEject, TUNderflow, and DiagSpill, advising kernel attack surface reduction as mitigation.
55
A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
Four local root privilege escalation vulnerabilities in the Linux kernel, aged 10-21 years, disclosed as CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469.
62
Re: Removing dead code (was: Retrospective by 'gpg.fail' authors)
oss-security discussion cites DejaGnu's removed test-timeout feature as a rare case where dead code removal had security implications.
12
Re: pcre2 version 10.48 released with security fixes
PCRE2 10.48 released with security fixes; seven vulnerabilities assigned CVEs including CVE-2026-86145 and CVE-2026-89156 through CVE-2026-89162.
45
Re: AI slops from Eve
oss-security maintainer Solar Designer explains the list moderates by content rather than sender domain amid ongoing AI-generated spam postings.
5
Re: AI slops from Eve
oss-security contributor Joe Krause warns that emails from mail provider cock.li, which he says hosts many script kiddies, should be treated as spam.
5
Re: AI slops from Eve
oss-security moderator Solar Designer says he may reject repetitive AI-generated postings after debate over AI slop submissions.
12
Re: AI slops from Eve
oss-security commenter argues AI models remain human-built algorithms while reflecting on recent AI-slop incidents in open-source
12
Re: AI slops from Eve
Eli Schwartz on the oss-security list criticizes AI-generated 'slop' posts from 'Eve', urging the community to stop anthropomorphizing bots.
4
AI slops from Eve
oss-security moderator Solar Designer approved three AI-generated vulnerability reports from automated security researcher Eve, sparking debate over AI slop on the list.
18
libpcap 1.10.7 fixes 7 vulnerabilities
libpcap 1.10.7 fixes seven vulnerabilities, including CVE-2026-31912 affecting the deprecated bpf_filter(), and all users are advised to update.
45
Security fixes in libfuse-3.18.3
libfuse 3.18.3 disables fuse_session_custom_io() by default to stop non-kernel peers from forging FUSE requests libfuse parses unvalidated.
30
Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more
Linux kernel developers discuss a batch of 21 local privilege escalation CVEs, including ZcopyReaper (CVE-2026-43502) in the RDS networking driver.
45
Related CVEs
by mentions- CVE-2026-74469<1%8.8Linux kernel: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit…
- CVE-2026-86145<1%8.2Out-of-Bounds Write in PCRE2 Regular Expression Library (pcre2_dfa_match)
- Incorrect free (double free) in PCRE2 JIT matching before 10.48
- CVE-2026-68121<1%7.8Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject)
- CVE-2026-43502<1%7.8Linux kernel: net/rds: handle zerocopy send cleanup before the message is queued
- CVE-2026-89157<1%7.4Out-of-Bounds Write in PCRE2 32-Bit Builds via Attacker-Supplied Large Patterns
- CVE-2026-89160<1%6.5Out-of-Bounds Read in PCRE2 pcre2_match on Invalid UTF Subjects
- CVE-2026-89156<1%5.9Out-of-Bounds Read in PCRE2 pcre2_match via JIT Fallback on Invalid UTF Data
- CVE-2026-31912<1%5.5Out-of-bounds read in libpcap BPF interpreter can crash packet-capture processes
- CVE-2026-89162<1%3.3Two-byte information disclosure in PCRE2 pcre2_serialize_encode before 10.48
Appears with
- Linux kernelproduct · 4
- Linuxvendor · 3
- DejaGnuproduct · 1
- libfusevendor · 1
- Eximvendor · 1
- gpg.failorganization · 1
- Seclistsorganization · 1
- PCRE2 projectvendor · 1
- oss-securityvendor · 1
- Module.symversproduct · 1
- libfuseproduct · 1
- cock.livendor · 1
- Linux kernelvendor · 1
- PCRE2product · 1
- DBD::DBMproduct · 1
- Exim 4.100.1product · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.