PHP rebuilds Windows packages to fix Brotli flaw CVE-2026-111497
Rebuilt 8.2–8.5 Windows packages ship Brotli 1.2.1; cURL auto-decompression can reach the memory flaw, with no known attacks.
68
- Mentions · 7d4
- Mentions · 30d20
- All mentions34
- First seenSep 10, 2026
- Last mentioned4d ago
Timeline
34 articles · newest firstPHP2Shell flaws allow unauthenticated RCE; wild attacks reported
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws score CVSS 9.2.
86
IBM CEO says open-weight models now suit cheap on-prem use
Krishna told investors open models cost about 10–25% of frontier tokens while scoring near 90% as effective for most tasks.
32
Brotli decoder flaw CVE-2026-111497 also hits Node.js, Bun, Python and Envoy
Google rates the memory-corruption bug 9.2; code execution was shown only on one Node.js build, with no attacks reported.
74
Torvalds backs AI use by competent kernel developers, not drive-bys
Kernel maintainers are dropping the Assisted-by tag, so submitters no longer must disclose AI use.
34
Oracle emergency Java update distrusts weak eMudhra CAs (CVE-2026-91403)
The CVSS 9.1 JSSE flaw can let an on-path attacker forge trusted hostnames; no attacks are confirmed.
76
European public bodies adopt NVIDIA open models under local control
Work covers the Commission, Poland, the UK, Germany and France, including imaging, personas and a classified cloud plan.
38
Nvidia proposes OpenShell architecture to govern AI agents
The blueprint needs Vera Rubin, Vera CPUs and BlueField-4, while BBVA and Santander are only reviewing it.
50
Google open-sources TorchTPU for running PyTorch on TPUs
TPU support also landed in vLLM, SGLang, TorchTitan, Ray, and Hugging Face libraries, with two pieces still in preview.
58
Linux KVM guest-host escape PwnEscape rated 9.3
Malformed IPv4 checksum metadata can cross the guest-host boundary; an upstream kernel fix is reaching major distros.
78
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
Linux kernel flaw CVE-2026-99999 lets guest VMs read host memory, shown on Vercel sandboxes but not exploited in the wild.
82
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js 16.4.1 and 15.5.28 patch two critical unauthenticated RCE bugs and a Server Actions denial of service.
74
Re: Incomplete fix for Emacs CVE-2026-79992
Maintainers say the Emacs fix for CVE-2026-79992 is incomplete and request another CVE.
36
Lightwell project filters out 400 Java library vulnerabilities
IBM and Red Hat's Lightwell says it found more than 400 new vulnerabilities in widely used Java libraries.
62
[OSSN-0110] Ironic can leak basic auth credentials to image server
OpenStack Ironic can leak HTTP basic-auth credentials to a configured image server.
48
Java library vulnerabilities: IBM and Red Hat fix 400+ previously unknown flaws
IBM and Red Hat say Lightwell fixed more than 400 previously unknown Java library flaws without naming them.
52
CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1)
Unauthenticated Foreman requests can bypass provisioning tokens via IP/MAC fallback and expose build data.
52
autotrust/GLM5.3-Flash-E224-DGX-Spark — new model trending #29 on Hugging Face
autotrust released an unofficial pruned NVFP4 GLM-5.3-Flash build that fits two NVIDIA DGX Sparks.
44
Critical Red Hat Satellite Flaw Could Enable Root Password Theft and Code Execution Attacks
Red Hat fixed Satellite flaw CVE-2026-96659, which can leak host root passwords and enable Foreman command execution.
67
OpenClaw Launches Free Open-source Enterprise Agent Platform for AI Agents
OpenClaw launched OpenClaw Enterprise, a free open-source control plane for governed AI agents.
51
Linux Kernel CVE-2026-72018 Flaw Lets Local Attackers Gain Root Access
CVE-2026-72018 lets local CAP_NET_ADMIN users escalate to root through a Linux SMC-D out-of-bounds write.
66
NVIDIA Launches Open Agent Safety Platform: OpenShell Sandboxes Agents on Vera CPUs While Sentry on BlueField-4 Quarantines Them in Milliseconds
NVIDIA launched Open Agent Safety Platform, pairing OpenShell sandboxes with a BlueField-4 watchdog.
66
Sudo Security Vulnerability Lets Attackers Escalate Privileges
A Sudo flaw, CVE-2026-96512, lets local users bypass time-based sudoers rules via a crafted TZ variable.
66
Sudo Vulnerability Lets Attackers Bypass Time-Based Authorization Controls
CVE-2026-96512 lets local users skew Sudo time-based authorization windows via the TZ variable.
67
Abandoning Scientific Linux Was a Mistake
Article argues CERN/Fermilab's abandonment of Scientific Linux for CentOS was a mistake due to lost option value.
15
Re: Flatpak 1.18.1 fixes multiple vulnerabilities
Simon McVittie disclosed CVE identifiers for multiple vulnerabilities fixed in Flatpak 1.18.1, with two IDs still pending from MITRE.
38
Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
Bas Alberts asks Red Hat to assign a CVE for an incomplete Emacs fix of CVE-2024-53920.
42
Linux KVM/arm64 Vulnerability Lets Attackers Escape Virtual Machines and Gain Host Access
CVE-2026-89775 lets a malicious ARM64 KVM guest skip TLB invalidation and access host memory.
68
New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory
Linux kernel flaw CVE-2026-89775 lets ARM64 KVM guests read and write freed host memory, enabling guest-to-host escape.
52
Red Hat OpenShift Flaw Lets Attackers Poison Disconnected Registries With Malicious Releases
OpenShift oc-mirror flaw CVE-2026-75939 can bypass release signature checks and poison disconnected registries.
64
CISA alerts of active exploitation of three Linux kernel flaws
CISA says three Linux kernel flaws, one critical, are actively exploited and due for federal fixes today.
88
Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
Tomas Hoger asks oss-security whether GitHub or Red Hat will assign a CVE for Emacs's incomplete fix of arbitrary code execution bug CVE-2024-53920.
12
CISA Warns of Linux Kernel Vulnerabilities Actively Exploited in Attacks
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV with a September 21 federal patching deadline.
80
Hackers Can Turn Vulnerable LiteLLM AI Gateways Into Root Access and Cloud Credential Theft
Wiz found multiple LiteLLM AI gateway flaws, including a CVE-2026-59822 MCP auth bypass added to CISA KEV, enabling root code execution and cloud credential theft.
74
Related CVEs
by mentions- CVE-2025-396823%9.8Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-53266<1%8.8Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge)
- CVE-2025-399642%5.5Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg)
- CVE-2026-99999<1%9.3Linux kernel IPv4 checksum metadata can corrupt headers
- Improper TLB invalidation in Linux kernel KVM/arm64 risks cross-VM memory exposure
- CVE-2026-96512<1%7.8Time-window bypass via TZ manipulation in sudo NOTBEFORE/NOTAFTER rules
- CVE-2024-53920<1%7.8In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can…
- CVE-2026-79992<1%7.8Shell argument injection in GNU Emacs TRAMP (incomplete fix of CVE-2024-53920)
- Symlink escape in Flatpak before 1.18.1 lets sandboxed apps read/write host files
Appears with
- CISAorganization · 7
- Linux kernelproduct · 7
- Red Hatvendor · 6
- IBMorganization · 5
- Nvidiavendor · 4
- NVIDIAorganization · 3
- OpenAIorganization · 3
- Google Cloudorganization · 3
- Amazon Web Servicesorganization · 3
- IBMvendor · 3
- Googlevendor · 3
- SAPorganization · 2
- SUSEorganization · 2
- PHPvendor · 2
- Impervaorganization · 2
- OpenShellproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.