55
Homebrew 7.0.0 is out, here’s what changed for security
Homebrew 7.0.0 closes eight security advisories, including a High sudo execution bug fixed in 6.0.12, and ships brew vulns vulnerability scanning.
Homebrew 7.0.0 closes eight security advisories rated one High, two Moderate, and five Low. The High flaw let unsigned cask removal metadata execute commands with sudo (fixed in 6.0.12), while the 7.0.0 Moderate closes a LaunchServices escape that let a malicious cask execute code outside the macOS install sandbox. The release ships brew vulns, which checks installed formulae against OSV.dev, extends build attestation verification to third-party tap bottles, and replaces Bubblewrap with Landlock sandboxing on Linux.
40
Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory
Two VLC 3.0 flaws, CVE-2026-56711 (heap corruption, CVSS 8.6) and CVE-2026-73324 (memory leak), let crafted PNGs or RTSP playlists corrupt memory or leak data.
Hap Security researcher Fabian Wahle disclosed two VLC Media Player flaws on September 9, 2026, affecting versions 3.0.0 through 3.0.23. CVE-2026-56711 (CVSS 8.6) is an integer overflow and out-of-bounds write in the AllocatePicture function, exploitable via a crafted PNG with oversized IHDR dimensions, potentially causing crashes or code execution. CVE-2026-73324 (CVSS 6.9) lets a malicious RTSP server read adjacent heap memory through an unterminated 4096-byte response line, triggerable via a realrtsp playlist URL. No patched release is confirmed yet; users should avoid untrusted media files, playlists, and RTSP streams.
52
Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass
Flextype CMS v1.0.0-alpha.3 API endpoints accept a NULL access_token because isset() validation lets requests bypass authentication.
Flextype CMS v1.0.0-alpha.3 API endpoints can declare access_token as a required parameter, but required-parameter validation only verifies the key exists in the request data. Authentication is then verified inside an isset($data['access_token']) condition, which in PHP treats a NULL value as absent. This allows requests supplying a NULL access_token to bypass authentication on affected endpoints. The flaw was disclosed on the Full Disclosure mailing list on September 3, 2026.
28
60
55
60
30
47
30
30
55
30
30
60
30
60
55
60
47
47
42
55
42
30
42
60
55
42
60
30
55
30
42
55
30
60
55
42
55