60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
NIST and CISA finalize playbook to stop token theft and forgery
NIST and CISA finalized NIST IR 8587, a playbook helping federal agencies and cloud providers defend identity tokens against theft and forgery.
The finalized NIST IR 8587 guidance covers protecting token signing keys, verifying tokens, lifetimes, revocation, session management, and dividing security responsibilities between cloud providers and customers. It cites an incident in which foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency. It also recommends extending token protections to AI agents and preparing identity systems for a future post-quantum cryptography transition.
60
60
ISC Releases Security Patches for New BIND DNS Software Vulnerabilities
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
NLnet Labs patched a critical heap overflow (CVE-2026-81642) in Unbound's DNSSEC validator that a malicious DNS zone can trigger for possible RCE.
Unbound 1.26.1, released September 17, fixes nine CVEs, including critical heap overflow CVE-2026-81642 (CVSS 9.1) in the DNSSEC validator, which affects every version through 1.26.0 and can be triggered by an attacker controlling a malicious zone that serves a DNSKEY record with a compression pointer into its own data, causing denial of service and possibly remote code execution. CVE-2026-82717, a heap corruption in CNAME synthesis reported by Ben Morris of Anthropic, could also lead to RCE under certain systems and compilation options. NLnet Labs has not reported exploitation and CISA marks CVE-2026-81642 exploitation as none; standalone and combined patches are available alongside the 1.26.1 release.
68