Search: “erasure-codes”

30 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

SeverityAll critical 0 high 0 medium 0 low 0 info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Re: Retrospective by 'gpg.fail' authorsnew

oss-security follow-up to a gpg.fail authors' retrospective argues that GnuPG's unmaintained, forgotten code is a security liability and should be deleted.

On the oss-security mailing list, Soatok Dreamseeker responds to a retrospective published by the gpg.fail authors, asking why unmaintained code is retained and stating that forgotten, unmaintained code is a liability and effectively unmaintained by definition. The visible reply addresses Werner Koch and concerns GnuPG code maintenance. No specific CVE, flaw, or exploitation is described in this snippet.

oss-security17:16 UTC · 35m agoVulnerability 8 sources

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning

New gradient inversion attacks tied to erasure-coding theory recover 94–100% of ImageNet batches, showing federated learning privacy leakage is underestimated.

The paper connects gradient inversion in federated learning to erasure-correcting code theory, constructing analytic attacks that exceed previously known recovery bounds. The attacks recover batches exactly, with every sample's label, from a single FedSGD round, and certify each recovery without ground-truth data. On eight image and tabular benchmarks, even a passive attacker observing an honestly trained network recovers 94–100% of ImageNet batches up to size 128, and more than 90% actively at batch sizes of several hundred. The authors conclude that federated learning's privacy leakage has been underestimated.

arXiv cs.CRSep 9, 03:17 UTC · 7d agoResearch

Compiler Can Undo Your Security Checks

Chris Domas explains at Black Hat how legal compiler optimizations can strip security checks and memory-clearing operations, turning secure C source into vulnerable binaries.

David Bombal interviews researcher Chris Domas at Black Hat USA 2026 about how the C abstract machine permits compilers to legally transform code in ways that remove security protections, delete memory-clearing operations, and introduce time-of-check to time-of-use vulnerabilities. Factors like register pressure, structure layout, and data size affect vulnerability, with examples where 17 or 33 byte buffers are safe while nearby sizes produce vulnerable code. An AI-assisted analysis of 500 million lines of open-source code identified 300 potentially dangerous patterns. Recommended mitigations include enabling compiler warnings, using sanitizers, analyzing optimized builds, and testing the exact binary that ships.

Hacker News · securitySep 12, 14:07 UTC · 4d agoResearch HN 22↑ · 27 comments

When Models Edit Too Much: On the Fidelity of Minimal Code Edits

A 400-task BigCodeBench evaluation shows frontier LLMs widely over-edit code; a preservation instruction cuts excess edits and raises Pass@1 by 2.3 points.

Researchers built an evaluation framework from 400 BigCodeBench problems with injected AST-level corruptions, each with a known minimal patch, to measure over-editing in LLM code repair. Even strong models like GPT-5.5 produce unnecessarily large edits despite high Pass@1. Adding a preservation instruction reduced average excess Levenshtein distance from 0.195 to 0.131, cut added cognitive complexity by 26.6%, and raised Pass@1 by 2.3 points. Reinforcement learning post-training gave the best out-of-domain edit-fidelity trade-off, while supervised fine-tuning overfit to seen corruption patterns.

Hugging Face daily papersSep 2, 20:00 UTC · 13d agoAI research1

Memory-safety defects in the upstream (abandoned) AOSP OpenCORE AAC decoder, shipped unpatched by Samsung TizenRT

Abandoned AOSP OpenCORE AAC decoder has out-of-bounds-write and wild-pointer flaws reachable from attacker-controlled frames, unpatched in Samsung TizenRT.

The OpenCORE AAC decoder in AOSP's abandoned external/opencore tree contains memory-safety defects of the out-of-bounds-write and wild-pointer class. The code is still vendored and built by multiple projects, most notably Samsung's widely deployed TizenRT embedded RTOS. The defects are reachable from untrusted media because an AAC frame is attacker-controlled. The researcher is requesting a CVE ID for the issue.

oss-securitySep 10, 01:12 UTC · 6d agoVulnerability1

ZDI-26-583: Clam AntiVirus 7z Archive Parsing Integer Overflow Remote Code Execution Vulnerability

Zero Day Initiative discloses CVE-2026-20215, an integer overflow in ClamAV's 7z archive parsing enabling remote code execution, rated CVSS 8.4.

The Zero Day Initiative published ZDI-26-583 for an integer overflow in Clam AntiVirus's 7z archive parsing. A remote attacker can execute arbitrary code when the antivirus processes a crafted archive, with attack vectors varying by implementation. The flaw is tracked as CVE-2026-20215 and rated CVSS 8.4. The advisory does not mention active exploitation.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-202151

ZDI-26-649: (Pwn2Own) OpenAI Codex Improper Neutralization of Control Sequences Remote Code Execution Vulnerability

ZDI published advisory ZDI-26-649 for a CVSS 7.8 remote code execution flaw (CVE-2026-19591) in OpenAI Codex, demonstrated at Pwn2Own.

The Zero Day Initiative published advisory ZDI-26-649 describing a remote code execution vulnerability in OpenAI Codex, tracked as CVE-2026-19591 with a CVSS 7.8 score. The flaw involves improper neutralization of control sequences. Exploitation requires user interaction, as the target must open a malicious folder. The bug was demonstrated at Pwn2Own and disclosed through ZDI.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 4 sources CVE-2026-195911

Access Control as Verified Parse Constraints

Researchers verify a class of EverParse validators that correctly enforce access-control policies, deploying a machine-checked enforcement gate on seL4.

The paper targets enforcement-code bugs in commercial security gateways by proving that forward-only, backtrack-free EverParse validators are verified recognizers for a bounded finite-state class that includes access-control decision functions with fixed-offset fields and bounded disjunction. Encoding a bounded policy language into a fixed-size byte buffer allows an SMT solver to verify the enforcement code once, covering all byte values, policies, requests, and sessions. Editing rule content over a fixed endpoint set requires no new proof, while adding endpoints reruns the toolchain. A deployment on the seL4 microkernel ensures every request passes through the gate and unverified components cannot corrupt the enforcement chain.

arXiv cs.CRSep 11, 06:33 UTC · 5d agoResearch

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability NotesAug 25, 16:11 UTC · 22d agoVulnerability

ZDI-26-636: Oracle Outside In Technology PostScript File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a heap-based buffer overflow in Oracle Outside In Technology's PostScript parsing (CVE-2026-60412) enabling user-triggered remote code execution.

Zero Day Initiative published ZDI-26-636, a CVSS 7.8 heap-based buffer overflow in PostScript file parsing within Oracle Outside In Technology. Remote attackers can execute arbitrary code when the target opens a malicious file or visits a malicious page, making user interaction a requirement. The vulnerability is tracked as CVE-2026-60412. The advisory reports no exploitation.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoVulnerability 4 sources CVE-2026-604121

Understanding the Usability of Cryptographic Verification Tools

Survey of Tamarin and ProVerif users reveals usability barriers: debugging non-termination, model validation, and opaque proof failures hinder cryptographic protocol verification.

The paper presents an exploratory human-centered survey of researchers, graduate students, and practitioners with hands-on experience using Tamarin, ProVerif, and related cryptographic protocol verification tools. Findings reveal usability barriers across the verification workflow, including difficulties debugging non-termination and performance issues plus the lack of systematic methods for validating formal models against real protocols. When proofs fail without concrete attacks, users commonly simplify models, add helper lemmas, and revisit modeling abstractions. Participants called for actionable diagnostics, clearer explanations of results, visualization, and automation for recurring proof tasks.

arXiv cs.CRSep 14, 20:40 UTC · 1d agoResearch

Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild

Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.

CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.

Palo Alto Unit 42Aug 17, 13:03 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2025-32433

Fwd: XZ Utils 5.8.4 and a security fix

XZ Utils 5.8.4 fixes an invalid memory write that occurs when a decoder is reinitialized after allocation failure in 5.8.3 and older.

XZ Utils 5.8.4 has been released with a security fix for versions 5.8.3 and older. The flaw is an invalid memory write that can occur when a decoder is reinitialized after an allocation failure. The announcement was posted on the oss-security mailing list by Sam James pointing to the upstream stable release. Users and distributions running affected versions should upgrade to 5.8.4.

oss-securitySep 9, 18:28 UTC · 6d agoVulnerability

TasmScan: Continuation-Aware Taint Analysis for TVM Bytecode with Savelist Abstraction

TasmScan introduces source-free taint analysis for TON smart-contract bytecode, detecting 95.3% of defects with 96.8% precision and 17x speedup.

TasmScan is the first bytecode-level static analysis framework for the TON Virtual Machine, enabling cross-continuation data flow reasoning without source code by modeling savelist semantics through forward register analysis with formal over-approximation guarantees. It lifts bytecode into a typed intermediate representation (TASIR) and performs path-sensitive taint analysis. On a 208-contract benchmark with human-confirmed ground truth it detects 95.3% of defects across five classes at 96.8% precision, and resolves 294,546 dynamic continuation targets with 100% precision across 2,921 registry contracts. It achieves a 17x median speedup over symbolic-execution baselines.

arXiv cs.CRSep 15, 11:01 UTC · 1d agoResearch

ZDI-26-543: Microsoft Windows ICC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI discloses an out-of-bounds write in Windows ICC file parsing via Mscms.dll enabling remote code execution (CVE-2026-54984, CVSS 7.8).

ZDI advisory ZDI-26-543 describes an out-of-bounds write in Microsoft Windows ICC file parsing that allows remote attackers to execute arbitrary code. Exploitation requires interaction with the Mscms.dll color management library, though attack vectors may vary by implementation. The flaw has a CVSS rating of 7.8 and is assigned CVE-2026-54984.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-549841

An Empirical Analysis of CodeQL False Positives and Query Refinements for Java Vulnerabilities

Study of 167 Java CVE instances finds CodeQL false positives follow recurring patterns; query refinements remove 81.8% of reviewed ones.

Researchers ran CodeQL's Java security query suite on 167 CVE instances from 110 projects, manually reviewing 500 sampled false-positive paths and building a five-category taxonomy led by Missed Path Constraint or Sanitization (36.6%), Benign Execution Context (29.4%), and Missing Trust Boundary Modeling (27.6%). Guided by the taxonomy, query-level refinements removed 81.8% of reviewed false positives and 15.8% of reported paths across the selected queries while retaining 7 of 8 true positives. To address generalization, agentic coding tools given the refinement patterns as templates adapted them to new projects successfully in 56% and 62% of tasks, versus 28% without guidance.

arXiv cs.CRSep 3, 22:48 UTC · 12d agoResearch1

Retrofitting Code Using LLMs to Support Exceptional Behavior

EXCODER combines static/dynamic analysis with LLMs to retrofit exception-handling code, achieving 85.92% pass@1 with Qwen 2.5 Coder 32B on Java benchmarks.

The paper introduces the task of retrofitting existing code with Exception Related Code (throw statements, guarding conditions, try/catch blocks) so that given Exceptional Behavior Tests pass. EXCODER performs context engineering by integrating static and dynamic program analysis output with LLMs; it was evaluated on a benchmark built from 304 methods across 75 GitHub Java projects. Combined with Qwen 2.5 Coder 32B, EXCODER achieves pass@1, 5, and 10 rates of 85.92%, 86.18%, and 86.51%, roughly 13 percentage points over baseline, and manual inspection reveals remaining limitations.

arXiv cs.AI / cs.LG / cs.CLSep 9, 16:18 UTC · 7d agoAI research1

ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.

The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.

arXiv cs.CRSep 8, 00:05 UTC · 8d agoResearch

USN-8772-1: AOM vulnerabilities

Ubuntu USN-8772-1 patches four libaom flaws (CVE-2026-56208 to CVE-2026-56211) that could cause heap overflow, arbitrary memory writes, or code execution.

Ubuntu Security Notice USN-8772-1 fixes a heap buffer overflow in libaom's first-pass statistics buffer handling in Look-Ahead Processing mode (CVE-2026-56208), potentially causing denial of service or arbitrary code execution. Three additional flaws in spatial and temporal layer ID validation in the SVC encoder controls (CVE-2026-56209, CVE-2026-56210, CVE-2026-56211) allow arbitrary memory writes, out-of-bounds heap reads, or code execution. Users should apply the updated packages.

Ubuntu Security Notices09:29 UTC · 8h agoAdvisory CVE-2026-56208 CVE-2026-56209 CVE-2026-56210+1 CVEs

ZDI-26-553: OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI discloses OriginLab Origin Viewer OGW file parsing memory corruption RCE (CVE-2026-18294, CVSS 7.8) exploitable via malicious file or page.

ZDI advisory ZDI-26-553 describes a memory corruption vulnerability in OriginLab Origin Viewer's parsing of OGW files, tracked as CVE-2026-18294 with a CVSS score of 7.8. Remote code execution is possible but requires user interaction, meaning the target must open a malicious file or visit a malicious page.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-18294

ZDI-26-585: OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI reported an out-of-bounds write in OriginLab Origin Viewer's OGWU parsing (CVE-2026-19885) that allows remote code execution via crafted files.

ZDI-26-585 details an out-of-bounds write vulnerability when OriginLab Origin Viewer parses OGWU files, leading to remote code execution. A successful attack requires the user to open a malicious file or visit a malicious page. The flaw carries a CVSS rating of 7.8 and is tracked as CVE-2026-19885. No in-the-wild exploitation is mentioned.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-19885

ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI advisory ZDI-26-587 details a heap-based buffer overflow RCE (CVE-2026-19781, CVSS 7.8) in Ashlar-Vellum Cobalt VS file parsing, requiring user interaction.

The Zero Day Initiative released advisory ZDI-26-587 covering a heap-based buffer overflow in Ashlar-Vellum Cobalt's VS file parsing. A remote attacker can execute arbitrary code when the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-19781.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-19781

ZDI-26-586: OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI advisory ZDI-26-586 reports a memory corruption RCE (CVE-2026-19886, CVSS 7.8) in OriginLab Origin Viewer OGM file parsing, needing user interaction.

The Zero Day Initiative published advisory ZDI-26-586 describing a memory corruption vulnerability in OriginLab Origin Viewer's OGM file parsing. Exploitation allows remote code execution when a user opens a malicious file or visits a crafted page. ZDI rated the issue CVSS 7.8 and assigned CVE-2026-19886.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-19886

CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

Critical ZooKeeper flaw lets any authenticated client delete arbitrary empty persistent or container znodes by bypassing ACL checks.

CVE-2026-79993 (critical severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific empty znodes in the data tree regardless of ACL restrictions on the znode or its parent. This can corrupt coordination state for dependent distributed systems like Kafka, HBase, or Solr clusters relying on ZooKeeper.

oss-securitySep 15, 18:24 UTC · 23h agoVulnerability CVE-2026-79993

CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

CVE-2026-16028: Protocol::HTTP2 Perl library before 1.14 lets closed streams linger in the connection table, enabling remote memory exhaustion.

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion because closed streams are never removed from the connection stream table by stream_state. The flaw was disclosed on oss-security by Robert Rothenberg on September 7, 2026. Users should upgrade to Protocol-HTTP2 1.14 or later on CPAN.

oss-securitySep 7, 18:45 UTC · 8d agoVulnerability CVE-2026-16028

SEMA-GUARD: Semantic and Graph-Based Vulnerability Detection in Assembly Code

SEMA-GUARD uses semantic analysis and graph neural networks to detect vulnerabilities in assembly code, achieving 85.1% accuracy on a Juliet-derived benchmark.

SEMA-GUARD is a framework that detects vulnerabilities in compiled programs when source code is unavailable, targeting malware, firmware, and embedded systems analysis. It enriches control flow graphs with low-level execution semantics including stack manipulations, memory accesses, and data flow. Evaluated on a Juliet Test Suite set compiled to assembly and split into function-level chunks, it achieves 85.1% accuracy and an F1 score of 0.801, outperforming purely statistical or structural approaches.

arXiv cs.CRSep 15, 14:35 UTC · 1d agoResearch1

Closing the Loop: Bidirectional Fully Encrypted Protocols

Researchers show naively composing unidirectional fully encrypted protocols is detectable and construct provably secure bidirectional FEPs, validated in Rust.

The paper introduces formal security definitions for bidirectional fully encrypted protocols (BiFEPs), covering exact shaping, delivery, protocol-state integrity, private half-close, and cross-direction isolation. It shows trivially composing two unidirectional FEPs enables detection attacks via cross-direction dependencies like traffic imbalance and connection tear-down. The authors construct provably secure BiFEPs for datastream and datagram settings, validated with a Rust implementation; no surveyed deployed protocol provides the full set of properties.

arXiv cs.CRSep 15, 16:32 UTC · 1d agoResearch

New AI Attack Hides Malicious Instructions in Normal-Looking Text to Evade Safety Filters

Check Point researchers show crafted prose hides policy-violating instructions that bypass all tested LLM gatekeepers, including GPT-4o mini and Llama Guard 3.

A new prompt-crafting technique embeds malicious payloads inside grammatical, natural-looking text without Base64, invisible Unicode, or obvious encodings, defeating lightweight pre-screening gatekeepers. In testing, all four evaluated gatekeeper models—gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3:8b—classified the crafted wrappers as safe at a 100% bypass rate across 23 obfuscated prompts. GPT-5 Thinking in high-reasoning mode recovered and acted on the hidden instruction in 17 of 18 tests (~94.4%), often spending over a minute and multiple Python executions. Researchers recommend paraphrasing untrusted input, hardening gatekeeper policies, and applying defense-in-depth controls for agentic deployments.

GBHackersSep 11, 05:53 UTC · 5d agoAI safety & security 2 sources

Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems

An empirical study finds no major agent-memory system enforces fact revocation at retrieval, causing agents to act on superseded, unsafe information.

Researchers tested five agent-memory systems across nine policy scenarios, nine models, and six defense conditions, tracking whether revoked facts are returned and acted upon. No system enforces revocation by default: revoked records are returned whenever the revocation label is visible to the retrieval layer, outrank their replacements, and lead agents to unsafe actions. The authors propose a backend-agnostic guard that sits between the agent and any memory store and withholds revoked or conflicting records at retrieval time.

arXiv cs.CRSep 8, 05:03 UTC · 8d agoAI safety & security

ZDI-26-550: OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI discloses a memory corruption flaw in OriginLab OriginPro OGW file parsing enabling remote code execution via malicious files (CVE-2026-18291, CVSS 7.8).

ZDI advisory ZDI-26-550 describes a memory corruption vulnerability in OriginLab OriginPro OGW file parsing that allows remote attackers to execute arbitrary code. User interaction is required: the target must visit a malicious page or open a malicious file. The flaw has a CVSS rating of 7.8 and is assigned CVE-2026-18291.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-18291