30
30
30
30
30
CVE-2026-49362: Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
CVE-2026-49362: unauthenticated attackers can create arbitrary durable queues in ActiveMQ Artemis via the CORE protocol, enabling denial of service.
A missing authentication check in the CORE protocol handler of Apache Artemis and Apache ActiveMQ Artemis, tracked as CVE-2026-49362, lets unauthenticated remote attackers create arbitrary durable queues. This enables unauthorized broker state manipulation and potential denial of service. Affected versions are artemis-server in Apache Artemis 2.50.0 through 2.56.0 and ActiveMQ Artemis 1.0.0 through 2.44.0. Apache rates the issue as important.
38
How an Emerging Industrial Protocol Family Could Put OT at Risk
New research shows unprotected Time-Sensitive Networking industrial protocols could let attackers disrupt or manipulate physical processes in OT environments.
Research covered by Dark Reading examines an emerging family of industrial protocols based on Time-Sensitive Networking (TSN) and finds that unprotected implementations could be attacked to disrupt or manipulate physical processes. The findings highlight growing OT risk as these protocols proliferate in industrial deployments; no confirmed exploitation is reported.
38
30
30
30
30
30
30
50
35
CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table
CVE-2026-16028: Protocol::HTTP2 Perl library before 1.14 lets closed streams linger in the connection table, enabling remote memory exhaustion.
Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion because closed streams are never removed from the connection stream table by stream_state. The flaw was disclosed on oss-security by Robert Rothenberg on September 7, 2026. Users should upgrade to Protocol-HTTP2 1.14 or later on CPAN.
28
TuxBot v3: Inside an IoT Botnet Framework With LLM
Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.
Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.
45
30
30
30
35
30
30
30
30
50
30
30
30
30
50
30
30
30
35
30
35
30
35
35