30
55
47
55
55
30
45
30
USN-8739-2: ImageMagick vulnerabilities
Ubuntu releases USN-8739-2, extending ImageMagick fixes for four CVEs including possible arbitrary code execution to Ubuntu 24.04 LTS.
USN-8739-2 provides the ImageMagick fixes from USN-8739-1 for Ubuntu 24.04 LTS. The flaws stem from incorrect handling of certain images that could allow an attacker to cause a denial of service or possibly execute arbitrary code. The affected CVEs are CVE-2026-56366, CVE-2026-56368, CVE-2026-56371, and CVE-2026-56373.
15
60
60
USN-8739-1: ImageMagick vulnerabilities
Canonical released USN-8739-1 fixing five ImageMagick flaws that could cause denial of service or arbitrary code execution.
Ubuntu security notice USN-8739-1 patches five ImageMagick vulnerabilities: CVE-2026-56366, CVE-2026-56368, CVE-2026-56371, and CVE-2026-56373 allow denial of service via crafted images on Ubuntu 14.04 through 22.04 LTS. CVE-2026-56370 affects Ubuntu 22.04 LTS and 26.04 LTS and could allow denial of service or arbitrary code execution. Users should apply the updated ImageMagick packages to affected releases.
25
30
35
IBM security advisory (AV26-922)
Canadian Cyber Centre relays IBM advisory for Langflow, MQ, and Sterling File Gateway flaws including MQ remote code execution (CVE-2026-13293).
Canadian Cyber Centre advisory AV26-922 relays IBM fixes for Langflow OSS (versions through 1.11.5 across release lines), IBM MQ (10.0.0.0 and 9.x LTS/CD through 9.4.5.1), and Sterling File Gateway (through 6.2.2.1). CVE-2026-13293 is a remote code execution flaw in IBM MQ Java messaging caused by an incomplete security scanner blocklist enabling network-based code execution. CVE-2026-19290 is an improper access control vulnerability in IBM Sterling File Gateway. Administrators are urged to review and apply the necessary updates.
30
55
30
USN-8770-1: SimpleSAMLphp vulnerabilities
Ubuntu patches SimpleSAMLphp signature validation and XXE flaws enabling user impersonation, privilege escalation, and information disclosure.
Ubuntu security notice USN-8770-1 fixes multiple SimpleSAMLphp vulnerabilities. CVE-2019-3465 stems from incorrect cryptographic signature validation in XML messages, allowing an authenticated attacker to impersonate users or gain elevated privileges; it only affected Ubuntu 16.04 LTS and 18.04 LTS. CVE-2024-52596 involves improper handling of external entities when parsing untrusted XML, allowing a remote attacker to obtain sensitive information, and did not affect Ubuntu 24.04 LTS. An additional flaw in signature verification for SAML messages using the HTTP-Redirect binding is also addressed.
20
Thelio Mira AI Linux Workstation: 192 GB GPU Memory
System76 launches the Thelio Mira AI Linux workstation from $3,299 with dual NVIDIA RTX Pro 6000 GPUs and 192 GB GPU memory for local AI workloads.
System76's Thelio Mira AI is a locally built (Denver, Colorado) Linux workstation for AI training, fine-tuning, and inference, starting at $3,299. Configurations go up to a 16-core AMD Ryzen 9000 CPU, 192 GB DDR5 RAM, and dual NVIDIA RTX Pro 6000 Blackwell GPUs delivering 192 GB of (ECC) GPU memory with liquid cooling, dual PCIe 5.0 x16 slots, and up to three M.2 NVMe drives. It ships with Pop!_OS 24.04 LTS or Ubuntu and is positioned as a way to avoid recurring cloud GPU costs.
15
USN-8741-1: Flatpak vulnerabilities
Ubuntu patched two Flatpak flaws, including a sandbox escape via app-controlled symlinks allowing host code execution (CVE-2026-34078).
Ubuntu security notice USN-8741-1 fixes two Flatpak vulnerabilities in Ubuntu 20.04 LTS, 22.04 LTS, and 24.04 LTS. CVE-2026-34078 stems from improper path validation in sandbox-expose options, letting a malicious or compromised Flatpak app use app-controlled symlinks to access arbitrary host files and gain code execution in the host context. CVE-2026-34079 involves improper path validation when removing outdated ld.so cache files, allowing a compromised app to delete arbitrary files on the host.
55
USN-8670-3: curl vulnerability
Ubuntu issued USN-8670-3 updating curl for Ubuntu 26.04 LTS to fix a flaw where wrong client certificates could be used on reused connections.
Ubuntu Security Notice USN-8670-3 extends the curl fix from USN-8670-1 to Ubuntu 26.04 LTS. The flaw, discovered by Joshua Rogers, involves incorrect handling of connection reuse when client certificate settings change, potentially causing the wrong client certificate to be presented. The issue can lead to authentication mix-ups rather than remote code execution.
22
USN-8679-2: Vim vulnerability
Ubuntu's USN-8679-2 updates Vim for Ubuntu 26.04 LTS, fixing a tags-file handling flaw that could allow arbitrary code execution.
Ubuntu Security Notice USN-8679-2 extends the Vim fix from USN-8679-1 to Ubuntu 26.04 LTS. The vulnerability stems from incorrect handling of certain tags files, which an attacker could exploit to execute arbitrary code. This is a routine distribution security update with no exploitation reported.
22
35
50
60
60
60
60
55
47
50
USN-8749-1: CivetWeb vulnerabilities
Ubuntu USN-8749-1 patches CivetWeb URI and HTTP request parsing flaws enabling remote DoS or possible code execution.
Ubuntu Security Notice USN-8749-1 addresses two CivetWeb vulnerabilities. CVE-2025-55763 involves incorrect URI parsing that could allow a remote attacker to cause denial of service or execute arbitrary code, affecting Ubuntu 22.04 LTS and 24.04 LTS. CVE-2025-9648 involves incorrect HTTP request parsing enabling remote denial of service.
25
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.
70
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).
Vercel patched two critical Next.js flaws enabling unauthenticated remote code execution: a heap buffer overflow in libheif's AVIF image scaling (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) and a Windows path traversal (CVE-2026-75604, CVSS 9.0). The AVIF flaw affects only sites explicitly enabling AVIF optimization and overwrites roughly 16,384 bytes past the buffer; the path traversal affects Windows-hosted Next.js deployments on versions 13.4-15.5.23 and 16.0-16.3.2. Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026, with the AVIF researchers releasing a Python PoC demonstrating RCE on multiple applications. No exploitation had been reported as of August 27, 2026.
68
60
60
60
60
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
60