Researcher argues public 0-day disclosure beats selling or using them
Aaron Rainbolt's oss-security reply prefers publication over sale or weaponization, but the post is cut off.
Stories per day · 30 days
8 RSS
Relatedapache-answer7mailing-list6apache5php5rce5vulnerability-disclosure5authorization4access-control3apache-kylin3cve3fake-recruiter3information-disclosure3kylin3ai-generated2ai-reports2authentication2denial-of-service2domain-takedown2
84 stories, newest first · one card per story
Stories tagged #oss-security
Jenkins advisory reports multiple vulnerabilities
An October 28 oss-security note links the Jenkins advisory but gives no flaw, version or fix details.
Poster says PHP 5.4.0 and newer hit by CVE-2026-109619 RCE
An oss-security reply widens the stale-global-state flaw beyond the subject’s PHP 8.2–8.5 range.
Node.js security releases for October 21 are out
The mailing-list reply says an URL lists the releases, but this excerpt names no issues or versions.
oss-security reply questions PHP CVE-2026-109619 identity
The post only relays a claim that the issue may be a different vulnerability, with no technical details.
PHP 8.2–8.5 RCE via stale global state reported
A mailing-list note says Fediverse reports of the fix are not yet fully confirmed.
Wheeler supports a separate oss-security list for AI vulnerability reports
He says open-weight models are already viable for finding and fixing flaws, and AI-hardened projects will become hard to attack.
OSS authors say newer AI audits mostly surface obscure bugs
Peter Gutmann says later models find issues that need extraordinary circumstances after earlier findings were fixed.
oss-security reply doubts a separate list would end vulnerability volume
Jan Schaumann says reporting stays cheaper than analysis, fixes, and long-term software maintenance.
oss-security poster expects repeating waves of AI vulnerability reports
Martin Steigerwald says fixed AI-found bugs should not be reported again, then harder bugs may follow.
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
oss-security contributors propose digests or a separate list to manage a flood of AI vulnerability reports.
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Peter Gutmann backs splitting oss-security so Apache CVE floods do not bury the main list.
CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction
GPAC MP4Box divide-by-zero CVE-2025-55653 crashes the importer on crafted MP4 files with a zero-denominator fraction.
Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10)
Registrar clientHold on 10 October 2026 suspended taikotalent.xyz, a domain tied to a fake-recruiter trojan.
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Solar Designer says oss-security volume and subscriber churn remain elevated amid AI vulnerability-report floods.
CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content
Apache Answer through 2.0.2 lets unauthorized users read or change reaction metadata on restricted content.
CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController
Apache Kylin through 5.0.4 lets unauthorized users read the SQL blacklist.
CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup
Unauthenticated users can trigger Apache Kylin metastore cleanup on versions 4 through 5.0.4; patch is 5.0.5.
Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10)
An oss-security moderator says a reported taikotalent.xyz fake-recruiter trojan looks AI-generated, though the domain exists.
FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10)
Fake-recruiter trojan distributed via taikotalent.xyz has been taken down after the registrar placed the domain on clientHold on October 10.
2
Re: Incomplete fix for Emacs CVE-2026-79992
Salvatore Bonaccorso flags CVE-2026-108976 as an incomplete fix for Emacs CVE-2026-79992.
Upcoming Node.js security release 2026/10/21
Node.js pre-announced security releases for 21 October 2026, with no CVE details yet.
Re: Incomplete fix for Emacs CVE-2026-79992
Maintainers say the Emacs fix for CVE-2026-79992 is incomplete and request another CVE.
Fwd: Announcing FreeType version 2.15.0
FreeType 2.15.0 fixes CVE-2026-95512, CVE-2026-50811, and vendored zlib flaw CVE-2026-27171.