USN-8883-2: Go vulnerability
Ubuntu fixes a Go 1.23 x/net/idna Punycode flaw that could bypass hostname access controls.
Stories per day · 30 days
1 RSS
8 stories, newest first · one card per story
Stories tagged #punycode
USN-8914-1: Google Guest Agent, Google OS Config Agent vulnerability
Ubuntu USN-8914-1 patches Punycode handling in Google Guest Agent and OS Config Agent that allowed hostname access-control bypass and privilege escalation.
Researchers Discover New Domain Spoofing Techniques That Bypass Chrome’s Phishing Protections
Researchers showed IDN lookalike domains can evade Chrome’s Unicode display and near-match phishing warnings.
New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing
Researchers showed Chromium can display Unicode brand lookalike domains as readable text, bypassing Punycode warnings.
Two characters open up a world of typosquatting opportunities in Chromium browsers
Researchers demonstrate Cyrillic barred-o and Latin k-hook glyphs bypass Chromium's anti-spoofing checks, letting lookalike domains like fake Apple and Okta render as genuine.
4
USN-8883-1: Go vulnerability
Ubuntu fixed a Go x/net/idna flaw that can bypass hostname controls via Punycode labels.
CVE-2026-74766: Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode
Perl Net::IDN::Punycode before 2.590 has a heap use-after-free when decode_punycode reallocates its buffer.
Search results are sending people to fake Bitrefill checkouts
Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.
1