CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation(penligent.ai)

52 points by cobychapple 3 days ago | 32 comments

A Penligent blog post analyzing CVE-2026-98432, a Linux kernel IPv4 TCP handshake use-after-free, its severity scores, exploitation evidence, and how to validate patches.

Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more(broccoli2shell.com)

384 points by theanonymousone 9 days ago | 200 comments

Aikido blog post explaining CVE-2026-111497, a critical Brotli decoder out-of-bounds write affecting Node.js, Python, and HTTP libraries, with patch versions and workarounds.

Spoofing OpenPGP.js signature verification(codeanlabs.com)

86 points by ThomasRinsma 1 year ago | 29 comments

Encrypted traffic interception on Hetzner and Linode targeting Jabber service(notes.valdikss.org.ru)

637 points by f311a 3 years ago | 257 comments

Blog post detailing discovery of a TLS man-in-the-middle interception of jabber.ru XMPP servers hosted on Hetzner and Linode using Let's Encrypt certificates.

OpenSSH Ships on Every Mac, Linux Server and Windows. Its Creator Trusts No One(zbruceli.org)

4 points by zbruceli 27 days ago | 0 comments

Long-form blog profile of OpenSSH creator Theo de Raadt, covering his NetBSD exit, lost DARPA grant, and security-focused philosophy.

Show HN: Iceoryx2 – Fast IPC Library for Rust, C++, and C(ekxide.io)

104 points by elfenpiff 2 years ago | 30 comments

Oracle Security Alert Advisory – CVE-2026-91403 (eMudhra cert revocation)(oracle.com)

14 points by rayhaanj 11 days ago | 3 comments

Oracle security alert for CVE-2026-91403, a remotely exploitable CVSS 9.1 JSSE vulnerability affecting Java SE and GraalVM, with affected versions and patch links.

CVE-2026-111943: Compromised Intermediate Certificate Authority(nvd.nist.gov)

314 points by keks24 11 days ago | 120 comments

NVD vulnerability detail page for CVE-2026-111943, described in the title as a compromised intermediate certificate authority.

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation(penligent.ai)

52 points by cobychapple 3 days ago | 32 comments

A Penligent blog post analyzing CVE-2026-98432, a Linux kernel IPv4 TCP handshake use-after-free, its severity scores, exploitation evidence, and how to validate patches.

OpenClaw privilege escalation vulnerability(nvd.nist.gov)

493 points by kykeonaut 7 months ago | 232 comments

NVD entry for CVE-2026-33579, a privilege escalation vulnerability in OpenClaw; the captured screenshot shows a Reddit network-policy block page instead.

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown(wiz.io)

424 points by bo0tzz 6 months ago | 89 comments

Wiz Research blog post detailing CVE-2026-3854, a critical flaw in GitHub's internal git infrastructure enabling remote code execution on GitHub.com and GitHub Enterprise Server.

CVE Foundation(thecvefoundation.org)

401 points by layer8 1 year ago | 71 comments

Press release dated April 16, 2025 announcing the launch of the CVE Foundation to secure the future of the CVE vulnerability identification program.