USN-8853-1: OpenSBI vulnerability
A security notice published on September 30, 2026 reports incorrect index validation in requests to the SBI PMU extension, which could allow denial of service.
Read articleKnowledge you can apply
Cyber
Security for teams connecting data, documents and agents to AI.
CISA adds Cisco SD-WAN flaw to KEV catalog
On September 30, 2026, CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
Read articleStar Blizzard expands phishing against Ukraine supporters
A news item dated September 30, 2026, reports that the Star Blizzard group expanded its phishing operations and adopted a new technique to make malware infections easier.
Read articleCVE-2026-95616: denial-of-service flaw in Apache WSS4J
A September 30, 2026 bulletin reports an integer overflow in WSS4J DER parsing that could enable unauthenticated denial of service. Check the affected versions and verify details in the original advisory.
Read articleCVE-2026-92899: Apache WSS4J flaw
A notice published on September 30, 2026 describes how differing Base64 representations of a Nonce can bypass UsernameToken replay protection in Apache WSS4J. The stated severity is moderate.
Read articleCVE-2026-92121: WSS4J signature-check flaw
An alert published on September 30, 2026 reports that Apache WSS4J streaming mode may leave an internal signed-content flag enabled after an STR-Transform reference. The stated severity is moderate.
Read articleCVE-2026-89238: Apache WSS4J flaw
A notice published on September 30, 2026, reports that confusion among EncryptedHeader child elements may cause Apache WSS4J to treat attacker-controlled content as a decrypted header.
Read articleApache WSS4J flaw bypasses SAML authentication
A notice published on September 30, 2026 reports that a flaw in Apache WSS4J’s DOM processor may let unauthenticated remote attackers forge authenticated SOAP messages. The alert rates the severity as important and lists affected versions.
Read articleCVE-2026-87830: Apache WSS4J streaming validation flaw
A notice published on September 30, 2026 reports that certain XPath expressions may fail to match elements during StAX validation of WS-SecurityPolicy. The stated severity is low; check the affected versions and verify details in the original notice.
Read articleCVE-2026-85532: Apache WSS4J validation flaw
An advisory published on September 30, 2026 reports insufficient validation of derived-key parameters, with moderate severity and a risk of weak keys or excessive CPU use.
Read articleUAT-11587 and the Antino backdoor: an espionage campaign in Asia
A Cisco Talos report published on September 30, 2026, describes campaigns attributed with high confidence to UAT-11587 and the Antino backdoor, observed against institutional targets in several Asian countries.
Read articleOrdinary light proposed for quantum computing
A note published on September 30, 2026 reports an approach using bright ordinary light to solve computational problems and claims it avoids data losses associated with quantum processors.
Read articleSimpler mathematics for designing metamaterials
Published on September 30, 2026, the item reports a simplified mathematical approach to designing metamaterials that can control different kinds of waves.
Read articleApache PLC4X: CVE-2026-102511 in ADS discovery
A notice published on September 30, 2026 reports that spoofed responses in Apache PLC4X ADS discovery could influence the connection destination. The source gives a CVSS 4.0 score of 8.5 and lists versions before 1.0.0 as affected; confirm details in the original notice.
Read articleCVE-2026-102510: Apache PLC4Go flaw
A September 30, 2026 advisory reports allocation and framing flaws in Apache PLC4X for Go. Its CVSS 4.0 score is 8.7, high; version 1.0.0 is not affected.
Read articleCVE-2026-102509: resource flaw in Apache PLC4X
A notice published on September 30, 2026 reports pre-authentication resource exhaustion in PLC4J, Apache PLC4X’s Java implementation. Version 1.0.0 is listed as unaffected.
Read articleApache PLC4X: critical alert for the OPC UA secure channel
An alert published on September 30, 2026 reports a flaw in the Apache PLC4X OPC UA driver. It assigns CVSS 4.0 a score of 9.2 and lists versions before 1.0.0 in the 0.9.0 line as affected; version 1.0.0 is stated to be unaffected.
Read articleMoodle: notice highlights end of fixes for 3.9 line
A reply published on September 30, 2026 says security fixes for Moodle 3.9.x ended on December 11, 2023, and points to newer LTS versions to assess.
Read articlePCRE2: reply explains how to consult a security advisory
Published on September 30, 2026, the oss-sec feed item suggests retrieving a PCRE2 advisory description through the API and converting its Markdown to plain text. It gives no technical details of the flaw.
Read articleSANS ISC Stormcast: episode listed for September 30, 2026
The SANS ISC Stormcast feed lists an episode for Wednesday, September 30, 2026. The item gives no topic or additional description.
Read articleRota Nacional
Bring privacy into your workflow.
30 days, no card, with a starting quota. After that, Pix credit from R$ 10,00.