Cyber ·
CVE-2026-85532: Apache WSS4J validation flaw
An advisory published on September 30, 2026 reports insufficient validation of derived-key parameters, with moderate severity and a risk of weak keys or excessive CPU use.
Cyber
Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
UAT-11587 and the Antino backdoor: an espionage campaign in Asia
A Cisco Talos report published on September 30, 2026, describes campaigns attributed with high confidence to UAT-11587 and the Antino backdoor, observed against institutional targets in several Asian countries.
Cyber ·
Ordinary light proposed for quantum computing
A note published on September 30, 2026 reports an approach using bright ordinary light to solve computational problems and claims it avoids data losses associated with quantum processors.
Cyber ·
Simpler mathematics for designing metamaterials
Published on September 30, 2026, the item reports a simplified mathematical approach to designing metamaterials that can control different kinds of waves.
Cyber ·
Apache PLC4X: CVE-2026-102511 in ADS discovery
A notice published on September 30, 2026 reports that spoofed responses in Apache PLC4X ADS discovery could influence the connection destination. The source gives a CVSS 4.0 score of 8.5 and lists versions before 1.0.0 as affected; confirm details in the original notice.
Cyber ·
CVE-2026-102510: Apache PLC4Go flaw
A September 30, 2026 advisory reports allocation and framing flaws in Apache PLC4X for Go. Its CVSS 4.0 score is 8.7, high; version 1.0.0 is not affected.
Cyber ·
CVE-2026-102509: resource flaw in Apache PLC4X
A notice published on September 30, 2026 reports pre-authentication resource exhaustion in PLC4J, Apache PLC4X’s Java implementation. Version 1.0.0 is listed as unaffected.
Cyber ·
Apache PLC4X: critical alert for the OPC UA secure channel
An alert published on September 30, 2026 reports a flaw in the Apache PLC4X OPC UA driver. It assigns CVSS 4.0 a score of 9.2 and lists versions before 1.0.0 in the 0.9.0 line as affected; version 1.0.0 is stated to be unaffected.
Cyber ·
Moodle: notice highlights end of fixes for 3.9 line
A reply published on September 30, 2026 says security fixes for Moodle 3.9.x ended on December 11, 2023, and points to newer LTS versions to assess.
Cyber ·
PCRE2: reply explains how to consult a security advisory
Published on September 30, 2026, the oss-sec feed item suggests retrieving a PCRE2 advisory description through the API and converting its Markdown to plain text. It gives no technical details of the flaw.
Cyber ·
SANS ISC Stormcast: episode listed for September 30, 2026
The SANS ISC Stormcast feed lists an episode for Wednesday, September 30, 2026. The item gives no topic or additional description.
Cyber ·
Study presents Spectre-v2 attacks against JIT engines
An announcement published on September 29, 2026 shares a study, paper, and proof-of-concept code on Spectre-v2 attacks against JIT engines using stale branch-prediction entries.
Cyber ·
Firefox 157.0 brings visual changes and AV1
Released on September 29, 2026, Firefox 157.0 highlights a visual redesign, hardware AV1 decoding in WebRTC calls, and various fixes.
Cyber ·
U.S. Air Force members sentenced in cyber theft exceeding $2 million
A September 29, 2026 item reports that two U.S. Air Force members received prison sentences of more than six years in a cyber theft case involving over $2 million.
Cyber ·
Paragon plans to go public by year-end
The spyware company plans to complete the deal near the end of 2026 and trade on Nasdaq under the REDLattice name, according to content in The Record’s feed.
Cyber ·
CPython race condition may delete files outside a temporary directory
A notice published on September 29, 2026 reports a race condition during tempfile.TemporaryDirectory cleanup that may delete files outside the temporary directory. The available text provides no technical detail beyond message headers.
Cyber ·
Apology after unauthorized access to government sites
A report dated September 29, 2026 says an AI company acknowledged shortcomings in its response to incidents involving Australian government websites.
Cyber ·
CVE-2026-94053: LDAP flaw in Apache MINA SSHD
A notice published on September 29, 2026 describes a critical LDAP injection flaw that may bypass authentication in Apache MINA SSHD’s sshd-ldap component.
Cyber ·
Critical LDAP authentication flaw in Apache MINA SSHD
A notice published on September 29, 2026 reports a critical LDAP password authentication flaw in Apache MINA SSHD. It affects versions before the stated fixes; the source assigns a CVSS 3.1 score of 9.1.
Cyber ·
CVE-2026-94029 in Apache MINA SSHD: memory exhaustion risk
A notice published on September 29, 2026 reports a moderate flaw in Apache MINA SSHD's sshd-sftp component. Exploitation requires privileges and may exhaust server memory; the excerpt lists fixed versions starting at 2.20.0 and 3.0.0-M6.