Cyber ·
CVE-2026-94002: memory risk in Apache MINA SSHD
A September 29, 2026 notice reports memory exhaustion in SFTP clients caused by unsolicited responses and lists affected versions.
Cyber
Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
CVE-2026-93996: DoS risk in Apache MINA SSHD
An advisory published on September 29, 2026 reports uncontrolled resource consumption while reading SCP command lines in the sshd-scp component. It rates the issue moderate, with a CVSS 3.1 score of 6.5.
Cyber ·
CVE-2026-93995: Apache MINA SSHD flaw
A notice published on September 29, 2026 reports inadequate validation in sshd-git that may let a JGit archive operation write a file to the server. It rates the issue moderate, with a CVSS 3.1 score of 6.5.
Cyber ·
Apache MINA SSHD: authentication policy flaw
A notice published on September 29, 2026 reports that Apache MINA SSHD servers using multi-factor authentication may bypass a requirement for different public keys. The issue has a CVSS 3.1 score of 8.1, rated high.
Cyber ·
CVE-2026-77185: critical Apache MINA SSHD flaw
A notice published on September 29, 2026 reports a possible authentication bypass in specific SSH server implementations using Apache MINA SSHD’s sshd-core. The flaw is rated CVSS 3.1 9.1.
Cyber ·
Discussion of multiple CVEs in Debian DSA 6528-1 bulletin
Published on September 29, 2026, the comment links the number of issues in the bulletin to Debian maintainers’ effort to avoid excessive changes. It suggests using the changelog to identify items relevant to a particular environment.
Cyber ·
Rust on GPUs: a prototype proposes a common target
Published on September 29, 2026, the report presents a proposal to compile conventional Rust code for GPUs without special libraries. The approach remains a prototype.
Cyber ·
groff 1.24.2 fixes security vulnerabilities
A bulletin published on September 29, 2026 announces groff 1.24.2 and says it fixes vulnerabilities affecting releases since 2012. The text gives no details about the flaws.
Cyber ·
Moodle 3.9.2: discussion does not confirm a CVE or exploit
A September 29, 2026 message clarifies that the oss-security mailing list does not assign CVEs and is not a way to bypass MITRE's process. The text does not, by itself, confirm an exploitable Moodle vulnerability.
Cyber ·
OpenSSL reports serious flaw in DTLS retransmissions
A notice dated September 29, 2026 describes a high-severity flaw in DTLS retransmission of handshake messages. The available excerpt does not provide affected versions or a fix.
Cyber ·
Discussion on libpng 1.6.59 distribution
On September 29, 2026, a post in the oss-sec feed asked where to find the official libpng 1.6.59 tarball, which the title describes as fixing CVE-2026-46675.
Cyber ·
The Linux kernel through PostgreSQL’s lens
At a 2026 Kernel Recipes talk, Andres Freund discussed how Linux kernel features and behavior affect PostgreSQL and how the kernel could better support applications.
Cyber ·
Tuesday security updates across Linux distributions
On September 29, 2026, a roundup from the LWN feed listed security updates from seven Linux distributions for kernels, browsers, libraries, and other components.
Cyber ·
CVE-2026-97395: Apache Polaris FileIO risk
A security feed reports that Apache Polaris versions before 1.8.0 may let FileIO requests be redirected to attacker-controlled endpoints.
Cyber ·
Sensors report scans for a file linked to Wordfence
A SANS ISC note published on September 29, 2026 reports a small number of scans for wordfence-waf.php and describes the file's connection to WordPress site protection.
Cyber ·
Dodo Pizza confirms cyberattack and possible data exposure
The Russian chain, with 1,500 locations, said customer data may have been compromised after hackers made claims. The reported categories include personal information and order details.
Cyber ·
Arizona reports theft of residents’ personal data
On September 29, 2026, the Arizona Supreme Court reported that hackers stole residents’ personal data. The court said the incident did not involve ransomware and that, as of Monday, no ransom demands had been made.
Cyber ·
Baicells Nova 430H flaw may temporarily disrupt cellular service
A CISA advisory published on September 29, 2026 describes a denial-of-service flaw in the Nova 430H eNodeB. The notice says no fix is planned and recommends reducing device exposure.
Cyber ·
CISA adds exploited Apple flaw to KEV catalog
On September 29, 2026, CISA reported adding CVE-2026-86950 to its KEV catalog: an out-of-bounds write flaw affecting several Apple products, with evidence of active exploitation.
Cyber ·
Critical Firmware Flaw in VIVOTEK Cameras
An alert published on September 29, 2026 says CVE-2026-22755 affects multiple VIVOTEK camera models. Command injection may enable remote execution, possibly as root; the vendor recommends installing the latest firmware.