Knowledge you can apply
Security for teams connecting data, documents and agents to AI.
Distributions including AlmaLinux, Debian, Fedora, Oracle, Red Hat, SUSE and Ubuntu published security updates for several packages, according to a machine-translated summary of the LWN feed.
Read articleLow-severity advisory on missing limits in Apache CXF StaxUtils, which can consume memory and CPU when parsing very large XML documents. Versions 3.6, 4.0 and 4.2 are listed as affected.
Read articleApache CXF advisory on the Netty-based HTTP client, which does not check that the host name matches the server TLS certificate, with affected versions and fixed release lines.
Read articleLow-severity advisory on Apache CXF: the multipart/MTOM attachment header parser did not fully enforce configured limits, which can lead to memory exhaustion. Fixed versions: 4.2.4, 4.1.9 and 3.6.13.
Read articleModerate-severity advisory on Apache CXF XML signature interceptors that did not guarantee the XML delivered to the application was covered by the verified signature. Fixed versions are listed.
Read articleSecurity advisory on Apache CXF STSTokenValidator, which shares the SAML signature validation result across requests. Versions from 4.2.0 before 4.2.4, from 4.0.0 before 4.1.9, and before 3.6.13 are listed as affected.
Read articleSecurity advisory on Apache CXF: validated STS tokens were cached using a 32-bit non-cryptographic hash, which may allow an attacker to craft a colliding token. Fixed versions are listed.
Read articleA low-severity flaw in the Apache CXF FIQL query parser, disclosed on 9 October 2026, can cause denial of service in specific version ranges.
Read articleIn October 2026, US lawmakers warned that a proposed sale of Spirit Airlines assets, linked to an AI training deal, could expose emails, messages and personal, employment and financial records.
Read articleUbuntu Security advisory on six libxml2 flaws that may lead to denial of service, code execution, XXE injection and SSRF. One of them affects only Ubuntu 26.04 LTS.
Read articleThe Go project marked v0.60.0 of golang.org/x/net to fix vulnerabilities, including memory exhaustion in an HTTP/2 server caused by Trailer headers. The advisory was forwarded through the oss-sec feed on October 8, 2026.
Read articleOn 8 October 2026 the Go project released versions 1.27.2 and 1.26.9, minor point updates that include 15 security fixes according to the project's announcement.
Read articleThe United States and other nations took down digital tools and infrastructure of Integrity Tech, a Beijing-based company, used for widespread vulnerability scanning and, in some cases, intrusions, as part of the Flax Typhoon campaign.
Read articleCisco Talos describes malware techniques that attempt to manipulate AI-assisted analysis and recommends treating text extracted from samples as evidence, not as instructions. The content is dated 8 October 2026.
Read articleThe Ubuntu Security feed published advisory USN-8909-1 on libde265, an H.265 decoding library. Crafted bitstreams can cause a NULL pointer dereference and make the program crash.
Read articleTomáš Šedovič, a program manager at the Rust Foundation, presented at Kangrejos 2026 how the Rust project organizes, tracks and changes its goals, with Rust for Linux developers in mind.
Read articleThe US Department of Justice charged the owner of a ransomware recovery company with wire fraud, alleging he secretly hid ransom payments while overcharging attack victims.
Read articleASOS said attackers accessed an employee's account and sent a fraudulent push notification. The investigation, conducted with outside experts, identified access to names, contact details and some non-personal account information.
Read articleA researcher describes searching for conversation history in OpenCode and Hermes to support forensic investigations of AI use. Published on 8 October 2026 through the SANS ISC feed.
Read articleA 25-year-old man who helped steal almost US$ 260,000 in cryptocurrency through a SIM swap fraud was sentenced to two and a half years in prison by a London court, according to the feed of The Record.
Read articleRota Nacional
30 days, no card, with a starting quota. After that, Pix credit from R$ 10,00.