Cyber ·
Flatpak 1.18.4 fixes security vulnerabilities
A notice published on September 28, 2026 says Flatpak 1.18.4 fixes several vulnerabilities and considers all earlier versions vulnerable.
Cyber
Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
USN-8837-1: pdfminer PDF-processing vulnerabilities
A security notice published on September 28, 2026 says specially crafted PDFs may exploit pdfminer flaws and possibly allow arbitrary code execution.
Cyber ·
USN-8835-1: Emacs SVG handling vulnerability
A security notice published on September 28, 2026 reports that specially crafted SVG images may cause memory corruption in Emacs, potentially leading to a crash, denial of service, or disclosure of information.
Cyber ·
USN-8832-1: Booth authentication flaw
A security notice published on September 28, 2026 reports that incorrect validation of message authentication codes in Booth could let a remote attacker bypass authentication.
Cyber ·
USN-8830-1: three vulnerabilities in phpseclib
A security notice published on September 28, 2026 lists three phpseclib flaws: two may expose information and one may cause denial of service.
Cyber ·
Threat intelligence bulletin for September 28, 2026
The bulletin covers cybersecurity incidents, AI-related threats and actively exploited vulnerabilities. The available excerpt also describes intrusions and thefts, but ends before completing its section on fixes.
Cyber ·
USN-8829-1: Plasma Workspace flaw
A security notice published on September 28, 2026 reports an authentication flaw in the Plasma Workspace session manager that could let a local attacker execute code as another user.
Cyber ·
USN-8828-1: dracut vulnerabilities
A security notice published on September 28, 2026 describes four dracut vulnerabilities, including local information exposure and possible root code execution through manipulated DHCP data.
Cyber ·
Cyberattack on Polish medical vendor exposes patient data
A report published on September 28, 2026, says hackers stole personal data from a Polish healthcare software vendor, in another recent attack on the country’s medical sector.
Cyber ·
USN-8827-1: Erlang security vulnerabilities
An Ubuntu security notice published on September 28, 2026 reports Erlang flaws that may enable denial of service, code execution, TLS interception, request smuggling, and authentication bypass.
Cyber ·
CVE-2026-85499: BanyanDB proxy flaw
A notice published on September 28, 2026 describes a low-severity authorization flaw in Apache SkyWalking BanyanDB 0.11.0. In a non-default configuration, a read-only Canopy user can send non-read requests through the monitoring proxy.
Cyber ·
Former U.S. soldier gets nearly six years for telecom company intrusions
Published on September 28, 2026, the report says a former U.S. Army soldier was sentenced to more than five years in prison after admitting to breaking into several telecommunications companies and leaking confidential records.
Cyber ·
USN-8836-1: FreeRDP vulnerabilities
A notice published on September 28, 2026 reports FreeRDP flaws that could expose information, cause service disruption, or allow code execution. Apply the Ubuntu update.
Cyber ·
NCSC urges mitigation of Citrix NetScaler vulnerabilities
In a September 28, 2026 publication, the UK NCSC urged organizations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway. The notice said two were being actively exploited.
Cyber ·
Report flags path truncation in crontab
A message published on September 28, 2026 discusses a Debian report about truncation of file-path arguments with 100 or more characters. The available excerpt questions whether the effect is silent and notes that it may depend on whether the file exists.
Cyber ·
CVE-2026-91006: command injection in Apache Karaf
A September 28, 2026 notice reports a moderate-severity Apache Karaf vulnerability: unquoted javaOpts values may allow command injection when starting child instances.
Cyber ·
CVE-2026-90979: LDAP injection flaw in Apache Karaf
A notice published on September 28, 2026 reports LDAP filter injection in Apache Karaf JAAS LDAP modules. Versions before 4.4.12 are affected; the notice rates severity as moderate.
Cyber ·
CVE-2026-19444: kubectl cp risk on Windows
A September 28, 2026, oss-sec feed post describes a medium-severity Kubernetes issue: a malicious tar in a container can cause kubectl cp to write files to arbitrary paths on Windows, within the local user's permissions.
Cyber ·
Heat Revolution: heat has memory
A text dated September 28, 2026, says scientific understanding of heat is undergoing a revolution, even though some phenomena may seem repetitive.
Cyber ·
Nanowire LED promises less heat
A note published on September 28, 2026 describes a nanowire LED architecture intended to improve efficiency by avoiding a limitation of current technology. The text says it does not heat up because it emits all the light it produces.