CVE-2026-92120: OAuth1 replay attack in Apache Allura
Low-severity advisory on an OAuth1 request replay flaw in Apache Allura up to version 1.21.0, fixed in version 1.22.0.
Read articleKnowledge you can apply
Cyber
Security for teams connecting data, documents and agents to AI.
CVE-2026-92119: mass assignment in the Apache Allura REST API
Public advisory dated October 12, 2026 about a mass assignment flaw in the Apache Allura REST API, affecting versions up to 1.21.0. Version 1.22.0 fixes the issue. Severity rated as moderate.
Read articleCVE-2026-92116: missing OAuth1 callback validation in Apache Allura
An OAuth1 callback validation flaw affects Apache Allura up to version 1.21.0. Version 1.22.0 fixes the issue, according to an advisory published on October 12, 2026 on the oss-sec list, with severity rated important.
Read articleMaintainers Summit 2026: LLMs, security bugs and succession in the kernel
The annual invitation-only kernel maintainers meeting, held on 8 October 2026 in Prague, discussed the impact of large language models, security bugs and long-term succession planning.
Read articleThreat intelligence report of October 12: breaches, AI-driven attacks and a critical Veeam flaw
Summary of a weekly threat intelligence report covering breaches in Denmark, ASOS and Ukraine, AI-assisted campaigns and the Veeam flaw CVE-2025-64393, with claims presented as reported.
Read articleLineageOS 24.0 is released on Android 17, ahead of schedule
The LineageOS project announced version 24.0, based on Android 17 and released earlier than expected. According to the text, the project turns 10 years old on December 24, 2026.
Read articleMonday security updates across Linux distributions
Linux distributions issued security updates for kernel, OpenSSL, browsers and dozens of libraries and packages, according to a 12 October 2026 summary from the LWN feed.
Read articleUnpatched cross-namespace secret exfiltration in k8s-config-connector; CVE requested
A researcher reports, via the oss-sec list, cross-namespace secret exfiltration in k8s-config-connector, still present on master as of 11/10/2026. A CVE ID has been requested from MITRE's CNA-LR.
Read articleUnpatched credential leak in Kubernetes cloud-provider-gcp; CVE requested
A researcher reports on the oss-sec list a credential leak in kubernetes/cloud-provider-gcp that remains present in the master branch. The 90-day disclosure deadline passed without a substantive reply, and a CVE identifier has been requested.
Read articleDrone strikes hit a third Yandex data center in Russia and disrupt digital services
According to a report from The Record, a third Yandex data center in Russia was hit by drones over a weekend, forcing its shutdown and disrupting cloud, payment and delivery services.
Read articleLinux kernel 7.3-rc7: ext4 data=journal mode to be removed in 2028
The 7.3-rc7 kernel pre-release is available for testing. The ext4 data=journal mode has been deprecated and will be removed in early 2028, according to the LWN feed.
Read articleUSN-8912-1: flaws in the Perl DBI module may allow code execution or denial of service
Ubuntu Security notice, dated October 12, 2026, on two vulnerabilities in the Perl DBI module, CVE-2026-78030 and CVE-2026-88816, with risk of arbitrary code execution or denial of service.
Read articleSANS ISC Stormcast for October 12, 2026: episode listed without a summary in the feed
Radar records the SANS ISC Stormcast episode for Monday, October 12, 2026. The feed gives only the title and link, with no description, topics or technical findings.
Read articleMalicious npm packages posed as a Web3 accelerator offering AI credits
Elastic Security Labs reported an operation using fake npm packages, websites and free AI credit offers to target crypto startups and founders, distributing malware for macOS and Windows.
Read articleCyberattack disrupts refrigeration in hundreds of French supermarkets
According to a report from The Record's feed, machine translated, an overnight cyberattack on Sunday stopped refrigerators in hundreds of supermarkets in France and spoiled fresh food.
Read articleIncomplete fix for CVE-2026-79992 in Emacs
Researchers found that the fix for CVE-2026-79992 in Emacs was incomplete. A patch from the TRAMP maintainer will be included in Emacs 31.2, which has no announced release date.
Read articleStable Linux kernels 7.2.10 and 6.18.56 released
Stable kernel versions 7.2.10 and 6.18.56 were released, each with several hundred fixes, according to the LWN feed dated 11 October 2026.
Read articleCVE-2026-107794: ExtUtils::Typemaps::STL::List allocates 32 GiB array for empty list
Security advisory from the CPAN Security Group on versions of ExtUtils::Typemaps::STL::List for Perl prior to 1.07, which allocate a 32 GiB array when processing an empty list. The advisory was published on October 10, 2026.
Read articleCVE-2026-107373: T_STD_STRING typemap may read SV size before converting the argument
CPAN Security Group advisory on ExtUtils::Typemaps: versions before 1.06 may read the size of an SV before converting the argument to a string. Published on October 10, 2026 in the oss-sec feed.
Read articleCVE-2026-103636: out-of-bounds read in Apache DataSketches VarOpt union deserialization
A low-severity flaw in datasketches-cpp up to version 5.2.0 can cause an out-of-bounds read and denial of service when deserializing a truncated VarOpt union.
Read articleRota Nacional
Bring privacy into your workflow.
30 days, no card, with a starting quota. After that, Pix credit from R$ 10,00.