// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input
A CVE describes uncontrolled recursion in GPAC MP4Box BIFS decoder triggered by crafted MP4 files, causing stack exhaustion.
-
CVE-2025-60491: heap use-after-free in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input
A heap use-after-free in GPAC MP4Box's dasher_flush_segment function can be triggered by crafted MPEG-2 TS input, assigned CVE-2025-60491.
-
CVE-2025-60490: heap use-after-free in GPAC/MP4Box gf_filter_pid_send_event_downstream via crafted MPEG-2 TS input
A heap use-after-free vulnerability in GPAC MP4Box can be triggered by crafted MPEG-2 Transport Stream input and has been assigned CVE-2025-60490.
-
CVE-2025-60489: NULL pointer dereference in GPAC/MP4Box dasher_insert_timeline_entry via crafted MP4 input
CVE-2025-60489 is a NULL pointer dereference in GPAC MP4Box triggered by crafted MP4 input, causing a denial of service; a fix is available.
-
CVE-2025-60487: NULL pointer dereference in GPAC/MP4Box gf_isom_get_esd via crafted XML input
A null pointer dereference in GPAC MP4Box may cause a denial of service when processing crafted XML input.
-
CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
Apache Camel CoAP component versions before 4.18.5 and 4.22.2 can expose sensitive information through unmuted consumer exceptions.
-
UK proposes 14-year prison terms for undersea cable sabotage
The UK proposes increasing maximum prison sentences to 14 years for deliberate undersea cable sabotage under updated legislation.
-
CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
CVE-2026-95664 affects Apache Camel’s AWS2-S3 producer, which evaluates untrusted S3 object keys from the CamelAwsS3Key header as simple expressions.
-
CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
A vulnerability in Apache Camel’s Keycloak component can accept expired access tokens because cached introspection results are not limited by token expiry.
-
CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
A path traversal vulnerability in Apache Camel Docling can allow remote authenticated users to write conversion output to arbitrary directories.
-
CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
Apache Camel Docling component has a path traversal vulnerability in versions 4.15.0 before 4.18.5 and 4.19.0 before 4.22.2, affecting custom CLI argument validation.
-
CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
CVE-2026-94386 affects Apache Camel OAuth component versions 4.19.0 through 4.22.1, where a token cache may reuse credentials across scopes.
-
Infostealer riding the AI Train
An infostealer targets browser credentials, cryptocurrency wallets, AI applications, development tools, cloud credentials, and local development files.
-
Quest Diagnostics warns of potential data theft after attack on lab service system
Quest Diagnostics reported a possible breach of patient data involving one of its key systems.
-
HPE patches eight max severity RCE and auth bypass AOS flaws
HPE released security updates for ArubaOS addressing 72 vulnerabilities, including eight critical remote code execution and authentication bypass flaws.
-
CISA Adds One Known Exploited Vulnerability to Catalog
A SQL injection vulnerability in Arista VeloCloud Orchestrator, CVE-2026-114625, was added to the Known Exploited Vulnerabilities catalog after evidence of active exploitation.
-
Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches
Linux kernel maintainer Linus Torvalds says AI-generated patches are acceptable if competent developers produce good code, but drive-by submissions should be avoided.
-
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of CVE-2026-115560, an unpatched remote code execution issue affecting only web applications with unusual configurations.
-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Russian-linked hackers used a new mesh network backdoor in a destructive attack against a Ukrainian logistics company after initial access via a spear-phishing email.
-
Compromised TLS Certificates
A certificate authority disclosed eight TLS certificates with private keys containing only 3 to 8 bits of entropy, far below the expected 384 bits.
-
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
A critical vulnerability in Python's Pillow library allows code execution when processing EPS images because filenames are passed to Ghostscript without validation.
-
UK threatens subsea cable saboteurs with 14 years behind bars
The UK government proposed tougher penalties for damaging subsea cables and new powers over telecoms operators amid concerns about sabotage.
-
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Researchers demonstrated a Node.js remote code execution proof of concept using crafted Brotli data processed by the bundled decoder, affecting an official Linux arm64 Node.js 24.22.0 image.
-
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
A flaw in the x402 SDK default client could let malicious APIs request AI agents’ full token balances before spending limits were added.
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Attackers made millions of unsuccessful attempts to exploit new PHP2Shell vulnerabilities to deploy a Mirai botnet variant, according to reported activity.
-
Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
Reports of exploitation attempts involving PHP bugs known as PHP2Shell increased, while experts said the exploits are less viable than headlines suggest.
-
CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)
A Palo Alto Networks advisory says PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect some of its products, with severity rated high.
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies
A security bulletin reports a ransomware supply chain attack affecting shipping firms, ongoing exploitation of PHP2Shell, and GoDaddy certificate revocations.
-
DSA-6579-1 roundcube - security update
A security update for Roundcube webmail has been released for Debian systems.
-
DSA-6580-1 erlang - security update
A security update has been released for the Erlang programming language packages on Debian.