Overview
Description
Statistics
- 24 Posts
- 24 Interactions
Fediverse
Vulnerabilità critica in APT: attacco MITM permette l’esecuzione di codice come Root su Debian e Ubuntu
#Ubuntu #debian #CVE
Scoperta una grave vulnerabilità in APT (CVE-2026-109518) che colpisce Debian e Ubuntu. Un attacco Man-In-The-Middle permette di sostituire pacchetti legittimi ed eseguire codice arbitrario come root durante gli aggiornamenti. Ecco come funziona la falla e come aggiornare subito i tuoi sistemi.
https://www.marcosbox.com/2026/11/04/vulnerabilita-critica-apt-debian-ubuntu-cve-2026-109518/
Une faille dans APT permet de modifier un paquet après sa vérification de sécurité.
CVE-2026-109518 : un attaquant sur le réseau peut exploiter la reprise des téléchargements HTTP pour exécuter du code en root.
Corrigé dans APT 3.0.4 sur Debian 13
Linux : une faille dans APT permet de remplacer un paquet vérifié et de l’exécuter en root https://www.it-connect.fr/faille-apt-cve-2026-109518-debian-ubuntu-root/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Linux
A security flaw tracked as CVE-2026-109518 affects APT, the package manager for Debian and Ubuntu.
An attacker positioned to alter HTTP traffic can trick APT during failed download retries into swapping a checked package for a malicious one, achieving root code execution.
Debian and Ubuntu published advisories and fixed builds on November 4, 2026.
Systems using default download retry settings on recent distributions are exposed, and users…
Debian's Nov 4 DSA-6607-1 fixes APT CVE-2026-109518. With manipulated HTTP downloads and redirects/retries, an on-path attacker could replace a verified package and execute code as root. Debian 13 (trixie) is fixed in apt 3.0.4. Check your distro's advisory and install its security update; exploitation in the wild is not confirmed.
https://lists.debian.org/debian-security-announce/2026/msg00526.html
Update your Linux systems now to fix CVE-2026-109518, a critical APT package manager flaw that lets on-path attackers run arbitrary code as root.
CVSS 4.0 scores APT flaw CVE-2026-109518 at 7.7. A man-in-the-middle attacker or malicious mirror can intercept a package download and replace it with code that runs as root, exploiting the default retry of failed HTTP downloads in Debian 12 and Ubuntu 22.04. Vendor advisories confirm fixes across multiple releases, including long-term support, and note HTTPS sources aren't exposed. #CyberSecurity #Technology
CVE-2026-109518: APT Download Verification Bypass Explained
CVE-2026-109518 lets an on-path attacker overwrite a verified .deb via hard links, redirects, and retries. Fixed in apt 3.0.4. Patch steps and morehttps://thecybersecguru.com/news/cve-2026-109518-apt-download-verification-bypass/
#infosec #vulnerability #security
CVE-2026-109518 APT vulnerability fixes available | Ubuntu
In light of CVE-2026-109518, new guidance on updating Debian 13 apt URLs to httpS (from http) in your containers. Also, updated guidance for Ubuntu 26.04 LTS VMs on AWS and GCP for this. #DiscrimiNAT has always been built from httpS sources so not affected.
https://chasersystems.com/docs/how-to/tls-upgrade/debian-13/
RE: https://infosec.exchange/@ChaserSystems/117564296571397932
CVE-2026-109518 (apt over plain http vulnerability in Debian/Ubuntu) has the same underlying cause as CVE-2019-3462, CVE-2016-1252 & CVE-2014-6273 before it. Some OS vendors just won't default repos to httpS. We've been maintaining slick, one-line TLS upgrade guides for the last six years on this, and just updated them.
Looking at you now, Microsoft.
Bluesky
Overview
Description
Statistics
- 20 Posts
- 23 Interactions
Fediverse
Still not fixed... https://ubuntu.com/security/CVE-2026-98432
Hmm, could I talk to the sommelier about this wine?
Sorry the sommelier is on holiday
https://ubuntu.com/security/CVE-2026-98432
At this point I would like to see a postmortem
CVE-2026-98432: kernel Linux, gravità critica (CVSS 3.1: 9.8, Red Hat).
Use-after-free TCP/IPv4: rischio crash e possibile esecuzione di codice da remoto, senza credenziali.
Verifica: uname -r e advisory della distribuzione. Contano anche i backport.
Patch: kernel corretto dal vendor, riavvio e nuovo controllo con uname -r. Disabilitare MPTCP non risolve la falla.
Das LLM sagt mir also:
The server is still running a kernel affected by CVE-2026-98432. The fixed kernel is already installed, so the next step is a planned reboot.I verified over SSH that AlmaLinux 9.8 is running 5.14.0-687.29.1.el9_8.x86_64. The installed 5.14.0-687.64.1.el9_8.x86_64 package lists the CVE fix in its changelog.
MPTCP is disabled and the host showed no MPTCP listeners, so the specific exposure the post describes appears absent. The underlying flaw still affects standard IPv4 TCP, and the server has an IPv4 ssh listener.
Nach Absprache mit dem Sohn habe ich die Kiste also gestern abend gebootet und dann nachgefragt.
The server rebooted on November 4 at 19:08 CET and is running 5.14.0-687.64.1.el9_8.x86_64, the kernel with the CVE-2026-98432 fix. Systemd reports zero failed units.
Two services were missing or unavailable when checked:
- Minecraft fabric-lobby was absent from TCP 25574, where the inventory last saw it running. fabric is running on 25572. Both are managed manually.
- friday.... returned HTTP 503 through local Apache. Its configured backend ports, 5173 and 5174, had no listeners. I couldn’t establish whether it was down before the reboot.
Apache, MySQL, SSH, firewalld, Postfix, OpenDKIM, and the inventoried monitoring services were active. Grafana reported its database healthy, InfluxDB answered its health probe, and the expected filesystems were mounted.
Boot logs: mradmin failed three times during startup, with DNS resolution errors for discord.com, then connected successfully.
Systemd ignored an invalid restart policy in wiki.service and an unsupported ImportCredential directive in telegraf.service. Both services are running. The kernel also logged nft_compat deprecation and CPU mitigation warnings.
===
Das ist ein ausgezeichnetes Ergebnis. Der Reboot hat geklappt, das LLM hatte ungefragt ein Verzeichnis der Services angelegt (Im Ansible ist ein docs/ Verzeichnis und es macht sich fleißig Notizen), und das zur Verfikation nutzen können. Und ich habe ein paar Dinge, die ich nach Rückfrage mit dem Sohne aufräumen kann.
Ähnliche Ergebnisse bekomme ich mit den komplexeren Setups meiner eigenen Dedis auch.
I should know never to update the cluster computing class server mid-semester. However I felt like I shouldn't ignore CVE-2026-98432
so of course now I ran some updates and not only does the NVIDIA driver refuse to build but also slurm/MPI pmix support is broken. sigh
I guess I could just make them do the rest of the assignments on the raspberry pi-cluster instead
Kernel security reboots for CVE-2026-98432, a different flaw from last week's Fragnesia reboots: Thursday, Nov 12, 11:00 AM–3:00 PM PST (19:00–23:00 UTC). Our GitLab CI runners reboot one per architecture at a time, so jobs may queue or need a retry, and git.osuosl.org and a few other OSL services are down a few minutes each. Details: https://status.osuosl.org/pages/maintenance/526712bf10cd4e587b000014/6aeb9bd7f7bb4b038d276f4d
Ah, it seems that instead of releasing a fix, Ubuntu has upgraded this vulnerability to "critical"... 🤔
The Linux TCP Use-After-Free
#RedHat Patches 9.8-Rated #Linux #TCP #RCE Flaw While #Ubuntu Releases Fixes for Testing
No login, no click, no password: one crafted TCP handshake can corrupt Linux kernel memory outright.
https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html
#CVE-2026-98432
#infosec #vulnetability #security
CVE-2026-98432 | Ubuntu
CVE-2026-98432 is a vulnerability that affects the IPv4 TCP connection handling in the Linux kernel and can lead to remote code execution. Ubuntu has no patch available yet.
#infosec #security #vulnerability
GitHub - cybervenom01/Mitigation_CVE-2026-98432:
This nftables configuration ruleset can help mitigate attacks on your hosts that are vulnerable to CVE-2026-98432. The rule can help block incoming IPv4 TCP connections that contain IP options. Regular TCP connections without IP options can still go through. This is a temporary solution until the Linux Kernels are fully patched. · GitHub
They are not only not providing value, they are providing anti-value to all developers by dragging their feet in fixing CVE-2026-98432.
Use Fedora or Debian or Alpine or Arch instead.
Das ist jetzt nicht mehr witzig:
Der Patch für CVE-2026-98432 (Score von 9,8/10) ist für Ubuntu "verfügbar" unter "in -proposed", ist also doch doch nicht allgemein verfügbar (außer für Stonking 26.10).
Zur Erinnerung, weil es schon etwas länger her ist: CVE-2026-98432 ist eine kritische Sicherheitslücke im IPv4-/TCP-Netzwerkstack des Linux-Kernels und ein Use-after-free-Fehler. Der Kernel gibt also einen Speicherbereich zu früh frei, obwohl ein anderer CPU-Kern ihn noch verwendet. Angreifende können über speziell präparierte TCP-Verbindungsanfragen die Speicherfehler auslösen.
Im schlimmsten Fall Ausführung beliebigen Codes mit Root-Rechten.
@ubuntu es eilt!
https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432
Install the Citrix security vulnerabilities update to patch critical Citrix security vulnerabilities affecting XenServer hypervisors and Scout gateways.
#Citrix #XenServer #Hypervisor #Virtualization #CVE202698432 #CVE2026111497 #InfoSec #Cybersecurity
🚨 Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Compromise Virtualization Hosts, CVE-2026-98432
Citrix has released emergency security updates for XenServer 8.4 and 9 after disclosing a critical vulnerability that could allow unauthenticated attackers with access to the management network to compromise virtualization hosts.
The vulnerability, tracked as CVE-2026-98432, also affects Workload Balancing and Conversion Manager appliances, raising concerns about attacks against infrastructure used to manage large numbers of virtual machines.
A second vulnerability, CVE-2026-102703, could allow a privileged attacker inside a guest virtual machine to compromise the underlying host, potentially breaking the security boundaries separating virtualized environments.
Citrix also addressed six additional vulnerabilities involving PXE boot and Secure Boot protections.
Security updates are now available for affected XenServer deployments and related management appliances. Administrators are urged to patch immediately and restrict management network access to trusted systems.
There are currently no confirmed reports of these vulnerabilities being exploited in the wild.
Bluesky
Overview
- Microsoft
- Microsoft Paint
Description
Statistics
- 6 Posts
- 232 Interactions
Fediverse
CVE-2026-83844 is a High (8.1) vulnerability for Microsoft Paint.
Might have to make the logo in ascii
RE: https://infosec.exchange/@kajer/117560238580690048
PoC for CVE-2026-83844 just dropped 😱
vulnerabilities don't really deserve jeers, all software is/can be vulnerable
... but like really?
https://nvd.nist.gov/vuln/detail/cve-2026-83844
> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
A remote code exec vulnerability in M$ #Paint(!) just got a rating of 8.1 … what a time to be alive
https://www.cve.org/CVERecord?id=CVE-2026-83844
Overview
- Zyxel
- GS1900-24E firmware
Description
Statistics
- 16 Posts
- 3 Interactions
Fediverse
The vulnerability, tracked as CVE-2026-107441, is an out-of-bounds write flaw in the switches' web management interface that allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests. https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/
Zyxel GS1900 Zero-Day: Why June's Patch Failed and Which Firmware Fixes It https://www.esecurityplanet.com/cybersecurity-threats/news-zyxel-gs1900-zero-day-cve-2026-107441/
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests. https://www.securityweek.com/zyxel-switch-hacks-blamed-on-patched-flaw-actually-exploited-a-zero-day/
Zyxel fixed CVE-2026-107441 on GS1900 switches. A LAN-side CGI flaw could allow unauthenticated OS command execution. Check the exact model and install its 2.90 firmware patch.
This is separate from CVE-2026-7273, exploited in September; no exploitation of 107441 is confirmed.
Zyxel has released firmware 2.90 Patch 3 for 10 GS1900 switch models to fix CVE-2026-107441.
The flaw allows an unauthorized user to execute commands with root privileges.
Binarly researchers rate it 9.8/10 and say the previous Patch 2 (CVE-2026-7273) does not stop the new exploit.
Affected models: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2.
The brief says there is no workaround for those unable to…
https://en.hacks.gr/krisimi-enimerosi-apo-ti-zyxel-gia-10-montela-diakopton-tis-seiras-gs1900/
Bluesky
Description
Statistics
- 10 Posts
- 4 Interactions
Fediverse
CISA added Apple WebKit CVE-2024-27834 to KEV on Nov 4 based on exploitation evidence. The pointer-authentication bypass requires prior arbitrary read/write access; it is not standalone web RCE. Apple fixed it in May 2024. Check outdated Apple devices in your fleet. CISA has not identified the attack campaign.
CISA has officially added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog.
The vulnerability affects Apple operating systems and concerns an authorization bypass mechanism.
Patches for this issue were released by Apple in May 2024.
Reports suggest the flaw is linked to activity by the APT29 group, which has utilized compromised websites and SEO tracking services to facilitate attacks.
Federal agencies are required t…
🚨 NEW on CISA KEV — exploited in the wild
🛡 Apple Multiple Products
Apple Multiple Products Improper Authentication Vulnerability
CVE: CVE-2024-27834 · patch by 2026-11-18
📈 EPSS 0.6% exploitation probability
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
🔗 https://ninjasignal.ninja/intel/cve/CVE-2024-27834
#cybersecurity #KEV #CVE #infosec
U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
CISA has added an Apple flaw, CVE-2024-27834, to its Known Exploited Vulnerabilities catalog following reports of active exploitation, The Hacker News reports. The improper authentication flaw, which affects multiple Apple operating systems, is being used to deliver information-stealing malware. https://thehackernews.com/2026/11/hackers-exploit-patched-apple-flaw-to.html
Bluesky
Overview
Description
Statistics
- 5 Posts
Fediverse
Kann es sein, dass es noch immer WordPress-Installationen unter Version 7.1.4 gibt?
Macht euch keine Sorgen. Andere werden CVE-2026-119977 bei euch finden.
Viel Glück!
Zum Hintergrund:
Die Schwachstelle beruht auf einer sogenannten Time-of-check-to-time-of-use-Race-Condition (TOCTOU).
Beim vollständigen Upgrade des WordPress-Kerns werden Dateien und Verzeichnisse in einem temporären, öffentlich erreichbaren Verzeichnis bereitgestellt.
Durch die zeitliche Lücke zwischen Prüfung und tatsächlicher Verwendung dieser Dateien können Angreifer unter bestimmten Bedingungen auf diesen Upgrade-Prozess einwirken.
Die Sicherheitslücke ermöglicht unter bestimmten Voraussetzungen eine nicht authentifizierte Remote Code Execution auf dem Webserver.
Besonders problematisch ist, dass dafür kein regulärer WordPress-Benutzeraccount erforderlich ist.
WordPress Update Flaw Is Under Attack, Plus 3 Stories https://raymondtec.com/2026/11/wordpress-update-flaw-under-attack-plus-3-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief
Attackers are exploiting a WordPress flaw during core updates. Also: mSecure’s encrypted database theft, patched Zyxel switches, and a refrigeration attack where recovery controls worked.
#TechNews #CriticalInfrastructure #CVE2026119977 #databreach #mSecure #OperationalTechnology #WordPress
Bluesky
Overview
Description
Statistics
- 4 Posts
Fediverse
Install the Citrix security vulnerabilities update to patch critical Citrix security vulnerabilities affecting XenServer hypervisors and Scout gateways.
#Citrix #XenServer #Hypervisor #Virtualization #CVE202698432 #CVE2026111497 #InfoSec #Cybersecurity
Bluesky
Overview
- Edimax
- BR-6208AC
Description
Statistics
- 3 Posts
- 3 Interactions
Fediverse
CVE-2026-122051: CRITICAL command injection (CVSS 10) in Edimax BR-6208AC v1.32 enables remote, unauthenticated code execution via /goform/mp. Exploit is public, no patch available. Restrict network access & monitor devices. https://radar.offseq.com/threat/cve-2026-122051-command-injection-in-edimax-br-6208ac-722ad11edef6a006 #OffSeq #CVE2026122051 #IoT
CVE-2026-122051 | Edimax BR-6208AC v1.32 is affected by a CRITICAL command injection vuln in /goform/mp — remote code execution possible without auth. Exploit is public, no patch. Isolate or replace vulnerable devices. https://radar.offseq.com/threat/a-flaw-has-been-found-in-edimax-br-6208ac-132-cve-2026-122051-18cd449922d0575f #OffSeq #CVE2026122051 #IoTSecurity
Overview
- Red Hat
- Red Hat Build of Keycloak
- keycloak-services
Description
Statistics
- 2 Posts
- 1 Interaction
Fediverse
Red Hat Build of Keycloak hit by CRITICAL vuln (CVE-2026-117691): SAML signature check bypass via percent-encoded params enables full account takeover. No fix yet — track Red Hat updates. https://radar.offseq.com/threat/cve-2026-117691-improper-verification-of-cryptographic-signature-in-red-hat-red-hat-build-of-keycloak-73f1b31f62aee735 🔒 #OffSeq #Keycloak #CVE2026117691 #infosec
RE: https://infosec.exchange/@offseq/117564193831527937
Uhh did Red Hat just drop a zero day without a corresponding patch? Because this time the report seems to not be slop. Red Hat advisory: https://access.redhat.com/security/cve/cve-2026-117691
Overview
- Apache Software Foundation
- Apache Juneau
- org.apache.juneau:juneau-microservice-core
Description
Statistics
- 2 Posts
- 1 Interaction
Fediverse
CVE-2026-121489 | CRITICAL severity in Apache Juneau (<9.2.1): Path traversal in DirectoryResource allows attackers to read, write, or delete files outside the root directory (if view/upload/delete enabled). Patch to 9.2.1 ASAP! https://radar.offseq.com/threat/cve-2026-121489-cwe-22-path-traversal-in-apache-software-foundation-apache-juneau-94a27222766ae77e #OffSeq #CVE2026121489 #infosec