Cybersecurity
357 articles RSS
Cloudflare Opens Post-Quantum GeoKey Manager Closed Beta, Using ML-KEM-768 and X25519 Instead of Attribute-Based Encryption
Cloudflare launched a post-quantum GeoKey Manager in closed beta for its Data Localization Suite, with general availability planned for Q1 2027, and dropped attribute-based encryption.
Chrome 157, Rails and Gitea Security Releases in November 2026: Fix Counts Rest on Bug Entries, Advisories and CVE Lists
Chrome 157 states 213 security fixes and Rails 21 security issues, while Gitea 28.3's post states no total and lists 21 CVE entries; Linuxiac reported 20 for Gitea.
kaniko Before v1.25.20 Can Send Azure Entra ID Tokens to Lookalike Registry Hosts (CVE-2026-105769); Go Database Lists No Upstream Fix
A GitHub advisory says kaniko before v1.25.20 can send an Entra ID token to a lookalike registry host named in a Dockerfile; the Go vulnerability database lists no fixed version of the upstream helper.
Debian and Ubuntu Fix CVE-2026-109518, an APT Flaw in Download Retries That Lets an On-Path Attacker Install Unverified Packages
Debian, Ubuntu and APT's developers published fixes on November 4 for CVE-2026-109518, which needs an attacker on the HTTP path and a non-zero Acquire::Retries setting.
OpenSSH 10.6p2 Fixes a Password Authentication Bypass Affecting musl-Based Linux Systems With PAM Disabled, Including Alpine Linux
OpenSSH's 10.6p2 release, dated 2026-11-05, works around a password bypass on musl-based Linux without PAM; BleepingComputer names Alpine Linux among affected systems.
CVE-2026-111497: One Brotli Decoder Flaw Reached Node.js, .NET, Python Packages and Others Through Separate Bundled Copies
Reporting on the Brotli decoder flaw CVE-2026-111497 shows fixes, scanner coverage and exploitation status differing across Node.js, .NET, Python packages and others.
Chrome 157 Stable Carries 213 Security Fixes, Seven Rated Critical, Including Two in Dawn and One Each in ANGLE and WebGL
Google promoted Chrome 157 to stable with 213 security fixes, seven rated critical; SecurityWeek reports no mention of exploitation in the wild.
GitHub Actions Will Block pull_request_target by Default in Public Repositories From December 2, With Brownouts on November 9 and 16
GitHub's November 2 changelog says Actions will block pull_request_target by default in public repositories from December 2, 2026, after brownouts on November 9 and 16, unless an event policy allows it.
PostgreSQL Anonymizer 3.3 fixes 12 CVEs that Dalibo calls critical; CVE records score them 3.5 to 6.5
Dalibo's PostgreSQL Anonymizer 3.3 fixes 12 CVEs. Its announcement calls them critical; the CVE records give CVSS 3.1 base scores of 3.5 to 6.5, and none of the records mentions superuser access, which the announcement cites.
Rails 8.1.4.1 and 8.0.5.2 Fix 21 Security Issues, Led by a Critical Active Storage ImageMagick File-Write Flaw, GHSA-f3w6-w445-fwh9
Rails says 8.1.4.1 and 8.0.5.2 fix 21 issues; the advisory for the Critical one says a crafted upload may let an unauthenticated attacker write files via ImageMagick.
Gitea 28.3.0 Lists 21 CVE Identifiers, Mostly Around Token Scopes, and Moves Review-Triggered Workflows to the Pull Request Head
Gitea's release post for 28.3.0 lists 21 CVE identifiers by the Herald's count, mostly around token scopes, including one where review-triggered workflows ran from a reviewer-chosen commit. Linuxiac's headline says 20.
Elixir 1.20.5, 1.19.7 and 1.18.6 Fix Two Denial-of-Service CVEs in URI.parse and JSON.decode; 1.20.5 Also Fixes a Mix deps.partition Flaw
Elixir 1.20.5 lists three CVE fixes in its security notes; 1.19.7 and 1.18.6 carry the URI and JSON fixes. CVE records rate each Medium under CVSS 4.0.