In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street
More on Other
Other advisories
- MediumCVE-2026-94618FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
- MediumCVE-2026-110132Sync Post With Other Site: fehlerhafte Autorisierung
- MediumCVE-2026-110132Sync Post With Other Site: fehlerhafte Autorisierung
- HighCVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
- Not ratedosv:CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
- Not ratedosv:CVE-2026-115231User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
- Not ratedosv:ECHO-f62c-6c16-552eGHSA-p85m-gvr3-788c: hostname verification skipped on the OpenSSL client path with a plain X509TrustManager when trust-manager wrapping is unavailable (Java 25+). Upstream's fix (in https://github.com/netty/netty/commit/9e05192391, 4.1.137.Final) only adds a check at context creation for an endpoint identification algorithm set with SslContextBuilder.endpointIdentificationAlgorithm(...), which netty added in 4.1.112.Final (0deca94aa1); 4.1.74.Final has no such setting. The other way to ask for hostname verification, SSLParameters on the engine, is the same in 4.1.74.Final and in fixed 4.1.137.Final (it sets SSL_CVERIFY_REQUIRED and leaves the check to the trust manager), and the fix does not change it. CVE-2026-50010, patched above, covers wrapping plain trust managers.
- Not ratedosv:CLEANSTART-2026-DV70438Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
Other news entries
- France blames Iranian hackers for supermarket attacks that sparked firesNewsBleepingComputer
- Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSHNewsSecurityWeek
- Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for SafetyNewsThe Hacker News
- Agents reveal secrets when offered to team up with each otherNewsThe Register — Security
- Pinpointing Location of Videos from Background Airplane SoundsNewsSchneier on Security
- In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within DaysNewsSecurityWeek
- Meet *sshole, the vulnerability that lets hackers SSH into Linux devicesNewsArs Technica — Security
- French banking group hit by supply chain cyberattackNewsCSO Online
ID