NewsSANS ISC Diary
How has use of framing protection security headers changed in the past 3 years?, (Wed, Jun 10th)
More on protection
Other advisories
- Not ratedosv:CLEANSTART-2024-DW19044Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privi...
- Not ratedosv:CLEANSTART-2024-ZI70174Protection mechanism failure in some 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access
- Not ratedosv:CLEANSTART-2025-UN19632Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object
- MediumCVE-2026-96636Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
- MediumCVE-2026-118654Echo static file middleware route protection bypass via encoded dot-dot traversal
- MediumCVE-2026-118654Echo static file middleware route protection bypass via encoded dot-dot traversal
- Not ratedosv:CVE-2026-118654Echo static file middleware route protection bypass via encoded dot-dot traversal
- MediumCVE-2026-118266Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
Other news entries
- Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them MovingNewsThe Hacker News
- Microsoft fixes Remote Desktop failures caused by recent Windows updatesNewsBleepingComputer
- Ireland's Employment Permits Portal taken offline after unauthorised activity; names, emails and roles may be exposedBreachpwn.watch
- OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning ProtectionsNewsThe Hacker News
- Bithumb internal groupware hacked, ID numbers and ID copies of 844 customers leakedBreachpwn.watch
- Meta hit with $25 billion fine for illegally sharing user dataNewsCSO Online
- PHP2Shell exploit bypasses protections designed to stop remote code executionNewsThe Register — Security
- Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacksNewsBleepingComputer
Source: https://isc.sans.edu/diary/rss/33068
ID