In Other News: Dolphin X AI-Powered Malware, Car Anti-Theft Device Hack, 400 Linux Kernel Flaws
More on Other
Other advisories
- MediumCVE-2026-110132Sync Post With Other Site: fehlerhafte Autorisierung
- MediumCVE-2026-110132Sync Post With Other Site: fehlerhafte Autorisierung
- Not ratedosv:CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
- HighCVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
- Not ratedosv:CVE-2026-115231User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
- Not ratedosv:ECHO-f62c-6c16-552eGHSA-p85m-gvr3-788c: hostname verification skipped on the OpenSSL client path with a plain X509TrustManager when trust-manager wrapping is unavailable (Java 25+). Upstream's fix (in https://github.com/netty/netty/commit/9e05192391, 4.1.137.Final) only adds a check at context creation for an endpoint identification algorithm set with SslContextBuilder.endpointIdentificationAlgorithm(...), which netty added in 4.1.112.Final (0deca94aa1); 4.1.74.Final has no such setting. The other way to ask for hostname verification, SSLParameters on the engine, is the same in 4.1.74.Final and in fixed 4.1.137.Final (it sets SSL_CVERIFY_REQUIRED and leaves the check to the trust manager), and the fix does not change it. CVE-2026-50010, patched above, covers wrapping plain trust managers.
- Not ratedosv:CLEANSTART-2026-DV70438Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
- Not ratedosv:CLEANSTART-2024-VU11249If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash
Other news entries
- Agents reveal secrets when offered to team up with each otherNewsThe Register — Security
- Pinpointing Location of Videos from Background Airplane SoundsNewsSchneier on Security
- In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within DaysNewsSecurityWeek
- Meet *sshole, the vulnerability that lets hackers SSH into Linux devicesNewsArs Technica — Security
- French banking group hit by supply chain cyberattackNewsCSO Online
- Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)NewswatchTowr Labs
- The White House is apparently a popular residential proxy exit spotNewsThe Register — Security
- OpenAI’s GPT-6 Astra silently obstructed safety research tasksNewsBleepingComputer
ID