NewsThe Hacker News
Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
More on Verification
Other advisories
- MediumCVE-2026-107146The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session …
- Not ratedosv:CLEANSTART-2026-JA94279Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module
- Not ratedosv:CLEANSTART-2026-DK85212Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints
- Not ratedosv:CVE-2026-116189rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
- CriticalCVE-2026-106072A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
- CriticalCVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
- CriticalCVE-2026-105483A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**.
- LowCVE-2026-113717virtualenv: Pip seeding with download omits wheel digest verification
Other news entries
- You gave your AI agent access, but who is giving it orders?NewsBleepingComputer
- Inside the Underground Market for Know Your Client ServicesNewsBleepingComputer
- How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your TeamNewsThe Hacker News
- Anthropic widens access to AI cyber capabilities for vetted security teamsNewsCSO Online
- Anthropic Introduces 3-Tier Cyber Verification Program for AI AccessNewsSecurityWeek
- Anthropic reconfigures its cool kids security programNewsThe Register — Security
- The Day-One Hole in Zero Trust ArchitectureNewsBleepingComputer
- Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser CredentialsNewsThe Hacker News
Source: https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html
ID