F5 Patches Multiple NGINX, BIG-IP Vulnerabilities
Teaser from the source
Attackers could exploit the bugs to modify configurations, terminate or restart processes, cross security boundaries, leak memory, and execute code. The post F5 Patches Multiple NGINX, BIG-IP Vulnerabilities appeared first on SecurityWeek .
This is the RSS-feed teaser. Read the full article at the original source.
Read at SecurityWeekMore on Patches
Other advisories
- Not ratedosv:ECHO-8083-7310-cd1aWindows-only. On Windows ReadWriteLock acts on SQLite side files that another local user places beside its database. The fix (PR #834) is Windows ACL handling. The POSIX side of the same advisory, GHSA-v4x8, is backported in patches/GHSA-v4x8-3wr5-3wq8.patch. Echo builds and ships this library for Linux only.
- Not ratedosv:ECHO-310a-f3e1-8768Unity unsafe blit unbounded length (CWE-789). Upstream e01f07cf only touches Unity-package formatter code that MessagePack.csproj excludes from compilation. Patch retained in patches/ but not applied.
- Not ratedosv:ECHO-e60c-e8f0-b786MVC input formatter TrustedData default (CWE-1188). Upstream c98d31f2 only touches MessagePack.AspNetCoreMvcFormatter, a separate package — not any shipped MessagePack.dll TFM. Patch retained in patches/ but not applied.
- CriticalCVE-2026-109618PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
- Criticalpwn_watch:fortinet-ai-found-flaws-hardening-release-oct-2026Fortinet patches critical AI-found flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator
- HighCVE-2026-84782Security update for openssl-3-livepatches
- Not ratedosv:SUSE-SU-2026:4560-1Security update for openssl-3-livepatches
- Not ratedosv:ECHO-e311-90be-2fe3Incorrect IPv6 host parsing in RfcUriParser, the RFC 3986 parser UriComponentsBuilder uses as of 6.2 (added by commit 52805da733, first released in 6.2.0; the advisory range is 6.2.0 - 6.2.18 and 7.0.0 - 7.0.7). 5.3.20 has no RfcUriParser: UriComponentsBuilder parses with the URI_PATTERN/HTTP_URL_PATTERN regexes, hardened here by the CVE-2024-22243/22259/22262 patches. The fix ce90e4b11f only changes RfcUriParser.
Other news entries
- Network appliances go more than a year without patches as exploits speed upNewsCSO Online
- Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for TestingNewsThe Hacker News
- Ivanti patches two more Connect Secure zero-days chained in attacksNewsBleepingComputer
- Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainNewsSecurityWeek
- WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 HoursNewsThe Hacker News
- Northflank security incident: PaaS tells users to assume all environment variables were decryptedBreachpwn.watch
- Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash FirewallsNewsThe Hacker News
- Chrome and Firefox Updates Patch Over 200 VulnerabilitiesNewsSecurityWeek
Source: https://www.securityweek.com/f5-patches-multiple-nginx-big-ip-vulnerabilities/
ID