#cves — Public Fediverse posts

Microsoft Patch Tuesday October 2026: Record 1,413 CVEs, one already under attack
#2026 #zero #cves #windows #record

https://redoracle.com/News/microsoft-patch-tuesday-october-2026-record-1413-cves-one-already-under.html

via @dotnet : .NET and .NET Framework October 2026 servicing releases updates

https://ift.tt/doFNnm0
#DotNet #NET #NETFramework #DotNetCore #SERVICING #SecurityUpdates #October2026 #SecurityImprovements #CVEs #ReleaseNotes #10dot0 #9dot0 #8dot0 #Installers #Bina…

CRITICAL CVE-2026-89110 in SAP NetWeaver Visual Composer: Low-priv users can exploit insufficient auth checks to fully compromise remote systems. No patch yet — restrict access & monitor activity. Details: https://radar.offseq.com/threat/cve-2026-89110-cwe-749-exposed-dangerous-method-or-function-in-sapse-sap-netweaver-visual-composer-f4b6d144b645c4b3 #OffSeq #SAP #Vuln #CVEs

Anthropic-linked CVEs pile up, attackers mostly shrug
#cves #anthropic #linked #glasswing #confirmed

https://redoracle.com/News/anthropic-linked-cves-pile-up-attackers-mostly-shrug.html

"Wir werden alle stärbääen!!11elf" blökt das Internet. Die pöhse #KI wird bald alles kaputt machen.

Man macht mich dieser Mist zornig.

Jede Gummi-KI oder eure tote Oma und ihr Dackel können 10+Jahre alte 9.x+ #CVEs "weaponizen".

Solange das halbe Netz voll ist mit "admin:admin" und/oder EOL Software mit Glory-Hole UI nach draussen, isses halt gefährlich.

DAS WAR ES ABER VORHER AUCH SCHON!

#IT #rant #PatchYourShit

✨ Breaking News: #AISLE triumphantly uncovers six curl #CVEs after the *ahem* formidable titans at #OpenAI and Anthropic manage to find a grand total of... zero. 🤦‍♂️ Because who needs AI, when you can just use, oh, I don't know—actual #cybersecurity experts? 🤷‍♀️
https://aisle.com/blog/aisle-discovered-six-curl-cves-after-openai-and-anthropic-found-zero #Experts #TechNews #HackerNews #ngated

Six curl CVEs after OpenAI and Anthropic came back with zero

https://aisle.com/blog/aisle-discovered-six-curl-cves-after-openai-and-anthropic-found-zero

Comments: https://news.ycombinator.com/item?id=49536114

#HackerNews #curl #CVEs #OpenAI #Anthropic #cybersecurity #vulnerabilities #tech #news

🤣 Breaking News: #Curl appoints itself as the supreme #overlord of #CVEs 💼🔨! Witness the awe-inspiring power of a project that can now bestow or withhold CVEs at will, all while bragging about their 57 glorious victories over security vulnerabilities! 🎉 Clearly, the world of #cybersecurity will never be the same.
https://daniel.haxx.se/blog/2026/06/24/a-cve-dispute/ #Vulnerabilities #BreakingNews #HackerNews #ngated

🎉 Wow, #NanoClaw, congrats on making the world's most secure container images by finally discovering the delete key! 🗑️ Who knew eliminating 1,400 #CVEs was as easy as smugly listing buzzwords and calling it innovation? 🚀 Just remember, now your Echo can reverberate endlessly in a vacuum of self-congratulation! 🙄
https://www.echo.ai/blog/echo-xnanoclaw-under-the-hood #Innovation #SecureContainers #TechBuzz #SelfCongratulation #HackerNews #ngated

We eliminated 1,400 CVEs in NanoClaw's container images

https://www.echo.ai/blog/echo-xnanoclaw-under-the-hood

Comments: https://news.ycombinator.com/item?id=49286357

#HackerNews #NanoClaw #CVEs #container #security #vulnerability #management

AI Patches Fall Short Without Human Oversight

Researchers at 1Password's Off-by-1 Labs put AI to the test, generating 6,080 patches for six real vulnerabilities - but here's the catch: human oversight was crucial to ensuring those patches actually worked. Even with advanced models like ChatGPT and Claude Opus, AI patches fell short without a human in the loop.

https://osintsights.com/ai-patches-fall-short-without-human-oversight?utm_source=mastodon&utm_medium=social

#AiPatches #LargeLanguageModels #Chatgpt #ClaudeOpus #Cves

40,000+ CVEs in a year. For many teams, #Kubernetes has turned into a vulnerability battlefield. @cat_edelveis explains why chasing #CVEs doesn’t scale—and what to do instead.

Learn how to move from noise to controlled risk: https://javapro.io/2026/04/14/modernizing-production-containers-to-resist-the-constant-cve-flow/

#DevOps kubernetesio

Linux Kernel Team Floods with 432 CVEs in Two Days

A staggering 432 Linux kernel CVEs were published over just two days, sending shockwaves through the Linux community and leaving system administrators scrambling to keep up with the sudden workload. This unprecedented flood of vulnerability notices has sparked heated debate over prioritization and practical solutions.

https://osintsights.com/linux-kernel-team-floods-with-432-cves-in-two-days?utm_source=mastodon&utm_medium=social

#LinuxKernel #Cves #VulnerabilityManagement #EmergingThreats #OpenSourceSecurity

Over 400 Linux CVEs published in the last 24 hours alone

https://lore.kernel.org/linux-cve-announce/

Comments: https://news.ycombinator.com/item?id=48992669

#HackerNews #Linux #CVEs #Cybersecurity #Vulnerabilities #OpenSource #TechNews

🚨BREAKING NEWS🚨: Six "new" #CVEs in #curl, including one that's the digital equivalent of a fossil! 🦖 Congrats to #AISLE for discovering what we've all known since the dawn of time: software is never perfect. 😏 But hey, at least your toaster and Mars rover can now sleep soundly knowing curl is secure. 🌌🔧
https://aisle.com/blog/aisle-discovers-6-new-cves-in-curl-including-the-oldest-issue-ever-reported #BREAKINGNEWS #softwaresecurity #cybersecurity #HackerNews #ngated

Aisle Discovers 6 New CVEs in Curl, Including the Oldest Issue Ever Reported

https://aisle.com/blog/aisle-discovers-6-new-cves-in-curl-including-the-oldest-issue-ever-reported

#HackerNews #Aisle #Curl #CVEs #cybersecurity #vulnerability #discovery

#OpenSource #security sustainability isn't about working harder. It's about structure that holds when the volume spikes.

Yesterday we kicked off a new @openjsf CNA initiative: an #API that lets each project own its own #CVEs.

https://youtu.be/HkePMUn0rKs?si=9eHqP0wXPrI-ISC-&t=242

You scanned dependencies last month. 👍 But 47 new #CVEs dropped since then. 😵‍💫

The gap between periodic scans is where risk lives. When a critical vulnerability hits, can you instantly tell which apps are affected?

This on-demand webinar covers continuous #SBOM monitoring, #EPSS scoring for active exploits, and #VEX for cutting false positives, without adding ops work.

https://www.amazee.io/resources/webinar/uncover-hidden-vulnerabilities-with-dependency-track

Memory safety CVEs differ between Rust and C/C++

https://kobzol.github.io/rust/2026/06/15/how-memory-safety-cves-differ-between-rust-and-c-cpp.html

#HackerNews #MemorySafety #Rust #C/C++ #CVEs #Cybersecurity

Since today #WWDC #ApplE Just a reminded about #CVES #CVEAlert #CVE #Infosec https://valtersit.com/vendors/apple - I think that Apple has done a great #CyberSecurity job protecting devices. And keeping #investors happy! More FREE #company portfolio information based on #stockmaket #stock and #IT

OK nerds, time to #patch your #Ubiquiti gear – 5 #vulns advised, 3 of them #CVSS 10s… 🙃

Security Advisory Bulletin 064

https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b

#CVE
#CVEs  

🎙️ The #FIRSTImpressionsPodcast is back for the 2026 conference season!
Tune in to the newest episode at: https://media.first.org/podcasts/FIRST_Impressions-MorLior.mp3

In this episode, podcasters interview Mor Weinberger and Lior Kaplan to preview their #FIRSTCON26 session: “From Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation”

The conversation dives into:
🔹 Why 90% of #CVEs already have fixes available
🔹 Why #remediation still takes months
🔹 How AI is accelerating vulnerability discovery
🔹 The hidden complexity of open source supply chains
🔹 Practical ways organizations can reduce risk today

New episodes drop every Friday leading up to FIRSTCON, featuring previews of conference talks and conversations with presenters across the global incident response community.

📍FIRST Conference 2026
June 14–19 | Denver, Colorado

Secure your seat today: https://www.first.org/conference/2026/registration

#FIRSTCON26 #CyberSecurity #OpenSource #VulnerabilityManagement #CVE #DevSecOps #SupplyChainSecurity

Resulting from funding gaps and idiotic shifts in priorities the U.S.A. is now woefully under investing in our core CyberDefense Ecosystem....

National Institute of Standards and Technology (NIST) is no longer enhancing all Common Vulnerabilities and Exposures (CVEs) with analysis and severity indicators, and instead NIST will prioritize enriching a much narrower set of security vulnerabilities.

Related: In April 2025, a funding gap by in DHS appropriations threatened to cease CVE operations entirely —which would have creating systemic risk for global vulnerability management. An emergency funding extension was implemented to avoid a full on crisis. https://www.justsecurity.org/136914/nist-cant-keep-up/ #NIST #MITRE #CVEs #NVD #Security #Risk #CyberSecurity #CyberDefence #CyberInfrastructure #AI #AISecurity #CISA #DHS #Vulnerability #ThreatIntelligence

🚨 OMG, #dnsmasq is exploding! 🚨 In a shocking twist of fate, CERT drops six #CVEs on lazy vendors who didn't realize their software was a ticking time bomb. Apparently, "longstanding bugs" means "we've ignored this for years, but now it's an emergency" 😂.
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html #cybersecurity #softwarebugs #vendorresponsibility #emergencyfix #HackerNews #ngated

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html

#HackerNews #CERT #CVEs #dnsmasq #security #vulnerabilities #cybersecurity #patches

Non-determinism is an issue with patching CVEs

https://flox.dev/blog/achieving-rapid-cve-remediation-in-an-era-of-escalating-vulnerabilities/

#HackerNews #Non-determinism #CVEs #patching #vulnerabilities #security #software #development

Exposure Management Platforms Face Validation Test

Are you tired of filling dashboards with green and closing hundreds of tickets, only to wonder if your organization is truly safer? The harsh reality is that most exposure management platforms fall short in connecting remediation to real risk reduction.

https://osintsights.com/exposure-management-platforms-face-validation-test?utm_source=mastodon&utm_medium=social

#ExposureManagement #VulnerabilityManagement #Cves #RiskReduction #Remediation

Ah, #Rust, the golden child of #programming languages that was supposed to eradicate #bugs like a magic wand. 🪄✨ Yet here we are, in 2026, discovering that even the mighty Rust can't catch everything — 44 #CVEs worth in a single audit! 🤦‍♂️ Apparently, the real bug is believing any language is infallible. 🐛🔍
https://corrode.dev/blog/bugs-rust-wont-catch/ #SoftwareDevelopment #Infallibility #HackerNews #ngated

NIST gives up enriching most CVEs

https://risky.biz/risky-bulletin-nist-gives-up-enriching-most-cves/

#HackerNews #NIST #CVEs #cybersecurity #news #riskmanagement #vulnerabilitymanagement

40,000+ CVEs in a year. For many teams, #Kubernetes has turned into a vulnerability battlefield. @cat_edelveis explains why chasing #CVEs doesn’t scale—and what to do instead.

Learn how to move from noise to controlled risk: https://javapro.io/2026/04/14/modernizing-production-containers-to-resist-the-constant-cve-flow/

#DevOps @kubernetesio

130 new #CVEs are disclosed every day.

Learn how to filter out the 95% of "noise" and focus on vulnerabilities that are actually exploitable in production.

Check out the latest guest blog from Jonas Rosland (Sysdig)

https://openssf.org/blog/2026/04/15/from-noise-to-signal-using-runtime-context-to-win-the-vulnerability-management-battle/

Hundreds of #CVEs per scan. Tickets piling up. Teams start ignoring alerts. This isn’t a tooling issue—it’s a system design problem. Catherine Edelveis shows how to reduce CVE noise with hardened base images. See how to regain control: https://javapro.io/2026/04/14/modernizing-production-containers-to-resist-the-constant-cve-flow/

#DevOps @Docker

While many organizations have mastered pre-deployment scanning, a massive blind spot remains: post-deployment vulnerability detection. As Tracy Ragan explains in her latest blog, software that is secure at release can become vulnerable as new #CVEs are disclosed.

https://openssf.org/blog/2026/04/03/rethinking-post-deployment-vulnerability-detection/

Time for a #rescue mission at #JCON2026 🚨

Your #Java container image is bloated, full of #CVEs, and one bad base image away from disaster?

Catherine Edelveis shows how to shrink, pin, scan and sign your images in 45 minutes.

https://youtube.com/shorts/TH5tVysKO4A
🎟️https://2026.europe.jcon.one/tickets

🔒 OPENCLAW SECURITY DISASTER + PRIVACY PROXY SOLUTION

OpenClaw: 42K exposed instances, CVE-2026-25253 (RCE), 1.5M tokens leaked, 341 malicious skills.

Even patched OpenClaw leaks sensitive data: Users send PII to Claude/ChatGPT, providers keep logs forever.

Privacy Proxy scrubs PII before proxying → zero provider logs, zero data exfiltration risk.

Deploy now: https://tiamat.live

#infosec #privacy #security #cves

this looks like a genuinely good and very impressive use of “AI” in security research – I’m leaving the air quotes in place at the moment since I haven’t been able to find much detail on how the system actually operates. #AISLE describes it as an “autonomous analyser” and “the world’s first #AI-native Cyber Reasoning System (CRS) for vulnerability management” 🙄

I’m pretty sure it’s not just spicy autocarrot though, possibly a mix of deep learning or other machine learning techniques (things that I think of as part of “traditional” AI research) with a sprinkling of LLM on top for “natural language” capabilities (and it’s possible that they’re leaning into “AI” as a descriptor to assign to the current hype cycle rather than calling it “machine learning” but ¯_(ツ)_/¯ )

What AI Security Research Looks Like When It Works

“In the latest #OpenSSL security release on January 27, 2026, twelve new zero-day vulnerabilities (meaning unknown to the maintainers at time of disclosure) were announced. Our AI system is responsible for the original discovery of all twelve, each found and responsibly disclosed to the OpenSSL team during the fall and winter of 2025. Of those, 10 were assigned #CVE-2025 identifiers and 2 received CVE-2026 identifiers. Adding the 10 to the three we already found in the Fall 2025 release, AISLE is credited for surfacing 13 of 14 OpenSSL #CVEs assigned in 2025, and 15 total across both releases. This is a historically unusual concentration for any single research team, let alone an AI-driven one.

These weren't trivial findings either. They included CVE-2025-15467, a stack buffer overflow in CMS message parsing that's potentially remotely exploitable without valid key material, and exploits for which have been quickly developed online. OpenSSL rated it HIGH severity; NIST's CVSS v3 score is 9.8 out of 10 (CRITICAL, an extremely rare severity rating for such projects). Three of the bugs had been present since 1998-2000, for over a quarter century having been missed by intense machine and human effort alike. One predated OpenSSL itself, inherited from #EricYoung's original #SSLeay implementation in the 1990s. All of this in a codebase that has been fuzzed for millions of CPU-hours and audited extensively for over two decades by teams including Google's.

In five of the twelve cases, our AI system directly proposed the patches that were accepted into the official release.”

https://aisle.com/blog/what-ai-security-research-looks-like-when-it-works

80 percent is the new 100: Strategische #Risikopriorisierung von IT-#Schwachstellen ist zukünftig das Credo - wenn es nicht ohnehin jetzt schon so ist.

So deutet ein neues Forecast des internationalen Netzwerks #FIRST (Forum of Incident Response and Security Teams) darauf hin, dass 2026 erstmals über 50.000 neue #CVEs veröffentlicht werden.

Künftig kommt es im #Cybersecurity Management deshalb deutlich stärker darauf an, die wirklich relevanten Lücken zu priorisieren:

https://www.first.org/blog/20260211-vulnerability-forecast-2026

#CVEs leaving you scratching your head?

@todb responds to your frequently asked questions in this video 👇

Pro tip: fingerprinting is key 🔍

CVEs Affecting the Svelte Ecosystem

https://svelte.dev/blog/cves-affecting-the-svelte-ecosystem

#HackerNews #CVEs #Svelte #Ecosystem #Security #Vulnerabilities #OpenSource #Software #Development

#CVEs leaving you scratching your head? @todb responds to your frequently asked questions in this video 👇

The illustrious Greg KH finally reveals the mystical sorcery behind Linux kernel #security 🎩✨, because who doesn't love a riveting saga about #CVEs that nobody asked for 🤷‍♂️? Watch as he valiantly attempts to explain the unknowable to the already uninterested—again. 💤🔐
http://www.kroah.com/log/blog/2026/01/02/linux-kernel-security-work/ #LinuxKernel #GregKH #OpenSource #TechHumor #HackerNews #ngated

Qualcomm has detailed six high-priority vulnerabilities — including a critical secure boot flaw (CVE-2025-47372). Additional issues affect TZ Firmware, HLOS components, DSP, audio, and camera modules.

OEMs are receiving patches and users may need to check manufacturer timelines for deployment.
Follow us for more non-sensationalized security reporting.

Source: https://gbhackers.com/qualcomm-alerts-users-to-critical-flaws/

#Infosec #Qualcomm #SecureBoot #FirmwareSecurity #ThreatIntel #TechNadu #CVEs #DeviceSecurity