Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The fla…
Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges
Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resourc…
Debian git-annex Fixes Cross-Repository Data Exfiltration
A vulnerabilitiy was discovered in git-annex, a tool to manage large files with git, without storing the file contents in git, which could result in data exfil…
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open…
Drupal warns of critical Commerce Core flaw exploited in attacks
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.…
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management …
GitLab warns of new max severity code execution vulnerability
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable ser…
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content ma…
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network
Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interact…
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run ar…
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, fo…
vLLM Vulnerability Update Fixes RCE and Server-Crashing Flaws
The vLLM project published security advisories on October 6, 2026, identifying version 0.31.0 as the fix for remote code execution (RCE), service crashes, and …
Debian php8.2 Security Advisory DLA-4819-1 CVE-2025-1218 Denial of Service
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in in denial of service, informati…
Debian LTS evolution-data-server Critical File Deletion Advisory DLA-4796-1
An issue has been found in evolution-data-server, an evolution database backend server. A Flatpak application with D-Bus access to the addressbook service can …
CISA Warns of Active Attacks on a Critical Cisco ISE Flaw
Attackers are exploiting a critical Cisco ISE flaw that can open the product’s web management interface without a valid login. Cisco disclosed CVE-2026-76460 o…
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wedn…
Fedora 43 Rest Security Advisory CVE-2026-16615 Weak Random Number Fix
Fix for https://access.redhat.com/security/cve/cve-2026-16615
Fedora 43 AusweisApp2 Software Update Advisory 2026-44f6d8f2e7
An update to AusweisApp2 version 2.5.5 is now available for Fedora 43, allowing online identification with German ID cards and providing access to stored data.
openSUSE Podman Security Advisory CVE-2026-55686 CVE-2026-57231 Guide
A security update for podman addresses two vulnerabilities in openSUSE Leap 15.3 and SUSE Enterprise Storage 7.1, allowing unauthorized host filesystem access …
Ubuntu Bind9 Security Advisory USN-8648-1 CVE-2026-10723 CVE-2026-10822
Multiple vulnerabilities in Bind9 affecting various Ubuntu LTS versions have been addressed, potentially allowing remote attacks leading to impersonation, deni…
Fedora 43 libnfs Security Advisory CVE-2026-57918 CVE-2026-53689
The Fedora 43 update for libnfs version 6.0.2 addresses CVE-2026-57918 and CVE-2026-53689 vulnerabilities, improving security for accessing NFS shares over a n…
Fedora 43 Lemonldap-ng Update Advisory CVE-2026-19349 Security Fix
Fedora 43 has updated lemonldap-ng to version 2.23.3, addressing CVE-2026-19349, enhancing its Web Single Sign On and Access Management features for improved s…
Oracle Linux 9 OpenSSH Important Security Advisory ELSA-2026-47756
Oracle Linux 9 has released updated packages for OpenSSH, addressing multiple security vulnerabilities through various fixes, including critical patches for re…
Gentoo HTTP-Daemon Normal Improper Header Handling GLSA-202608-10
Gentoo Linux's advisory warns of a vulnerability in HTTP-Daemon allowing header manipulation, potentially leading to unauthorized access. Users are urged to up…