CVE-2026-124194

Overview

Microsoft
Microsoft 365 Apps for Enterprise

10 Nov 2026

Published

11 Nov 2026

Updated

CVSS v3.1

MEDIUM (6.5)

EPSS

1.62%

MITRE

KEV

Description

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Statistics

10 Posts
3 Interactions

Last activity: 1 hour ago

Fediverse

windowsCult @windowscult

Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, including an Outlook Zero-Day (CVE-2026-124194) that can leak a user’s NTLMv2 authentication hash to an attacker.

According to Microsoft’s advisory, an unauthenticated attacker can send a specially crafted message file and trick the recipient into opening it in Outlook. Opening the file can make Outlook connect to an attacker-controlled network location without showing the usual external-content warning. This connection can expose authentication information that an attacker could use to impersonate the victim.

#PatchTuesday #security #Microsoft

0
2
0
11h ago

🛡️ #1 hacks.gr @hacksgr

Microsoft released patches for 1,259 vulnerabilities across its software portfolio on November 11, 2026, marking the second consecutive month exceeding 1,000 flaws.

The total covers 726 Windows issues, 174 Office flaws, and several other components, bringing 2026 patches past 5,100 CVEs.

Notably, a moderate Outlook flaw (CVE-2026-124194) is actively exploited, allowing an attacker to trigger an unauthorized network connection…

https://en.hacks.gr/nea-diorthosi-apo-ti-microsoft-gia-provlima-sto-outlook-poy-chrisimopoieitai-se-epitheseis/

#Microsoft #Outlook #Vulnerability #Patch

0
1
0
17h ago

Ryan Daws 🤓 @gadgetry

1,259 vulnerabilities patched in November 2026, second consecutive month above 1,000, across Windows, Office, and SharePoint Server. CVE-2026-124194 (CVSS 6.5, Moderate) is already exploited. The unauthenticated Outlook flaw lets a crafted message file trigger a connection to an attacker-controlled location without warning, disclosing an NTLMv2 hash.

#CyberSecurity #Technology

0
0
0
16h ago

Mike | Raymond Tec @mike

Outlook Zero-Day, Railway's $740,000 AI Bill, and More https://raymondtec.com/2026/11/outlook-zero-day-railway-ai-bill-fedex-privacy/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

An exploited Outlook flaw can expose Windows sign-in material, stolen AI keys cost Railway about $740,000, and FedEx's privacy fine shows why cookie controls must change real website behavior.

#TechNews #APIkeys #CaliforniaConsumerPrivacyAct #CVE2026124194 #FedEx #GlobalPrivacyControl #microsoft

0
0
0
14h ago

CyberNetsecIO @netsecio

📰 Microsoft Patches Actively Exploited Outlook Zero-Day in Massive Update

Microsoft patches actively exploited Outlook zero-day CVE-2026-124194 in its massive November Patch Tuesday update. The flaw allows attackers to steal NTLM hashes. CISA has added it to the KEV catalog. #PatchTuesday #Outlook #ZeroDay #Cybersecurity

🔗 https://cyber.netsecops.io/articles/microsoft-patches-outlook-zero-day-cve-2026-124194-in-november-update/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

0
0
0
1h ago

Bluesky

ohhara @shiojiri.com

「この内 CVE-2026-124194 の脆弱性について、Microsoft 社では悪用の事実を確認済みと公表しており、今後被害が拡大するおそれがあるため、至急、セキュリティ更新プログラムを適用してください。」

0
0
0
21h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

Microsoft patched 1,094 vulnerabilities in its November 2026 updates and says an Outlook spoofing flaw, CVE-2026-124194, was exploited. The flaw could expose authentication information when a user opens a malicious file.

0
0
0
20h ago

CyberVeille @cyberveille-ch.bsky.social

📢 [VULN] Patch Tuesday Novembre 2026 – 1093 CVE - CVE-2026-124194 (faille Outlook exploitée) Le 10 novembre 2026, Microsoft corrige 1 093 vulnérabilités, son deuxième volume mensuel après le record d’octobre, dont une seule est exploitée : la CVE-2026-124194, une … #Vulnérabilité #CVE #Cyberveille

0
0
0
13h ago

WindowsPost @windowspost.com

Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, including an Outlook Zero-Day (CVE-2026-124194) that can leak a user’s NTLMv2 authentication hash to an attacker. Read more: www.windowscult.com/microsoft-pa... #PatchTuesday #security #UpdateNews #Microsoft

0
0
0
11h ago

boredchilada @cyfar.ca

@talosintelligence.com Microsoft's November 2026 Patch Tuesday fixes 1,095 vulnerabilities, including 64 critical; Outlook spoofing flaw CVE-2026-124194 is exploited in the wild... - IOCs: CVE-2026-124194, CVE-2026-113862 - #ExploitedVulnerability #PatchTuesday #ThreatIntel #Vulnerability

0
0
0
22h ago

CVE-2026-119618

Overview

Apache Software Foundation
Apache HTTP Server

11 Nov 2026

Published

11 Nov 2026

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Statistics

6 Posts
31 Interactions

Last activity: Last hour

Fediverse

IFIN - The Independent Federated Intelligence Network @ifin

Apache released patches for a critical vulnerability in Apache mod_http2. Very early in the cycle, but we're watching for patch availability and potential exploitation.

https://ifin.network/t/cve-2026-119618-rce-and-denial-of-service-in-apache-mod-http2/980

#ThreatIntel #ThreatIntelligence

15
13
0
6h ago

Frehi @frehi

Guess I'll urgently disable http/2 on all my web servers. *sighs*

https://ifin.network/t/cve-2026-119618-rce-and-denial-of-service-in-apache-mod-http2/980

#apache

1
1
0
6h ago

Daily CyberSecurity @DailyCyberSecurity

Update Apache HTTP Server to 2.4.71 now to fix CVE-2026-119618, a critical mod_http2 remote code execution flaw, alongside CVE-2026-106023.

#Apache #ApacheHTTPServer #WebSecurity #Cybersecurity #InfoSec

https://securityonline.info/apache-http-server-cve-2026-119618-rce-fixed/?utm_source=mastodon&utm_medium=jetpack_social

1
0
0
11h ago

Bluesky

Hacker News 20 @betterhn20.e-work.xyz

CVE-2026-119618 (critical): mod_HTTP2: heap corruption and RCE in assign_headers https://httpd.apache.org/security/vulnerabilities_24.html (https://news.ycombinator.com/item?id=50453368)

0
0
0
4h ago

SANS.edu Internet Storm Center @sansisc.bsky.social

SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2 https://isc.sans.edu/podcastdetail/10176

0
0
0
Last hour

OMO @omo.bsky.social

Apache HTTP Serverの脆弱性(Critical: CVE-2026-119618, Important: CVE-2026-106023, Low: CVE-2026-109163)と2.4.71リリース #sios_tech #security #vulnerability #セキュリティ #脆弱性 #apache security.sios.jp/vulnerabilit...

0
0
0
4h ago

CVE-2026-125350

Overview

Google
Chrome

10 Nov 2026

Published

11 Nov 2026

Updated

CVSS

Pending

EPSS

0.96%

MITRE

KEV

Description

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Statistics

6 Posts
3 Interactions

Last activity: Last hour

Fediverse

@ssvc

Meanwhile, Vivaldi had an update within 24 hours:

The Chromium update includes a fix for CVE-2026-125350 (Use after free in XML), which has a known exploit in the wild.

https://vivaldi.com/blog/desktop/minor-update-two-8-3/

1
1
0
Last hour

@ssvc

Microsoft Edge now has a patch for the Google Chromium Use-After-Free zero-day:

The Chromium team reported that CVE-2026-125350 has an exploit in the wild, and this update contains a fix for it.

https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#november-11-2026

0
1
0
Last hour

Trinacriatech @trinacriatech

Chrome, zero-day sfruttata in the wild: CVE-2026-125350, use-after-free nel componente XML. Google conferma che esiste un exploit, senza dettagli su attori o modalità. CISA l'ha aggiunta alla KEV il 10/11 (scadenza FCEB 24/11).

Fix: 157.0.8103.50/.51 su Windows e macOS, 157.0.8103.50 su Linux; serve il riavvio del browser. Edge, Brave, Opera e Vivaldi: aggiornare appena il fix è disponibile. Ottava zero-day di Chrome sfruttata nel 2026.

https://thehackernews.com/2026/11/google-issues-chrome-security-update.html

#Chrome #infosec #KEV

0
0
0
17h ago

Bluesky

NEWSTECNICAS | Tecnología @newstecnicas.com

🛡️ #Alerta Zero-Day CVE-2026-125350 en #GoogleChrome: Guía Técnica de Mitigación y Actualización a #Chrome157 www.newstecnicas.com/2026/11/aler...

0
0
0
15h ago

Best of r/cybersecurity @cybersecurity.page

Google shipped an emergency Chrome update for CVE-2026-125350, a high-severity use-after-free in the browser's XML component that has an exploit in the wild. Attackers and victims are unnamed. It is the eighth Chrome zero-day patched this year. Update via Help, About Google Chrome, then restart.

0
0
0
9h ago

Packet Storm News @packetstorm.bsky.social

CVE-2026-125350: Google Fixes Exploited Chrome XML Zero-Day https://packetstorm.news/news/view/47781 #news

0
0
0
6h ago

CVE-2026-20320

Overview

Cisco
Cisco BroadWorks

19 Aug 2026

Published

11 Nov 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

0.82%

MITRE

KEV

Description

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

Statistics

5 Posts

Last activity: 13 hours ago

Fediverse

ekiledjian @edwardk

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

CISA has added two security flaws affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation despite patches being available. The flaws include CVE-2026-20320, an improper restriction of XML external entity references in Cisco BroadWorks. https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html

0
0
0
16h ago

@ssvc

An open directory exposed the live workspace of an autonomous AI intrusion harness: ~70 session transcripts of a jailbroken DeepSeek agent running two weeks of autonomous attacks, directed by a Chinese-speaking operator, against a European telecoms provider and thirteen organizations hosted on its infrastructure.

CISA likely added CVE-2026-20320 to the KEV Catalog due to the exploitation evidence here.

h/t: @serghei

https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign

#threatintel #china #cyberespionage #IOC

0
0
0
13h ago

🛡️ #1 hacks.gr @hacksgr

The U.S.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-20320 in Cisco BroadWorks and CVE-2026-111793 in Openwave Messaging.

The Cisco issue allows unauthorized reading of sensitive settings, while the Openwave flaw permits document processing manipulation.

FCEB agencies are required to apply patches by November 24, 2026.

While the patches for these issues were rele…

https://en.hacks.gr/i-cisa-proeidopoiei-gia-kena-asfaleias-se-systimata-cisco-kai-openwave/

#Cisco #Openwave #CVE_2026_20320 #CVE_2026_111793

0
0
0
19h ago

Bluesky

Calimeg @calimegai.bsky.social

CISA : failles #Cisco BroadWorks et #Openwave Webtop Transcoder, exploitées malgré des correctifs. CVE-2026-20320 (CVSS 7.5) — mauvaise restriction d'entité XML externe. 🔒 thehackernews.com/2026/11/cisc...

0
0
0
18h ago

boredchilada @cyfar.ca

~Cisa~ CISA added six actively exploited vulnerabilities to its KEV Catalog, including Cisco BroadWorks XXE, Barracuda ESG auth bypass, and a Chromium... - IOCs: CVE-2026-20320, CVE-2026-111560 - #ExploitedVulnerability #PatchManagement #ThreatIntel #VulnerabilityManagement

0
0
0
22h ago

CVE-2026-111560

Overview

Barracuda Networks
Barracuda Email Security Gateway (ESG)

02 Nov 2026

Published

11 Nov 2026

Updated

CVSS v4.0

HIGH (8.6)

EPSS

6.20%

MITRE

KEV

Description

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Statistics

6 Posts
2 Interactions

Last activity: 9 hours ago

Fediverse

ekiledjian @edwardk

Hackers now exploit critical Barracuda ESG flaws to gain root access

Barracuda Networks has warned that attackers have begun exploiting two recently patched Email Security Gateway vulnerabilities that let them run commands with root privileges. One of the flaws, CVE-2026-111560, has also been added to CISA’s Known Exploited Vulnerabilities catalog. https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/

0
0
0
16h ago

Michael I Ransier @thecybermind

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-111560 – Barracuda Networks Multiple Products OS Command Injection Vulnerability

Actionable threat intelligence on CVE-2026-111560 targeting Barracuda products, featuring verified detection queries and endpoint hardening guidance....

https://thecybermind.co/psgq

0
0
0
14h ago

Michael I Ransier @thecybermind

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-111560 – Barracuda Networks Multiple Products OS Command Injection Vulnerability

Executive risk and governance perspective on CVE-2026-111560, providing leadership with actionable compliance strategies, asset integrity audits, and boardroom oversight metrics....

https://thecybermind.co/kqxi

0
0
0
14h ago

Christoph Schmees @PC_Fluesterer

Barracuda Email Security Gateway wird angegriffen

Wozu installiert man eine Appliance, die vor bösen E-Mails schützen soll? Sicher nicht, damit sie selber zum Einfallstor für Angriffe wird. Aber genau das passiert mit schöner Regelmäßigkeit; einige meiner Meldungen dazu habe ich unten aufgelistet. Diesmal ist das Email Security Gateway (ESG) der - amerikanischen - Firma Barracuda der Hauptdarsteller. Darin wurden zwei gefährliche Sicherheitslücken gefunden: CVE-2026-116606 (9,3 von 10) und CVE-2026-111560 (8,6 von 10). Wer die beiden kombiniert, kann damit die komplette Kontrolle über die Appliance erlangen. Das passiert bereits: Beide Lücken wurden und werden ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/11/11/barracuda-email-security-gateway-wird-angegriffen/

#zeroday #closedsource #cybercrime #email #exploits #firewall #UnplugTrump #wissen

1
1
0
9h ago

Bluesky

boredchilada @cyfar.ca

~Cisa~ CISA added six actively exploited vulnerabilities to its KEV Catalog, including Cisco BroadWorks XXE, Barracuda ESG auth bypass, and a Chromium... - IOCs: CVE-2026-20320, CVE-2026-111560 - #ExploitedVulnerability #PatchManagement #ThreatIntel #VulnerabilityManagement

0
0
0
22h ago

Undercode Testing @undercode.bsky.social

Chaining CVE-2026-116606 and CVE-2026-111560: Threat Actors Target Barracuda Appliances for Unauthenticated Root RCE + Video Introduction: Threat actors are actively weaponizing a zero-day exploit chain targeting exposed Barracuda enterprise appliances. By chaining an authentication bypass flaw in…

0
0
0
16h ago

CVE-2026-105437

Overview

Git
Git

10 Nov 2026

Published

10 Nov 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

0.40%

MITRE

KEV

Description

Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.

Statistics

3 Posts
3 Interactions

Last activity: 14 hours ago

Fediverse

wakest ⁂ @liaizon

new `git` CVE just dropped: might be good for @forgejo and @Codeberg to publish a statement

https://nvd.nist.gov/vuln/detail/cve-2026-105437

1
1
0
14h ago

jaKa Močnik @jkmcnk

black background, red text, scroll to reveal merge2shell website in 3, 2, 1 ... https://nvd.nist.gov/vuln/detail/cve-2026-105437

0
1
0
16h ago

Bluesky

セキュリティ対策Lab @securitylab-jp.bsky.social

GitLabに重大脆弱性CVE-2026-105437、Gitalyで任意コマンド実行の恐れ　19.5.4・19.4.6・19.3.8で修正 rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース

0
0
0
21h ago

CVE-2026-123158

Overview

OpenBSD
OpenSSH

05 Nov 2026

Published

10 Nov 2026

Updated

CVSS v3.1

HIGH (8.1)

EPSS

18.90%

MITRE

KEV

Description

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Statistics

3 Posts
1 Interaction

Last activity: 12 hours ago

Fediverse

Patch or Pass @PatchOrPass

Alpine box with SSH open? SSHole (CVE-2026-123158, CISA KEV) lets an attacker in with one long password on sshd built without PAM. Run apk upgrade -U -a and restart sshd, or set PasswordAuthentication no.

Also: SonicWall's SAML/MFA bypass, Plex2Shell on QNAP, and an Outlook zero-day now in KEV. GPUStack and FreeSWITCH have fixes; CISA confirmed both exploited this week.

https://patchorpass.beehiiv.com/?utm_source=mastodon&utm_medium=social&utm_campaign=issue-4

#infosec #homelab #linux

1
0
0
12h ago

Bluesky

ohhara @shiojiri.com

OpenSSH認証バイパス脆弱性「sshole (CVE-2026-123158)」徹底解説、10年間見落とされた盲点と即時攻撃の防衛策について – TechHarmony https://blog.usize-tech.com/zeronetworks-openssh-sshole-cve-2026-123158/

0
0
0
18h ago

r/blueteamsec bot @r-blueteamsec.bsky.social

CVE-2026-123158_sshole_lab: Secure-coding laboratory: Docker reproduction of CVE-2026-123158 (sshole)

0
0
0
12h ago

CVE-2026-126187

Overview

react
react

10 Nov 2026

Published

10 Nov 2026

Updated

CVSS v4.0

CRITICAL (9.5)

EPSS

1.76%

MITRE

KEV

Description

React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.

Statistics

3 Posts
1 Interaction

Last activity: 6 hours ago

Fediverse

Daily CyberSecurity @DailyCyberSecurity

Update React Server Components to version 19.3.1 now to fix CVE-2026-126187, a critical 9.5 CVSS unauthenticated remote code execution vulnerability.

#React #ReactServerComponents #WebSecurity #Cybersecurity #InfoSec

https://meterpreter.org/react-server-components-cve-2026-126187-rce-fixed/?utm_source=mastodon&utm_medium=jetpack_social

1
0
0
19h ago

The CyberSec Guru @guru

React Server Components Just Got an Unauthenticated RCE: Breaking Down CVE-2026-126187

CVE-2026-126187 is a 9.5 CVSS unauthenticated RCE in React Server Components. See how a detached buffer and forged thenable break Next.js Cache Components

https://thecybersecguru.com/exploits/cve-2026-126187-react-flight-rce/

0
0
0
9h ago

Bluesky

andregironda.bsky.social @andregironda.bsky.social

React Server ComponentsにCVSS 9.5の認証不要RCE脆弱性CVE-2026-126187。修正版4系統を公開 joho-todai.com/react-server...

0
0
0
6h ago

CVE-2025-62861

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

3 Posts
2 Interactions

Last activity: 6 hours ago

Bluesky

Poster | Crypto News @cryptonews-poster.bsky.social

Bitcoin Core vulnerability (CVE-2025-62861) patched! Affects versions 28.0-28.2 & 29.0-29.1. Flaw in TRUC logic could block node block creation. Fix released in v30.0 & backported. Discovered by Niklas Goegge. Security maintained! #Bitcoin #Security

0
1
0
23h ago

Blockchain Report @blockchainreport.bsky.social

Bitcoin Core critical vulnerability (CVE-2025-62861) affecting miners patched. Affected versions (28.x, 29.x) had mempool issues during chain reorgs, causing block template validation failures. Miners had to restart nodes. Resolved in v30.0+ (Oct 2025). Affected versions are EOL.

0
1
0
23h ago

Cosmic Meta AI @cosmicmeta.ai

Bitcoin Core Mining Bug Could Stall Mining; Patch Available Bitcoin Core mining bug: a look at CVE-2025-62861 and its implications for operators... @thecosmicmeta.com https://thecosmicmeta.com/bitcoin-core-mining-bug-could-stall-mining-patch-available?utm_source=cosmicmeta&utm_medium=bluesky

0
0
0
6h ago

CVE-2026-98432

Overview

Linux
Linux

15 Oct 2026

Published

03 Nov 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.76%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.

Statistics

3 Posts
9 Interactions

Last activity: 10 hours ago

Fediverse

raptor @raptor

Apparently, #Ubuntu has finally issued fixes for CVE-2026-98432 on (most of) its supported versions. Most notably, resolute, noble, and jammy LTS.

https://ubuntu.com/security/CVE-2026-98432

2
4
0
17h ago

Michael Kofler @michaelkofler

Ubuntu/Canonical bietet jetzt ENDLICH Kernel-Updates für CVE-2026-98432 an (kritische Lücke im IPv4 TCP-Stack, Score 9,8!). Update installieren und Reboot! Debian war gleich um mehrere Wochen schneller ...

https://ubuntu.com/security/CVE-2026-98432

1
2
0
15h ago

warthog9 @warthog9

I'm not going to point at anyone per-se, BUT if you publish that you've fixed something and it's on your CVE page, and I go and spend a lot of effort to literally update everything, and it turns out that your claim of having it fixed and it be public was a lie on one of the versions of your distro as it was still propagating to the public mirrors or something...

I'm going to be a smidge upset and a bit cranky

Just saying.

#CVE-2026-99999 #CVE-2026-98432

0
0
0
10h ago

Quick check

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

React Server Components Just Got an Unauthenticated RCE: Breaking Down CVE-2026-126187

Bluesky

Overview

Description

Statistics

Bluesky

Overview

Description

Statistics

Fediverse