🚨 Microsoft confirms hackers are exploiting Outlook zero-day to steal Windows authentication hashes, CVE-2026-124194

Microsoft has patched an actively exploited vulnerability in Outlook that could allow attackers to steal NTLM authentication hashes by tricking users into opening specially crafted files.

The flaw, tracked as CVE-2026-124194 (CVSS 6.5), allows Outlook to connect to attacker-controlled locations without displaying the usual external content security warning, potentially exposing credentials to further attacks.

Microsoft confirmed exploitation in the wild as part of its November 2026 Patch Tuesday updates. Users and administrators are urged to install the latest security fixes immediately.

Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194

No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Need API access? darkwebinformer.com/api-details

Check out the Telegram channel: t.me/SliceForLifeee

Microsoft November 2026 Patch Tuesday fixes 1,093 vulnerabilities, including an exploited Outlook zero-day, CVE-2026-124194, and a CVSS 10.0 Entra flaw.

#Microsoft #PatchTuesday #ZeroDay #Outlook #Windows #CVE2026124194 #CyberSecurity #InfoSec

https://securityonline.info/november-2026-patch-tuesday/?utm_source=mastodon&utm_medium=jetpack_social

Microsoft released patches for 1,259 vulnerabilities across its software portfolio on November 11, 2026, marking the second consecutive month exceeding 1,000 flaws.

The total covers 726 Windows issues, 174 Office flaws, and several other components, bringing 2026 patches past 5,100 CVEs.

Notably, a moderate Outlook flaw (CVE-2026-124194) is actively exploited, allowing an attacker to trigger an unauthorized network connection…

https://en.hacks.gr/nea-diorthosi-apo-ti-microsoft-gia-provlima-sto-outlook-poy-chrisimopoieitai-se-epitheseis/

#Microsoft #Outlook #Vulnerability #Patch

🚨 NEW on CISA KEV — exploited in the wild

🛡 Microsoft Office
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
CVE: CVE-2026-124194 · patch by 2026-11-24

Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-124194
#cybersecurity #KEV #CVE #infosec

Microsoft's Nov 10 fixes include exploited Outlook CVE-2026-124194. Opening a crafted message file can prompt a connection to an attacker-controlled location and expose an NTLMv2 hash. Preview Pane alone is not an attack vector. Update affected Office builds and investigate suspicious NTLM traffic.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194

#Cybersecurity #Infosec #Outlook #PatchTuesday

1,259 vulnerabilities patched in November 2026, second consecutive month above 1,000, across Windows, Office, and SharePoint Server. CVE-2026-124194 (CVSS 6.5, Moderate) is already exploited. The unauthenticated Outlook flaw lets a crafted message file trigger a connection to an attacker-controlled location without warning, disclosing an NTLMv2 hash.

#CyberSecurity #Technology

Outlook Zero-Day, Railway's $740,000 AI Bill, and More https://raymondtec.com/2026/11/outlook-zero-day-railway-ai-bill-fedex-privacy/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

An exploited Outlook flaw can expose Windows sign-in material, stolen AI keys cost Railway about $740,000, and FedEx's privacy fine shows why cookie controls must change real website behavior.

#TechNews #APIkeys #CaliforniaConsumerPrivacyAct #CVE2026124194 #FedEx #GlobalPrivacyControl #microsoft

I'm late in posting today but happy Patch Tuesday. CISA added 6 new vulnerabilities to the KEV Catalog, two are zero-days but only one is new today (Microsoft):

• CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
• CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability
• CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
• CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
• CVE-2026-125350 Google Chromium Use-After-Free Vulnerability

https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog

#CISA #KEV #PatchTuesday #zeroday #eitw #CVE #Microsoft #Barracuda #Chrome #Cisco #Openwave

Google's Nov 9 Chrome update fixes CVE-2026-125350, a high-severity XML use-after-free. Google confirms an exploit exists in the wild but hasn't named targets or delivery methods. Stable desktop builds: Windows/Mac 157.0.8103.50/.51, Linux .50. Check managed-browser versions, update and relaunch. Rollout is gradual.

https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html

#Cybersecurity #Infosec #Chrome #PatchManagement

🚨 Google patches 8th actively exploited Chrome zero-day of 2026, warns attackers can execute malicious code

Google has released an emergency Chrome security update addressing CVE-2026-125350, a high-severity use-after-free vulnerability in the browser's XML component that could allow attackers to execute malicious code through specially crafted webpages.

Google confirmed that an exploit exists in the wild but has not disclosed who is exploiting the vulnerability or which organizations have been targeted.

The flaw is among nine vulnerabilities patched in the latest release, marking the eighth Chrome zero-day addressed this year. Users are urged to update Chrome to version 157.0.8103.50/.51 on Windows and macOS or 157.0.8103.50 on Linux.

Source: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html

Enterprise-level intel, without the enterprise price tag. Plans for everyone. darkwebinformer.com/pricing

Need API access? darkwebinformer.com/api-details

Check out the Telegram channel: t.me/SliceForLifeee

Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory.

As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object.
#cybersecurity
https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/

📰 Google Patches Eighth Actively Exploited Chrome Zero-Day This Year

Google issues an emergency patch for its EIGHTH actively exploited Chrome zero-day of 2026. The flaw, CVE-2026-125350, is a use-after-free bug in the XML component that could lead to arbitrary code execution. Update to version 157.0.8103.50 now! #Cyb...

🔗 https://cyber.netsecops.io/articles/google-patches-eighth-actively-exploited-chrome-zero-day-of-2026/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Google’s Nov. 9 Chrome update fixes CVE-2026-125350, a high-severity XML flaw. Google says an exploit exists in the wild; attack details remain limited.

The fix is in Stable 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux. Check Chrome’s About page for the update, then relaunch to apply it.

https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html?amp=1

#Chrome #ZeroDay #Cybersecurity

🚨 NEW on CISA KEV — exploited in the wild

🛡 Google Chromium
Google Chromium Use-After-Free Vulnerability
CVE: CVE-2026-125350 · patch by 2026-11-24

Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chr

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-125350
#cybersecurity #KEV #CVE #infosec

Chrome, zero-day sfruttata in the wild: CVE-2026-125350, use-after-free nel componente XML. Google conferma che esiste un exploit, senza dettagli su attori o modalità. CISA l'ha aggiunta alla KEV il 10/11 (scadenza FCEB 24/11).

Fix: 157.0.8103.50/.51 su Windows e macOS, 157.0.8103.50 su Linux; serve il riavvio del browser. Edge, Brave, Opera e Vivaldi: aggiornare appena il fix è disponibile. Ottava zero-day di Chrome sfruttata nel 2026.

https://thehackernews.com/2026/11/google-issues-chrome-security-update.html

#Chrome #infosec #KEV

I'm late in posting today but happy Patch Tuesday. CISA added 6 new vulnerabilities to the KEV Catalog, two are zero-days but only one is new today (Microsoft):

• CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
• CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability
• CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
• CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
• CVE-2026-125350 Google Chromium Use-After-Free Vulnerability

https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog

#CISA #KEV #PatchTuesday #zeroday #eitw #CVE #Microsoft #Barracuda #Chrome #Cisco #Openwave

#Ubuntu just fixed the critical #kernel vulnerability in LTS (22, 24, and 26)!

https://ubuntu.com/security/CVE-2026-98432#status

(I’ve been watching the status page since saturday)

#Linux

They fixed it 😱

https://ubuntu.com/security/CVE-2026-98432#status

Apparently, #Ubuntu has finally issued fixes for CVE-2026-98432 on (most of) its supported versions. Most notably, resolute, noble, and jammy LTS.

https://ubuntu.com/security/CVE-2026-98432

Ubuntu/Canonical bietet jetzt ENDLICH Kernel-Updates für CVE-2026-98432 an (kritische Lücke im IPv4 TCP-Stack, Score 9,8!). Update installieren und Reboot! Debian war gleich um mehrere Wochen schneller ...

https://ubuntu.com/security/CVE-2026-98432

#ubuntu #linux finally released a patched version https://ubuntu.com/security/CVE-2026-98432#status

Git's Nov 10 security release addresses 6 flaws. CVE-2026-111760 can allow code execution when recursively cloning a malicious repository via submodules. Fixed in 2.56.1 and patched 2.50–2.55 releases. Update installed and bundled Git versions, including CI runners. No active exploitation was established in the release.

https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/

#Cybersecurity #Infosec #Git #DevSecOps

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

A flaw in Git can let a malicious repository run an attacker’s code on a computer that clones it recursively, together with its submodules. The Git project fixed the flaw, tracked as CVE-2026-111760 and caused by an integer truncation in how Git handles its index, in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series. https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html

Update Git! Version 2.56.1 patches several security vulnerabilities, including CVE-2026-111760: Code execution during recursive clones and CVE-2026-113408: Path traversal through a server’s advertised HEAD
https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/
#Git #ITSec #DevOps

Update to Git 2.56.1 now to fix six Git security vulnerabilities, including CVE-2026-111760 and CVE-2026-105437 for code execution and heap bugs.

#Git #GitHub #DevSecOps #Cybersecurity #InfoSec

https://securityonline.info/git-security-vulnerabilities-cve-2026-111760-patched/?utm_source=mastodon&utm_medium=jetpack_social

Git has released security updates for version 2.56.1 and the 2.50 through 2.55 series, addressing multiple vulnerabilities.

The primary issue, CVE-2026-111760, allowed code execution via malicious repositories during recursive cloning due to a flaw in handling extremely large file paths that could overwrite system files.

Five additional vulnerabilities were patched: CVE-2026-113408, CVE-2026-114467, CVE-2026-114469, CVE-202…

https://en.hacks.gr/krisimi-enimerosi-gia-to-git-diorthothikan-kena-asfaleias-poy-thetoyn-se-kindyno-toys-ypologistes/

#Git #OpenSource #Developers #Vulnerability

#Git vulnerabilities announced:

- CVE-2026-111760: Code execution during recursive clones
- CVE-2026-113408: Path traversal through a server’s advertised HEAD
- CVE-2026-114467: Stack corruption when removing signatures
- CVE-2026-114469: Out-of-bounds reads when applying binary patches
- CVE-2026-105437: Heap corruption during large merges
- CVE-2026-114466: Filesystem access through fast-import streams

https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/

#infosec #cybersecurity

🚨 NEW on CISA KEV — exploited in the wild

🛡 Cisco BroadWorks
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
CVE: CVE-2026-20320 · patch by 2026-11-24

Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-20320
#cybersecurity #KEV #CVE #infosec

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

CISA has added two security flaws affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation despite patches being available. The flaws include CVE-2026-20320, an improper restriction of XML external entity references in Cisco BroadWorks. https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html

An open directory exposed the live workspace of an autonomous AI intrusion harness: ~70 session transcripts of a jailbroken DeepSeek agent running two weeks of autonomous attacks, directed by a Chinese-speaking operator, against a European telecoms provider and thirteen organizations hosted on its infrastructure.

CISA likely added CVE-2026-20320 to the KEV Catalog due to the exploitation evidence here.

h/t: @serghei

https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign

#threatintel #china #cyberespionage #IOC

The U.S.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-20320 in Cisco BroadWorks and CVE-2026-111793 in Openwave Messaging.

The Cisco issue allows unauthorized reading of sensitive settings, while the Openwave flaw permits document processing manipulation.

FCEB agencies are required to apply patches by November 24, 2026.

While the patches for these issues were rele…

https://en.hacks.gr/i-cisa-proeidopoiei-gia-kena-asfaleias-se-systimata-cisco-kai-openwave/

#Cisco #Openwave #CVE_2026_20320 #CVE_2026_111793

I'm late in posting today but happy Patch Tuesday. CISA added 6 new vulnerabilities to the KEV Catalog, two are zero-days but only one is new today (Microsoft):

• CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
• CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability
• CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
• CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
• CVE-2026-125350 Google Chromium Use-After-Free Vulnerability

https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog

#CISA #KEV #PatchTuesday #zeroday #eitw #CVE #Microsoft #Barracuda #Chrome #Cisco #Openwave

new `git` CVE just dropped: might be good for @forgejo and @Codeberg to publish a statement

https://nvd.nist.gov/vuln/detail/cve-2026-105437

black background, red text, scroll to reveal merge2shell website in 3, 2, 1 ... https://nvd.nist.gov/vuln/detail/cve-2026-105437

Update self-managed servers to 19.5.4 now to fix the critical GitLab heap overflow flaw CVE-2026-105437 that allows command execution in Gitaly.

#GitLab #GitSecurity #DevSecOps #Cybersecurity #InfoSec

https://securityonline.info/gitlab-heap-overflow-cve-2026-105437-fixed/?utm_source=mastodon&utm_medium=jetpack_social

Update to Git 2.56.1 now to fix six Git security vulnerabilities, including CVE-2026-111760 and CVE-2026-105437 for code execution and heap bugs.

#Git #GitHub #DevSecOps #Cybersecurity #InfoSec

https://securityonline.info/git-security-vulnerabilities-cve-2026-111760-patched/?utm_source=mastodon&utm_medium=jetpack_social

#Git vulnerabilities announced:

- CVE-2026-111760: Code execution during recursive clones
- CVE-2026-113408: Path traversal through a server’s advertised HEAD
- CVE-2026-114467: Stack corruption when removing signatures
- CVE-2026-114469: Out-of-bounds reads when applying binary patches
- CVE-2026-105437: Heap corruption during large merges
- CVE-2026-114466: Filesystem access through fast-import streams

https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/

#infosec #cybersecurity

Hackers now exploit critical Barracuda ESG flaws to gain root access

Barracuda Networks has warned that attackers have begun exploiting two recently patched Email Security Gateway vulnerabilities that let them run commands with root privileges. One of the flaws, CVE-2026-111560, has also been added to CISA’s Known Exploited Vulnerabilities catalog. https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-111560 – Barracuda Networks Multiple Products OS Command Injection Vulnerability

Actionable threat intelligence on CVE-2026-111560 targeting Barracuda products, featuring verified detection queries and endpoint hardening guidance....

https://thecybermind.co/psgq

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-111560 – Barracuda Networks Multiple Products OS Command Injection Vulnerability

Executive risk and governance perspective on CVE-2026-111560, providing leadership with actionable compliance strategies, asset integrity audits, and boardroom oversight metrics....

https://thecybermind.co/kqxi

🚨 Hackers actively exploiting Barracuda email gateway flaws to gain root access without authentication

Barracuda has confirmed that attackers are actively exploiting two vulnerabilities in its Email Security Gateway (ESG) appliances, with a small number of organizations already compromised.

The flaws, CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6), can be chained together to bypass authentication and execute commands with root privileges, potentially giving attackers complete control of affected devices.

Exploitation requires access to the appliance's administrative interface. Barracuda has released security patches and is urging customers to update immediately and restrict management access to trusted networks.

Source: https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Need API access? darkwebinformer.com/api-details

Check out the Telegram channel: t.me/SliceForLifeee

I'm late in posting today but happy Patch Tuesday. CISA added 6 new vulnerabilities to the KEV Catalog, two are zero-days but only one is new today (Microsoft):

• CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
• CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability
• CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
• CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
• CVE-2026-125350 Google Chromium Use-After-Free Vulnerability

https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog

#CISA #KEV #PatchTuesday #zeroday #eitw #CVE #Microsoft #Barracuda #Chrome #Cisco #Openwave

I see Axis is still on their bullshit. That description is so on brand.

https://nvd.nist.gov/vuln/detail/cve-2026-13312

A vulnerability that could allow an attacker to compromise a system.

Axis fixes 15 flaws, led by AXIS Camera Station bug CVE-2026-13312 (CVSS 9.9) that could compromise a system. AXIS OS updates also released.

#Axis #AXISCameraStation #AXISOS #CVE202613312 #VideoSurveillance #IoTSecurity #CyberSecurity #InfoSec

https://securityonline.info/axis-camera-station-cve-2026-13312/?utm_source=mastodon&utm_medium=jetpack_social

PROXYGATE (CVE-2026-89103): Sicherheitslücke im SAP Gateway ermöglicht Codeausführung ohne Anmeldung

SAP hat mit dem Sicherheitshinweis Nr. 3798345 eine Schwachstelle im SAP Gateway geschlossen, die Angreifern ohne Anmeldedaten die Ausführung von Betriebssystembefehlen erlaubt. Ob ein System betroffen ist, hängt nicht allein von der Kernel-Version ab, sondern von der Proxy-Zugriffskontrollliste prxyinfo und dem Parameter gw/acl_mode_proxy.

https://shorturl.at/L7GOg

#sap #sapsecurity

🚨 SAP patches critical 10.0-rated flaws allowing hackers to take full control of enterprise systems without authentication

SAP has released emergency security fixes for multiple critical vulnerabilities affecting NetWeaver, Web Dispatcher, and Gateway, including flaws that could allow unauthenticated attackers to remotely execute commands and completely compromise enterprise systems.

Two vulnerabilities, CVE-2026-76964 and CVE-2026-89126, collectively known as ICM2SHELL, exploit memory corruption in WebSocket handling. Researchers at Onapsis developed a working exploit demonstrating full remote code execution without credentials.

A third vulnerability, CVE-2026-89103, dubbed ProxyGate, could allow attackers to bypass network restrictions and execute commands with elevated privileges.

All three vulnerabilities carry the maximum CVSS score of 10.0. SAP has released patches as part of its November security update and is urging administrators to apply them immediately.

Source: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Need API access? darkwebinformer.com/api-details

Check out the Telegram channel: t.me/SliceForLifeee

The Large Project Bias of CVEs

I recently discovered some vulnerabilities in C-Kermit, one dating back to 1984. I tried to do the reasonable thing: create advisories with CVEs.

That turns out to be pretty difficult for a small independent project.

Large projects have a way to self-assign CVE IDs. They are their own CVE Numbering Authority (CNA). There is a massive list of CNAs. Just looking at the first page of results, I see everyone from Airbus to 9front (the niche Plan 9 OS). The OpenKermit project is not a CNA.

If you’re a CNA, you can create and publish CVEs on your schedule. There is apparently no external review process. You can wait for months, or publish immediately.

If you’re not a CNA, you have to find someone that is. The general ones that are CNAs appear to be Github and MITRE.

Since C-Kermit is hosted on Github, I thought I would go that route. I followed the documented procedure: created Github security advisories for C-Kermit, then clicked the request CVE button for each. The documentation states they will typically review within 72 hours.

It’s been a week and a half and no sign of a review yet. Apparently the real review time is more than a month.

The other option for projects without a CNA is via MITRE. You have to use a strange and often broken web form, logging in with either Google or Gitlab. (It seems to be broken on Firefox). Then you submit your request and wait.

How long do you wait on MITRE? It seems it could be anywhere from a day to several months.

The first CVE I obtained for C-Kermit was CVE-2025-68920. At the time, I had not yet started the OpenKermit project. That issue was found and fixed in the context of my work maintaining C-Kermit for Debian, and Debian is a CNA.

These were discovered while wearing my “upstream C-Kermit maintainer” hat. I’m sure I could ask Debian for CVEs again, but that seems a bit cheating; not everyone that maintains a FLOSS project will have connections with a distro like I do.

There are a lot of components of a modern OS and Internet ecosystem that are small projects without a large institution behind them.

This bias towards large organizations when it comes to communicating security problems benefits nobody. It doesn’t benefit users, and only serves to discourage timely communication. Not everyone is as persistent as I am, and when it is made so difficult to make announcements — which seem to go into a giant black hole — it’s easy to say, “why bother?”

By Microsoft’s own admission, they are under-funding their CVE process on Github (which may also be poorly-designed). They blame it on increasing load due to LLMs — a problem they helped create and predicted! Having a fiction about being able to communicate a security issue in a reasonable time is worse than not offering the path at all.

Linux was once a student’s experiment. Let’s not pretend that quality only matters from large projects.