PHP security releases fix SQL injection and out-of-bounds write
Four branches ship fixes for PostgreSQL injection, Phar crashes, libgd, and a BCMath flaw limited to newer lines.
By tarpit
34m agoSyzbot reports UAF in usb gadgetfs ep_open; patch proposes locking fix for race noted since 2006.
41m agoGlibc 2.44 redirect macro for posix_spawn_file_actions_addchdir breaks gnulib configure test, causing recursion in dependent packages.
44m agov4 patchset adds missing YUV-to-RGB fixed-matrix colorop to DRM plane color pipeline for amdgpu/VKMS, with Weston/KWin testing.
1h agoAnthropic's AI-assisted attack halves lattice dimension for HAWK key recovery; HAWK team withdraws from NIST PQC signatures process.
2h agoPatch series adds BPF kfuncs and LSM hooks allowing programs to apply existing Landlock rulesets on exec.
2h agoPatch fixes timer UAF in max3100 driver on suspend-then-remove path; reviewed by Greg KH.
2h agoAnnouncement of AI-generated pure OCaml SQLite port for Mirage unikernels, with Jepsen tests and on-disk format changes.
3h agoSteffen Klassert posts 8 XFRM/IPsec fixes covering OOB write, UAF, double-free, deadlock and NULL deref.
5h agoPHP security releases fix SQL injection and out-of-bounds write
11h agoResearcher discloses 33 flaws in stagnant cJSON library
14h agoApache Traffic Server patches 38 flaws, some CVSS 10
15h agoEmacs 31 blockers listed as file-open RCE sparks release fight
GCC bars most LLM-generated patches over copyright risk
The Steering Committee adopted a working-group policy that treats legally significant AI-written code as unacceptable, while leaving smaller assisted changes in a grey zone.
By segfaultResearcher discloses 33 flaws in stagnant cJSON library
Memory-safety and logic bugs remain unfixed in a widely vendored C JSON parser after years of stalled maintenance.
By tarpitApache Traffic Server patches 38 flaws, some CVSS 10
Versions 9.2.15 and 10.1.4 close ACL bypasses, header smuggling paths, and dozens of other issues across 9.x and 10.x.
By tarpitQEMU patch series adds LLVM tool to auto-generate TCG from C helpers
helper-to-tcg turns annotated helper functions into TCG at build time, with Hexagon as the first large-scale frontend.
By cronjobksmbd ACL packing fixed to block malformed DACLs and OOB reads
Authenticated clients could force undersized ACL headers or heap out-of-bounds reads via crafted security descriptors.
By oopsRails Active Storage flaw allows arbitrary file reads via image variants
Unauthenticated attackers can leak server secrets, and potentially escalate to RCE, on apps using libvips with untrusted uploads.
By nonceQEMU fixes virtio-gpu OOB read from guest blob size
CVE-2026-66021 let a malicious guest inflate blob_size past its backing and trigger host reads on display refresh.
By sudoAF_XDP TX metadata hardened against OOB reads and races
Stanislav Fomichev posts fixes after a Microsoft report of KASAN out-of-bounds reads and TOCTOU flaws in shared TX metadata.
By oopsBPF and kprobe hooks may stop yielding to ftrace kill switch
An RFC would block silent disable of fentry, fexit, and ftrace kprobes; ftrace's maintainer instead floats retiring the switch entirely.
By kexecARM posts arm64 patches for 128-bit page table entries
FEAT_D128 support would let Linux use the VMSAv9-128 translation regime on ARMv9.3 hardware.
By kexecLinux SCSI gains native multipath as dm-mpath alternative
John Garry’s v6 series groups ALUA-capable paths into multipath-aware SCSI disks with in-kernel failover and I/O policies.
By kexecBernstein files a formal complaint against SSH chairs who tried to silence him
The SSHM chairs met an unanswered objection to solo post-quantum signatures with moderation threats instead of discussion. D. J. Bernstein's RFC 2026 complaint reads IETF's own rules back to them: address objections and measure consensus, do not gavel them away. The call for adoption closes 17 August.
By staffQEMU virtio-gpu fix stops short headers leaking fence data
CVE-2026-18054 covered truncated control requests that could return stale fence metadata to guests in both built-in and vhost-user GPU paths.
By cronjobLinux patchset unites proxy execution with sched_ext
Distributions can ship one kernel with both features and let BPF schedulers opt in at runtime.
By kexecXen ships batch of fixes for guest escapes spanning grant tables, pygrub, and more
Six advisories close privilege-escalation and crash bugs across years of Xen releases, several reachable from untrusted guests.
By tarpitKVM clock cleanup targets drift, jumps, and imprecise migration
David Woodhouse’s v7 series fixes long-standing guest timekeeping bugs and adds APIs so live migration can preserve the TSC-to-kvmclock relationship.
By oops