A security vulnerability (CVE-2026-43961) in Vim's netrw plugin allows arbitrary code execution via Vimscript injection through an unescaped filename in the s:NetrwMarkFile() filter() expression. This issue affects Red Hat Enterprise Linux 10.2 Extended Update Support and related variants. The vulnerability has been rated as important by Red Hat Product Security. An update fixing this vulnerability is available in the vim package version 9.1.083-26.el10_2 for affected Red Hat Enterprise Linux distributions.
Multiple security vulnerabilities were identified in the perl-CGI module used in Red Hat Enterprise Linux 10.2 Extended Update Support. These include a denial of service via unenforced request and upload limits, arbitrary file write through unsanitized upload filenames, and a security feature bypass via untainted request parameters. Red Hat has issued an important security advisory with updates to address these issues.
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update. These include numerous use-after-free flaws, sandbox escapes, privilege escalations, information disclosures, spoofing issues, race conditions, and boundary condition errors across various components such as JavaScript GC, DOM, Graphics, Audio/Video, Networking, and Layout. The update is rated as important by Red Hat and targets Red Hat Enterprise Linux 9.8 Extended Update Support.
A use-after-free vulnerability (CVE-2026-33416) in the MinGW Windows Libpng library allows for arbitrary code execution. This security issue affects the mingw-libpng package in Red Hat Enterprise Linux 8. Red Hat has issued a security advisory rating this vulnerability as moderate impact and has released an update to address it.
A security vulnerability (CVE-2026-78030) has been identified in the perl-DBI package used in Red Hat Enterprise Linux 8. The flaw involves loading arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in the DBD::DBM driver. This could allow an attacker to load unintended modules, potentially leading to security risks. Red Hat has issued an important security update to address this issue for multiple architectures and extended life cycle releases of RHEL 8.
Multiple threat actors have been using GSocket, an open source remote access tool, to maintain persistent access on compromised Linux servers, especially targeting web applications and hosting environments. The activity surged by over 350% between March and August 2026, with education and research sectors notably affected. GSocket uses a shared public relay network for command and control, bypassing traditional infrastructure that defenders can block. Attackers deploy GSocket with renamed processes in memory-backed directories and establish persistence via cron and systemd. Some attacks involve privilege escalation exploiting CVE-2026-43284. The tool's outbound-only connections and shared relay infrastructure complicate detection and remediation.
A security vulnerability identified as CVE-2026-61642 affects the Squid proxy caching server. The issue involves HTTP request smuggling via the Transfer-Encoding header. Red Hat has issued an important security advisory with updates for multiple Red Hat Enterprise Linux 10.2 variants to address this vulnerability.
A security vulnerability (CVE-2026-125712) has been identified in the gstreamer1-plugins-base package used in Red Hat Enterprise Linux 9. The issue involves missing bounds checks in the parsing of RTCP SDES packets within the gst-plugins-base component of the GStreamer streaming media framework. Red Hat has issued an important security update to address this flaw.
A use-after-free vulnerability (CVE-2026-125704) exists in the GStreamer core buffer value deserialization component of the gstreamer1 streaming media framework. Red Hat has issued a security update for Red Hat Enterprise Linux 10 to address this issue. The vulnerability is rated as having an Important security impact by Red Hat Product Security.
Red Hat has released a critical security update for the OpenJDK 8 build on Windows, version 8u512, replacing versions 8u502 and 8u504. This update addresses numerous security vulnerabilities across various components of the Java runtime and development kit, including PKCS5 padding, TLS certificate handling, LDAP logins, SASL authentication, HTTP client and server handling, certificate checks, XML processing, image and font rendering, Kerberos validation, and more. The update includes multiple enhancements and fixes to improve security and stability.
Two critical denial of service vulnerabilities have been identified in the brace-expansion component used by the cockpit-image-builder frontend in Red Hat Enterprise Linux 10.2 Extended Update Support. These vulnerabilities involve uncontrolled recursion and stack exhaustion caused by crafted brace patterns. Red Hat has issued a security update to address these issues in the cockpit-image-builder package.
Two security vulnerabilities have been identified in the podman container management tool, part of the libpod library used for container pods. The first vulnerability (CVE-2025-11395) allows arbitrary file write when importing an OCI archive. The second vulnerability (CVE-2026-94603) allows the 'podman run' command to disable almost all sandboxing, including user-requested sandboxing, via image annotation. These issues affect Red Hat Enterprise Linux 9.8 Extended Update Support and related variants. Red Hat has released security updates to address these vulnerabilities.
.NET 9.0 for Red Hat Enterprise Linux has received an important security update addressing multiple vulnerabilities including information disclosure, elevation of privilege, and denial of service issues affecting ASP.NET Core and .NET components. The update includes SDK version 9.0.124 and runtime version 9.0.23. These vulnerabilities impact various .NET versions from 8.0 through 11.0. The advisory references multiple CVEs for these issues and provides fixes via updated packages.
Falcon (also known as XG or Xiàng Gē) is a sophisticated browser-based command and control (C2) malware framework operating via malicious JavaScript. It compromises webmail portals and government web applications to sideload malicious Chrome and Firefox extensions that steal sensitive data such as passwords, emails, session cookies, and communications. Falcon delivers an implant called Antino, which uses Microsoft OneDrive as a covert C2 channel. Between March and May 2026, it targeted government entities in one Middle Eastern and four Southeast Asian countries, focusing on ministries of foreign affairs, defense, interior, and law enforcement. The framework exhibits advanced capabilities including browser proxying, download interception, network traffic hijacking, and credential harvesting, with overlaps to the PeckBirdy malware family.
A security update for OpenVPN addresses a vulnerability (CVE-2026-84790) affecting versions 2.7_alpha1 through 2.7.7. The flaw allows remote authenticated users to impersonate others by exploiting a crafted certificate subject field. This issue was identified and fixed by the SUSE Product Security Team.
A security update for SUSE's openssl-1_1-livepatches addresses CVE-2026-84782, which involves DTLS retransmitting handshake messages from a stale buffer offset. This vulnerability has been assigned a high severity level.
This security update for OpenSSL 1.1 addresses multiple vulnerabilities including excessive memory allocation in relative CRLDP processing, timing side-channel attacks in scalar multiplication for non-NIST elliptic curves and SM2 signature generation, denial of service via unauthenticated and undersized DTLS 1.2 AEAD records, and DTLS retransmission issues from stale buffer offsets. Additionally, it includes a fix to avoid untraceable inter-procedural optimizations via a compiler flag. These issues collectively pose risks of memory exhaustion, information leakage through timing attacks, and denial of service conditions.