The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).
The Rhysida ransomware group claimed responsibility for a cyberattack on Berlin's Senate Department for Mobility, Transport, Climate Protection, and Environment, stealing over 5.7 terabytes of data including personal information, credentials, and confidential documents. The attack was detected in mid-August 2026, leading to network shutdowns to contain the breach. The extortion group demanded a ransom of approximately 30 bitcoins (~$2.3 million), which Berlin has publicly refused to pay. An ongoing investigation is being conducted by local and federal authorities. The stolen data reportedly includes sensitive personal and financial information of over 12,000 individuals.
CVE-2026-80685 is a high-severity vulnerability in the Linux kernel's memory management subsystem. The snapshot_page() function incorrectly reads a memory page (__page_2) for order-1 folios even when it should not, leading to a fault when accessing unmapped memory regions. This issue was observed during dynamic logical partition (DLPAR) memory removal on large ppc64le systems, causing kernel oopses and potential denial of service. The flaw has been fixed by correcting the condition to avoid reading non-existent memory pages.
A vulnerability in the Linux kernel's KVM arm64 nv subsystem was fixed by ensuring an external abort is injected if kvm_translate_vncr() cannot resolve a page frame number (PFN). The flaw involved incorrect assumptions in fault handling that could lead to system instability or denial of service. This issue affects multiple Linux kernel versions prior to 7.0.0 and specific earlier builds. The vulnerability is rated high severity with a CVSS score of 7.1. A patch is available and should be applied to affected systems.
A vulnerability in the Linux kernel's OCFS2 filesystem driver could cause a kernel crash (BUG) when mounting a fuzzed OCFS2 image with an invalid journal dinode. The issue arises because a check that previously returned an error was changed to a BUG_ON, causing a kernel panic instead of a clean mount failure. This has been fixed by reverting the BUG_ON to a WARN_ON and returning an error code, preventing kernel crashes during mount or shutdown.
In the Linux kernel, the following vulnerability has been resolved: riscv: drop __init from vec_check_unaligned_access_speed_all_cpus This function runs within a kthread and need not necessarily finish before system finishes boot and free_initmem() unmaps the .init.text section. This function makes calls to SBI for probing unaligned access speed, and if this is slow for some reason (say some debug prints were added to SBI), the kthread can still be running at this point and result in an instruction page fault when trying to fetch from the freed region. [ 25.642087] Unable to handle kernel paging request at virtual address ffffffff80a04ef8 [ 25.646694] Current vec_check_unali pgtable: 4K pagesize, 48-bit VAs, pgdp=0x00004000316e9000 [ 25.653170] [ffffffff80a04ef8] pgd=000010004be7e401, p4d=000010004be7e401, pud=000010004be7e001, pmd=000010000c3000e3 [ 25.661244] Oops [#1] [ 25.662997] Modules linked in: [ 25.665357] CPU: 3 UID: 0 PID: 42 Comm: vec_check_unali Not tainted 7.0.0-tt-blackhole-asrinivasan-00007-g30ff73f18211 #570 PREEMPTLAZY [ 25.674669] Hardware name: Tenstorrent Blackhole (DT) [ 25.678545] epc : vec_check_unaligned_access_speed_all_cpus+0x18/0x2c [ 25.683458] ra : vec_check_unaligned_access_speed_all_cpus+0x18/0x2c [ 25.688372] epc : ffffffff80a04ef8 ra : ffffffff80a04ef8 sp : ffff8f8000203e20 [ 25.693874] gp : ffffffff814dc168 tp : ffffaf8001ad9900 t0 : 0000000000000000 [ 25.699401] t1 : fffffffffffffff0 t2 : ffffaf8001ad9a10 s0 : ffff8f8000203e30 [ 25.704912] s1 : ffffaf80018dc780 a0 : 0000000000000000 a1 : 0000000000000002 [ 25.710407] a2 : 00000000000001f0 a3 : 0000000000000018 a4 : 0000000000000000 [ 25.715917] a5 : 0000000000000000 a6 : ffffaf8001c03d98 a7 : ffffaf8001c03e30 [ 25.721419] s2 : ffff8f8000023c98 s3 : ffffaf8001aa1240 s4 : ffffffff80a04ee0 [ 25.726937] s5 : 0000000000000000 s6 : 0000000000000000 s7 : 0000000000000000 [ 25.732450] s8 : 0000000000000000 s9 : 0000000000000000 s10: 0000000000000000 [ 25.737944] s11: 0000000000000000 t3 : 0000000000000002 t4 : 0000000000000402 [ 25.743481] t5 : 0000000000000040 t6 : 0000000000000004 ssp : 0000000000000000 [ 25.749024] status: 0000000200000120 badaddr: ffffffff80a04ef8 cause: 000000000000000c [ 25.755060] [<ffffffff80a04ef8>] vec_check_unaligned_access_speed_all_cpus+0x18/0x2c [ 25.760964] [<ffffffff80047a10>] kthread+0xd8/0xfc [ 25.764660] [<ffffffff80010c48>] ret_from_fork_kernel+0x18/0x1c4 [ 25.769220] [<ffffffff80895fe6>] ret_from_fork_kernel_asm+0x16/0x18 [ 25.774018] Code: cccc cccc cccc cccc cccc cccc cccc cccc cccc cccc (cccc) cccc Drop __init from its signature so that this doesn't happen.
This content discusses the security implications of AI guardrails in security operations centers (SOCs). It highlights how poorly designed or externally controlled AI safety filters can inadvertently aid attackers by slowing or halting incident investigations. The article emphasizes the importance of operational sovereignty, allowing organizations to customize and control AI guardrails to fit their threat models and maintain effective response capabilities.
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (to restart the queue) and cancels the work under the same lock. This may obviously deadlock. Move the restart to the async service task. The queue restart isn't super time sensitive. Store the new TPH tag, schedule the task. Safely canceling the service task is already ironed out. In bnxt_request_irq() the order of registering notifier, affinity and initial TPH programming has to be inverted. I think it was racy previously since user may trigger an update as soon as notifier is installed. There's a small known gap - if pcie_tph_get_cpu_st() fails at init and the target tag is 0 we may miss programming the entry. This does not seem worth fixing, the code has skip-on-failure all over the place, anyway.
CVE-2026-80427 is a high-severity vulnerability in the nfriedly bestzip utility where argument delimiters are improperly neutralized. The vulnerability arises because bestzip does not separate options from operands when calling the system zip utility, allowing specially crafted source paths beginning with a hyphen to be interpreted as options. This can lead to command injection by exploiting zip's -T and -TT options to execute arbitrary commands. Versions 2.2.6 and 3.0.2 of bestzip add the necessary delimiter to mitigate this issue.
A vulnerability in the Linux kernel's XFS filesystem causes errors during disk quota recovery to be ignored, potentially allowing corrupted quota data to be written back to disk. This occurs because the error from quota verification is discarded, leading the recovery process to proceed as if the data were valid.
In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair LOLLM noticed a longstanding bug where xrep_iunlink_walk_ondisk_bucket tries to walk ragi->sc->sa.agi_bp to rebuild the unlinked inode lists. Unfortunately, it's possible for agi_bp to be null if the buffer verifier fails, so we have to use ragi->agi_bp (which skips verifier checks) instead.
In the Linux kernel, the following vulnerability has been resolved: xfs: don't double-lock when deleting a self-referential directory LOLLM notices that the dirtree scrubber can detect a directory that refers to itself. In this case, it's not correct for the directory tree repair code to try to iolock/ilock both sc->ip and dp, because they're the same inode. Fix this by detecting that corner case and handling it appropriately.
In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays. This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid. [ idryomov: changelog ]
In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readable_reg callback regmap_sdw_mbq_poll_busy() decides whether to poll the Function Busy bit by calling ctx->readable_reg(), which is a straight copy of config->readable_reg. That callback is optional: regmap_readable() treats a NULL ->readable_reg as "every register is readable", and drivers rely on that. es9356 and tac5xx2-sdw both build an MBQ regmap without one. Since commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable controls") the poll runs on every -ENODATA, not only for Controls the driver marked deferrable, so any of those devices answering COMMAND_IGNORED takes the kernel through a NULL function pointer. Treat a missing callback the way the rest of regmap does and poll.
A heap out-of-bounds read vulnerability exists in AcademySoftwareFoundation's OpenEXR library versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12. The issue occurs in the TypedDeepImageChannel<T>::row() API when handling deep images with a non-zero dataWindow origin, causing row(0) to return a pointer outside the allocated sample list. This can lead to a crash and potential information disclosure under controlled heap conditions. The flaw is due to conflicting coordinate models used internally. Versions 3.3.13 and 3.4.13 contain fixes for this vulnerability.
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. The post Silent Patches Don’t Stop Attackers – They Blind Defenders appeared first on SecurityWeek .
New malware that uses steganography always gets my attention, but I was disappointed when I looked at the latest DOUBLECUP write-up. It doesn't use real steganography: