A security vulnerability was identified in the Ignition utility used during system initialization in Red Hat Enterprise Linux 9.8. The flaw involves the golang crypto/x509 package, which could allow man-in-the-middle attacks via untrusted intermediate certificates. This vulnerability affects the process by which Ignition reads and applies configuration from various sources on first boot. Red Hat has released an update to address this issue.
The bq-helix-build-hook-6ade983e package on PyPI version 0.1.0 contains malicious code that collects sensitive information from the environment during installation. This includes credential files, environment variables, and data from cloud metadata endpoints, which are then exfiltrated. The campaign associated with this malware is identified as 2026-10-bq-helix-recon and is characterized by clear malicious intent to steal information.
The bq-helix-recon-6ade983e package on PyPI contains malicious code that executes on every Python startup by placing PTH/sitecustomize files. This code collects sensitive information such as credential files, environment variables, and cloud metadata, then exfiltrates this data. The campaign associated with this package is clearly malicious, functioning as an infostealer targeting cloud tokens and other credentials.
A security update has been issued for the libXtst package by SUSE Product Security Team. This update is functionally equivalent to the Red Hat advisory RHSA-2026:91223. No specific details about the vulnerability or affected versions are provided in the available data.
Multiple security vulnerabilities have been identified and fixed in the libxml2 library, which provides implementations of various XML standards. These include denial of service via use-after-free, arbitrary code execution through various buffer overflow vulnerabilities, data integrity issues from integer overflow, information disclosure, SSRF, and double-free/use-after-free in Python bindings. Red Hat has issued an important security advisory providing updates for Red Hat Enterprise Linux 8.6 to address these issues.
A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.
CVE-2026-119197 is a vulnerability in the pyasn1 Python library prior to version 0.6.5. It involves inefficient algorithmic complexity in decoding binary REAL values, where the decoding time grows quadratically with the mantissa length. This can cause a denial of service by tying up a CPU core for seconds or longer. The issue is fixed in pyasn1 version 0.6.5.
CVE-2026-119196 is a high-severity vulnerability in the pyasn1 Python library prior to version 0.6.5. It involves inefficient algorithmic complexity during decoding of constructed BIT STRING values, where repeated shifting and copying of accumulated bit values causes quadratic CPU workload. This can lead to CPU exhaustion when processing large fragmented BIT STRING inputs. The issue is fixed in pyasn1 version 0.6.5.
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.
Red Hat Ansible Automation Platform 2.7 includes fixes for three denial of service vulnerabilities in the receptor component related to HTTP/2 SETTINGS frames, crafted HTTP Range headers, and multiple ECH outer extension references. These issues could allow an attacker to cause service disruption. Red Hat has released updates addressing these flaws.
CVE-2026-119194 is a high-severity vulnerability in the pyasn1 Python library affecting versions from 0.3.3 up to but not including 0.6.5. The flaw involves inefficient algorithmic complexity in schemaless container decoding, where attacker-controlled ASN.1 input with many distinct long tag IDs causes hash collisions. This results in quadratic CPU usage during decoding, potentially exhausting CPU resources and reducing service availability. The issue is fixed in version 0.6.5.
A vulnerability in PHPUnit versions 13.4.0 through 13.4.3 allows local attackers on multi-user systems to execute arbitrary code with developer privileges. The issue arises from insecure creation and reuse of a temporary directory for PHPT code coverage files without verifying ownership or permissions. This can be exploited by pre-creating the directory and replacing job files before execution. The flaw is fixed in version 13.4.4.
A use-after-free vulnerability exists in the librsvg2 library when XML includes contain duplicated entities. This flaw can lead to memory corruption issues. Red Hat has issued a security update to address this vulnerability in the Extended Life Cycle Support 7 versions of Red Hat Enterprise Linux. The update fixes the issue by correcting the handling of duplicated entities in XML includes.
A vulnerability in digitalbazaar forge (node-forge) prior to version 1.4.1 allows crafted DER input with nested BIT STRINGs to cause excessive recursion and resource consumption during ASN.1 decoding. This leads to high CPU usage and quadratic memory consumption, potentially resulting in denial of service. The issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows improper enforcement of the path length constraint in X.509 CA certificates when the keyUsage extension is missing. This can enable an attacker with control of a path-length-constrained CA private key or a subordinate CA certificate to create a certificate chain that exceeds the declared path length yet still passes verification. The issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows a remote peer to trigger an uncaught TypeError during TLS handshake processing. This occurs when a TLS record of a different content type interrupts a fragmented handshake message, causing the process to fail and potentially disrupting the connection or hosting process. The issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows a remote attacker to cause a denial of service via uncontrolled recursion during TLS record processing. The recursive processing of TLS records consumes one JavaScript stack frame per record, enabling exhaustion of the call stack when thousands of small records are sent together. This issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access.
ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.