ALT: Yolo Peace

En situation de quasi-monopole privé sur nos données de santé, Doctolib accueille Nvidia dans son capital, et le gouvernement applaudit. Loin d’aider au développement d’une IA souveraine européenne, cette opération semble être un cheval de Troie pour le géant du numérique états-unien.

F5 has disclosed three serious security flaws in NGINX Plus and NGINX Open Source that can let remote, unauthenticated attackers crash worker processes by sending crafted HTTP requests. In certain setups, the memory errors could also allow code execution, although F5 says that outcome requires Address Space Layout Randomization, known as ASLR, to be disabled or bypassed. All three issues affect the NGINX data plane, which handles user traffic, rather than its control plane. The flaws are tracked as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176. F5 published the three advisories on October 14, 2026, and rated every issue High at 8.1 under CVSS v3.1 and Critical at 9.2 under CVSS v4.0. The bugs do not make every NGINX server vulnerable by default because each one needs a specific software version and configuration. Multiple NGINX Vulnerabilities CVE-2026-97205 is a use-after-free flaw in ngx_http_core_module . It can be triggered when asynchronous file I/O, or AIO, is enabled and NGINX processes a Server Side Includes page containing an include virtual command. The worker may keep using memory after that memory has been released, leading to memory corruption or an unexpected worker shutdown. F5 credits security researcher Cyberlanc3r with reporting the issue. CVE-2026-93479 is a heap buffer overflow linked to the NGINX map directive and regular expression matching. The unsafe condition can appear when the root directive or an access-log format uses the map’s regex capture variables before the map output variable. A related path involves a non-cacheable variable used in a string expression. Crafted requests can then make a worker write beyond the allocated memory area and restart. F5 credits Matt Suiche of Tolmo and Mateusz Gierblinski for coordinated disclosure. CVE-2026-15176 is a separate heap buffer overflow in ngx_http_core_module . It affects a location block that combines alias with rewrite and a set or return directive that refers to $request_filename . The same risk can exist when $request_filename appears in an access log_format . F5 says a remote attacker can trigger the flaw without authentication, but the required server-side conditions remain outside the attacker’s control. The company found this issue internally. The affected range is broad. CVE-2026-97205 and CVE-2026-15176 affect NGINX Open Source 1.31.0 through 1.31.6 and 1.0.0 through 1.30.5, while the older 0.x line is also listed for CVE-2026-15176. CVE-2026-93479 has a narrower open-source range of 1.31.2 through 1.31.6 and 1.30.0 through 1.30.5. NGINX Plus 37.0.0 through 37.0.4 is affected by all three bugs. Related products, including NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric, and some NGINX Ingress Controller releases, are also affected. Administrators should upgrade NGINX Open Source to 1.31.7 or 1.30.6. NGINX Plus users on the 37.x line should move to 37.0.5.1 or 37.1.0.1. Fixed releases also include NGINX Instance Manager 2.24.0, F5 WAF for NGINX 5.16.0 or 5.14.2, NGINX Gateway Fabric 2.8.0, and NGINX Ingress Controller 5.7.0. Some older branches have no update, so F5 advises moving to a supported branch that contains a fix. Where patching cannot happen at once, configuration changes can lower the risk. For CVE-2026-97205, F5 recommends disabling either AIO or SSI. Turning off AIO may reduce performance for large static files or media streaming under heavy load, while disabling SSI stops NGINX from processing SSI tags. For CVE-2026-93479, administrators should replace unnamed regex captures with named captures and use them only inside the matching block. For CVE-2026-15176, F5 recommends avoiding alias inside a location block and avoiding $request_filename where possible. Teams should first run nginx -T to review the full active configuration, including included files, then compare the installed build against each advisory. After any change, nginx -t can check the syntax before the configuration is reloaded. These checks matter because the presence of an affected version alone does not prove that the needed configuration is active. The disclosure follows several other NGINX memory-safety fixes in 2026. Cybersecurity News previously reported three NGINX flaws involving heap overflow, memory disclosure, and use-after-free conditions and an earlier group of NGINX bugs that could cause code execution or denial of service . F5’s advisories do not report active exploitation of these three newly disclosed flaws. Still, internet-facing NGINX systems should be reviewed quickly because a successful request can restart workers and disrupt service, while a working ASLR bypass could raise the impact to code execution. Applying the fixed release remains the strongest response because the workarounds cover only the known unsafe configuration paths. An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline . The post Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code appeared first on Cyber Security News .

ALT: Sylvester's Shame Bag (Looney Tunes)

ALT: Homelander Capitão Pátria

Explore 3D Enigma models, follow their electrical circuits and rotor mechanisms, and learn how the machines were used.

ALT: Warhammer Silence Heretic

Most Amazing Wombat Tattoo Ideas (Wombat Tattoo Design Images) images that can inspire you to have a look-a-like Tattoo on your body. Kookaburra tattoo, Cute animal drawings, Tattoo designs

Let’s Encrypt will cut its default TLS certificate lifetime from 90 days to 64 days on February 10, 2027, giving website operators less time between renewals. The change applies to certificates issued or renewed from that date, while subscribers can still choose shorter certificate profiles offering 45 days or roughly six days. Let’s Encrypt Certificate Lifetime According to the October 7 announcement published by Let’s Encrypt , the nonprofit certificate authority confirmed the schedule. Existing certificates will remain valid until their normal expiry dates, and Let’s Encrypt will not revoke them as part of the transition. It expects the final 90-day certificate to expire on May 11, 2027. The shorter lifetime limits how long a certificate can remain trusted after a private key is stolen or a certificate is issued incorrectly. It also makes reliable renewal systems more important, especially for teams still using fixed schedules or manual steps. The move is part of the wider shift toward shorter public TLS certificate lifetimes. Cybersecurity News previously covered the CA/Browser Forum’s plan to reduce maximum validity to 47 days . Let’s Encrypt is moving faster, with its default profile set to 45 days on February 16, 2028, as outlined in its earlier certificate lifetime roadmap. Let’s Encrypt will start issuing 64-day certificates in its staging environment on October 14, 2026. Administrators can use this test service to check renewal behavior before the production change. Staging certificates are not trusted by browsers and should not replace certificates on live websites. For automated setups, the key feature is ACME Renewal Information, or ARI. ACME is the protocol used to request and renew certificates automatically. ARI lets Let’s Encrypt tell a supported client when to renew, helping it adjust to shorter lifetimes without relying on a fixed calendar. Administrators should check their client’s documentation to confirm ARI support. When ARI isn’t available, Let’s Encrypt recommends renewing at about two-thirds of the certificate’s lifetime. For a 64-day certificate, that means around day 43, rather than waiting until the old 60-day renewal point. The authority also recommends searching cron jobs, wrapper scripts, and runbooks for hardcoded values such as 83, 80, or 60. These numbers may reveal renewal rules designed around 90-day certificates. Updating those rules now also prepares systems for the 45-day default planned for 2028. Alongside certificate validity, Let’s Encrypt will reduce authorization reuse from 30 days to 10 days. This is the period during which an earlier domain control check can support another certificate request without repeating that check. The reuse period will fall to seven hours in 2028. Let’s Encrypt says this supports upcoming validation rules and removes the need for separate Certificate Authority Authorization rechecks on older validation data. Most subscribers will not need changes unless their ACME setup specifically depends on authorization reuse. Rate limits will not change because of the shorter lifetimes, according to Let’s Encrypt’s rate limit guidance. ACME endpoints and certificate issuance chains will also remain unchanged. Operators should test the full certificate workflow, including deployment and service reloads, rather than checking renewal alone. Teams managing many websites should also confirm that renewed certificates reach every server and that monitoring checks the certificate actually served to users after each reload. Alerts for failed renewals can help teams catch problems before expiry. The practical priority is dependable automation that keeps certificates current as renewal windows shrink. Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC The post Let’s Encrypt Cuts TLS Certificate Lifetimes From 90 to 64 Days Starting February 2027 appeared first on Cyber Security News .

ALT: Patrick Star: Head Explode Mind Blown (SpongeBob)