Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. [...]

F5 has disclosed three serious security flaws in NGINX Plus and NGINX Open Source that can let remote, unauthenticated attackers crash worker processes by sending crafted HTTP requests. In certain setups, the memory errors could also allow code execution, although F5 says that outcome requires Address Space Layout Randomization, known as ASLR, to be disabled or bypassed. All three issues affect the NGINX data plane, which handles user traffic, rather than its control plane. The flaws are tracked as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176. F5 published the three advisories on October 14, 2026, and rated every issue High at 8.1 under CVSS v3.1 and Critical at 9.2 under CVSS v4.0. The bugs do not make every NGINX server vulnerable by default because each one needs a specific software version and configuration. Multiple NGINX Vulnerabilities CVE-2026-97205 is a use-after-free flaw in ngx_http_core_module . It can be triggered when asynchronous file I/O, or AIO, is enabled and NGINX processes a Server Side Includes page containing an include virtual command. The worker may keep using memory after that memory has been released, leading to memory corruption or an unexpected worker shutdown. F5 credits security researcher Cyberlanc3r with reporting the issue. CVE-2026-93479 is a heap buffer overflow linked to the NGINX map directive and regular expression matching. The unsafe condition can appear when the root directive or an access-log format uses the map’s regex capture variables before the map output variable. A related path involves a non-cacheable variable used in a string expression. Crafted requests can then make a worker write beyond the allocated memory area and restart. F5 credits Matt Suiche of Tolmo and Mateusz Gierblinski for coordinated disclosure. CVE-2026-15176 is a separate heap buffer overflow in ngx_http_core_module . It affects a location block that combines alias with rewrite and a set or return directive that refers to $request_filename . The same risk can exist when $request_filename appears in an access log_format . F5 says a remote attacker can trigger the flaw without authentication, but the required server-side conditions remain outside the attacker’s control. The company found this issue internally. The affected range is broad. CVE-2026-97205 and CVE-2026-15176 affect NGINX Open Source 1.31.0 through 1.31.6 and 1.0.0 through 1.30.5, while the older 0.x line is also listed for CVE-2026-15176. CVE-2026-93479 has a narrower open-source range of 1.31.2 through 1.31.6 and 1.30.0 through 1.30.5. NGINX Plus 37.0.0 through 37.0.4 is affected by all three bugs. Related products, including NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric, and some NGINX Ingress Controller releases, are also affected. Administrators should upgrade NGINX Open Source to 1.31.7 or 1.30.6. NGINX Plus users on the 37.x line should move to 37.0.5.1 or 37.1.0.1. Fixed releases also include NGINX Instance Manager 2.24.0, F5 WAF for NGINX 5.16.0 or 5.14.2, NGINX Gateway Fabric 2.8.0, and NGINX Ingress Controller 5.7.0. Some older branches have no update, so F5 advises moving to a supported branch that contains a fix. Where patching cannot happen at once, configuration changes can lower the risk. For CVE-2026-97205, F5 recommends disabling either AIO or SSI. Turning off AIO may reduce performance for large static files or media streaming under heavy load, while disabling SSI stops NGINX from processing SSI tags. For CVE-2026-93479, administrators should replace unnamed regex captures with named captures and use them only inside the matching block. For CVE-2026-15176, F5 recommends avoiding alias inside a location block and avoiding $request_filename where possible. Teams should first run nginx -T to review the full active configuration, including included files, then compare the installed build against each advisory. After any change, nginx -t can check the syntax before the configuration is reloaded. These checks matter because the presence of an affected version alone does not prove that the needed configuration is active. The disclosure follows several other NGINX memory-safety fixes in 2026. Cybersecurity News previously reported three NGINX flaws involving heap overflow, memory disclosure, and use-after-free conditions and an earlier group of NGINX bugs that could cause code execution or denial of service . F5’s advisories do not report active exploitation of these three newly disclosed flaws. Still, internet-facing NGINX systems should be reviewed quickly because a successful request can restart workers and disrupt service, while a working ASLR bypass could raise the impact to code execution. Applying the fixed release remains the strongest response because the workarounds cover only the known unsafe configuration paths. An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline . The post Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code appeared first on Cyber Security News .

Let's compare four strategies for switching workspaces while working with Git.

GitLab has released urgent security updates to fix a critical vulnerability that could allow attackers to execute arbitrary code on affected servers without logging in. Tracked as CVE-2026-97229, the flaw carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company released patches on October 12, 2026. The vulnerability involves an integer overflow in GitLab’s CI/CD regular expression compiler. GitLab says insufficient regular expression validation could allow an unauthenticated attacker to trigger code execution through a specially crafted expression inside a CI/CD configuration. Regular expressions are text patterns used to match or filter data. Here, processing a malicious pattern could compromise the GitLab server itself. According to GitLab’s security advisory , exploitation is possible under certain conditions. The published description does not provide a complete attack sequence or identify the exact conditions required. However, the CVSS vector indicates network access, low attack complexity, no required privileges, and no user interaction. It also assigns high impact to confidentiality, integrity, and availability. This is server-side code execution, rather than malicious JavaScript running in a visitor’s browser. That difference makes the issue particularly serious for organizations hosting development projects on affected GitLab installations. Successful exploitation could threaten the server’s data and operation. The release notice does not state that attackers have exploited this vulnerability in real-world attacks. GitLab credited security researcher joaxcar with reporting the issue through its HackerOne bug bounty program. The company previously patched critical GitLab CI/CD regex vulnerabilities in September. Those earlier flaws required authentication, while the newly disclosed issue could allow exploitation without an account. The advisory does not establish whether these vulnerabilities share the same underlying cause. Affected Versions and Required Updates The affected releases are GitLab CE and EE versions from 19.2 before 19.2.8, from 19.3 before 19.3.4, and from 19.4 before 19.4.2. Administrators should upgrade affected self-managed installations immediately to the corresponding patched release. GitLab.com already runs the patched version, and GitLab Dedicated customers do not need to take action. The release also addresses other security weaknesses, including cross-site scripting, authorization failures, and a prompt-related issue in GitLab Duo Agent Platform. Earlier GitLab security updates covering CI/CD authorization flaws show why administrators should review the full patch notice rather than focus only on the headline vulnerability. GitLab warns that version 19.3.4 has a known bug affecting merge request pages when the Ona integration is enabled. A fix is planned for 19.3.5. Administrators should account for this issue during upgrades without overlooking the urgent security fix. GitLab’s linked instance security guidance provides broader protection advice. Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC The post Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers appeared first on Cyber Security News .

Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. [...]

Alt: Confused Doggo with Math Formulas

A Docker flaw, CVE-2026-17106 (dubbed CopyEscape) , lets malicious containers write files outside the docker cp destination, potentially enabling code execution and root-level compromise. The issue affects Docker’s archive extraction handling in moby/go-archive. When users copy files from a container to a host, Docker does not perform a simple direct transfer. The Docker daemon first packages the requested container files into a tar archive, and the local Docker CLI extracts that archive using the permissions of the user who ran the command. That process becomes dangerous when an attacker controls the source container. A normal command such as docker cp container:/report.txt ./report.txt appears safe because the user chooses the destination. However, CopyEscape allows an attacker to manipulate the archive created by a running container and plant a symlink that points outside the chosen output directory. Docker Tar Processing Flow (source : imperva ) The Docker CLI can then follow that symlink while extracting a later archive entry, causing the file write to land elsewhere on the host filesystem. CopyEscape Docker Flaw Imperva said the exploit chain combines two weaknesses. First, a time-of-check to time-of-use race in the archive-generation process lets a running container change a directory into a symbolic link while Docker is walking its filesystem. This can produce an inconsistent tar archive that describes the same path as both a directory and a symlink. Second, vulnerable extraction routines do not reliably confine writes to the destination folder after filesystem links are resolved. The result is an arbitrary file creation or overwrite primitive with the permissions of the Docker CLI process. A developer who runs Docker cp could have shell startup files, SSH configuration , cloud credentials, source code, or user-level persistence files replaced. The source filesystem shows escape as a symlink, but its child treats it as a directory (source : imperva ) On macOS, the vulnerable extraction occurs on the local system even though Docker Desktop runs containers inside a Linux virtual machine, making local user files a potential target. The risk is more serious on Linux systems where administrators, CI systems, maintenance scripts, or automated pipelines run sudo docker cp. In its proof of concept, Imperva replaced /usr/bin/runc with an attacker-controlled script. According to Imperva , once Docker later invoked the replaced runtime binary, the payload executed as root. The attack does not directly grant the container Docker daemon privileges instead, it abuses the elevated authority already granted to the docker cp command. CVE-2026-17106 also affects Docker Sandboxes through sbx cp , creating risks for AI-agent and coding-agent workflows when retrieving files from untrusted sandboxes. Docker Sandboxes 0.38.0 fixes the destination-escape issue. Docker addressed the flaw in Docker Desktop 4.86.0, released on August 10, 2026. The release notes describe the issue as a destination-escape flaw in docker container cp. The underlying moby/go-archive fix is available in version 0.3.0, while the affected package versions are earlier than 0.3.0. Organizations should upgrade Docker Desktop to version 4.86.0 or later and update Docker Engine and Docker CLI to current patched releases. Docker’s security advisory confirms that Desktop 4.86.0 fixes CVE-2026-17106. Until upgrades are complete, administrators should avoid copying files from running containers that are untrusted, compromised, or used for processing external content. Stopping a container before using docker cp can prevent the live filesystem race used in the demonstrated exploit. However, treat all archives from untrusted sources as hostile. Teams should also avoid sudo docker cp, remove root privileges from CI artifact-collection jobs where possible, and retrieve suspicious container data only from disposable virtual machines or isolated analysis environments. CopyEscape shows that archive extraction is itself a security boundary: a routine file-retrieval operation can become the path an attacker uses to cross from a container back onto the host. Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC The post CopyEscape Docker Flaw Lets Malicious Containers Overwrite Host Files and Gain Root Access appeared first on Cyber Security News .

[Experimental] A virtio device for near-native NVIDIA GPU access in KVM virtual machines. - nestrilabs/virtio-nvgpu

Multipath TCP (MPTCP) for Linux, an extension to TCP that enhances connection redundancy and performance by utilizing multiple underlying TCP sessions simultaneously. This site provides installation g...

At the core of the Hugging Face hacking incident were a series of human choices that traded security for speed.

With ML-DSA-44 validation enabled, 1.1.1.1 lets us test both challenges at Internet scale: carrying larger DNS responses and preventing fallback to conventional signatures.

A better and stronger spiritual successor to BZip2. - iczelia/bzip3

The surveillance seems aimed at the domestic market, but it knocks huge holes in the security of the devices it's found in.

Meet Z.ai, the AI assistant powered by GLM-5.2. Build websites, write code, handle long-horizon tasks, and get instant answers. Fast, smart, and reliable.

ALT: Chris Farley Says Holy Schnikes

Un robot chinois a battu samedi le record du 100 mètres de la légende jamaïcaine Usain Bolt, lors de la cérémonie d'ouverture des World Robot Gams à Pékin. Des dizaines d'humanoïdes sans visages et leurs opérateurs humains ont participé à des épreuves allant de l'athlétisme à la boxe, en passant par le football et les arts martiaux.

An update on the August 17 outage and the steps we're taking to improve reliability.

Extension NAS ultime ! Découvrez comment un ingénieur réseau a atteint 350 To avec ZimaBoard 2. Utilisez notre guide PCIe HBA pour maximiser dès maintenant la capacité de stockage de votre serveur dom...

Stripe a négocié l’acquisition d’OpenRouter pour plus de 7 milliards de dollars, révèle Bloomberg. Le géant du paiement avance ainsi ses pions dans le monde de l’IA, en intégrant l’un des orchestrateurs les plus populaires du marché. Il poursuit en parallèle les négociations visant à s’offrir PayPal, après le rejet de son offre initiale formulée […]