LinuxSecurity.com

An attacker could log in as another user without passing the password or signature checks meant to stop them.

You do not have to run an untrusted program for it to become dangerous.

A local user with no write permission changed a root-owned file's contents in a published XFS demonstration.

An unauthenticated visitor could make an affected WordPress site permanently delete content already in its trash by submitting a public form.

Open-source maintainers can now apply for free security scans from Anthropic.

Go 1.27.2 and 1.26.9 arrived on Oct 8, 2026 with corrections for 15 security flaws.

A file on a build machine could end up in a cloud deployment bundle because of a flaw disclosed by Amazon Web Services (AWS) on Oct 8, 2026.

OpenStack disclosed a Zaqar security flaw on Oct 7, 2026 that lets an authenticated user access another project’s messaging queues.

X.Org has issued fixes for 12 vulnerabilities in its display software.

A bug in Linux’s TCP Fast Open code can leave it reading memory that has already been released.

Apache disclosed a critical Apache Jackrabbit session hijacking flaw on Oct 7, 2026.

IBM and Red Hat say their Lightwell initiative has identified and remediated more than 400 previously unknown vulnerabilities in widely used Java libraries.

Why is the orders application talking to the backup server?

The vLLM project published security advisories on October 6, 2026, identifying version 0.31.0 as the fix for remote code execution (RCE), service crashes, and request-handling flaws.

Deepanshu Kartikey has submitted a patch for a Linux filesystem bug that lets a crafted JFS disk image overwrite kernel memory during a directory listing.

Andrey Misiurov has proposed a patch for a Linux NTFS bug that lets a crafted disk image make the kernel read beyond a memory buffer.

Shubham Antil has submitted a revised two-patch series addressing an NFC security bug in Linux's device-shutdown code.

Jérémy Jean has confirmed that a maintainer's proposed patch stops the reproduced failure behind an nftables interval bug.

“Which settings are we supposed to use?” is a reasonable question from an administrator building a server.

Apache published four Struts security notices on October 5, 2026. The fixes are in the new 6.12.0 and 7.4.0 releases.