LinuxSecurity.com

Linux developers have merged a fix for a Linux kernel vulnerability that can leave Binder device creation writing to memory the kernel has already released.

Citrix has confirmed targeted attacks involving a Citrix NetScaler vulnerability and urged affected customers to update.

Apache is asking OpenOffice users to turn off its Java integration after warning that a malicious document could run code on their computer.

Apache released Thrift 0.25.0 on Sep 30, 2026 with memory checks for several C++, Java, and Python components.

Apache’s release notice on Oct 3, 2026 lists six Apache Directory LDAP API vulnerabilities.

OpenSSL issued fixes on Sep 29, 2026 for an OpenSSL vulnerability that can send unrelated program memory to another party during secure connection setup.

LiteLLM has patched a privilege-escalation flaw that can let an authenticated internal user forge an administrative session and reach command-execution features in some AI gateway deployments.

Apache released HTTP Server 2.4.69 on October 1, 2026, to fix security faults ranging from unwanted code execution to mishandled web responses.

Apache detailed two Apache APISIX vulnerabilities in notices issued on October 1, 2026.

Apache disclosed CVE-2026-94250 on October 1, 2026, warning that public access to a batch-request endpoint can let an attacker exhaust a gateway worker's memory.

Apache's September 30, 2026 advisory, CVE-2026-88789, warns that an XML document can make an affected Camel Quarkus application read files or contact internal services.

Linux developers have proposed an IPsec fix after reproducing a memory error in IP-TFS, a mode that groups and pads encrypted traffic to make traffic patterns harder to infer.

Linux developers have proposed a FastRPC fix for a race that can leave the kernel using memory after it has been released.

Linux developers have proposed six fixes for the driver that reads QNX6 filesystems, a disk format associated with the QNX operating system.

LightLLM, software used to serve AI models, can expose Linux AI servers to remote code execution when operators enable its profiling mode, a tool for measuring performance.

ModSecurity has released fixes for a group of web application firewall (WAF) weaknesses that can let dangerous input reach Linux-hosted applications without being inspected as intended.

A Linux device driver fix closes a use-after-free risk in the AC100 real-time clock (RTC) driver.

Flatpak 1.18.4 fixes three vulnerabilities that could let a malicious sandboxed app affect files or processes on its Linux host.

A Linux flash-storage fix prevents a double free, in which the kernel releases the same object twice during device setup.

Apache released Karaf 4.4.12 on September 27, 2026, to fix three authorization flaws in its Java server runtime.