LinuxSecurity.com

Open-source maintainers can now apply for free security scans from Anthropic.

Go 1.27.2 and 1.26.9 arrived on Oct 8, 2026 with corrections for 15 security flaws.

A file on a build machine could end up in a cloud deployment bundle because of a flaw disclosed by Amazon Web Services (AWS) on Oct 8, 2026.

OpenStack disclosed a Zaqar security flaw on Oct 7, 2026 that lets an authenticated user access another project’s messaging queues.

X.Org has issued fixes for 12 vulnerabilities in its display software.

A bug in Linux’s TCP Fast Open code can leave it reading memory that has already been released.

Apache disclosed a critical Apache Jackrabbit session hijacking flaw on Oct 7, 2026.

IBM and Red Hat say their Lightwell initiative has identified and remediated more than 400 previously unknown vulnerabilities in widely used Java libraries.

Why is the orders application talking to the backup server?

The vLLM project published security advisories on October 6, 2026, identifying version 0.31.0 as the fix for remote code execution (RCE), service crashes, and request-handling flaws.

Deepanshu Kartikey has submitted a patch for a Linux filesystem bug that lets a crafted JFS disk image overwrite kernel memory during a directory listing.

Andrey Misiurov has proposed a patch for a Linux NTFS bug that lets a crafted disk image make the kernel read beyond a memory buffer.

Shubham Antil has submitted a revised two-patch series addressing an NFC security bug in Linux's device-shutdown code.

Jérémy Jean has confirmed that a maintainer's proposed patch stops the reproduced failure behind an nftables interval bug.

“Which settings are we supposed to use?” is a reasonable question from an administrator building a server.

Apache published four Struts security notices on October 5, 2026. The fixes are in the new 6.12.0 and 7.4.0 releases.

An npm package used throughout the SubQuery project was poisoned.

On an affected host, a second mount of the same NFSv4 share could alter SELinux label handling on the first.

Linux developers have merged a fix for a Linux kernel vulnerability that can leave Binder device creation writing to memory the kernel has already released.

Citrix has confirmed targeted attacks involving a Citrix NetScaler vulnerability and urged affected customers to update.