MAL-2026-13738 Malicious code in @openzeppelin-5/contracts (npm)

@openzeppelin-5/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v5 line via the look-alike scope @openzeppelin-5, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

Cybersecurity-writeups-

Security Write-ups A collection of cybersecurity case studies...

CVE-2026-66777

creationtimestamp| type| source ---|---|--- 2026-08-11 03:01:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7rq7fx366ozh7 2026-08-13 08:48:17+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0998...

Joern 4.0.601

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark

AI agents are rapidly improving in cybersecurity capabilities when the source code is available for analysis, yet much of the software most consequential to cybersecurity, including malware, firmware, and proprietary applications, is available only as binaries. Analyzing such software requires...

CVE-2026-43606: Observable Timing Discrepancy

Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks, resulting in high confidentiality and integrity impact due to the exposure of private cryptograph...

CATana: On the Dangers of SIM-Originating AT Commands

Hostile SIMs have been discussed as an attack vector against Mobile Equipment ME connected to cellular networks. One main attack path are proactive commands sent from the SIM to the victim device. In this work, the authors examine the threats posed by the RUN AT command which are SIM-originating...

CVE-2026-72911

creationtimestamp| type| source ---|---|--- 2026-08-10 21:24:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msqzwphlo425 2026-08-10 22:00:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msr3y6rwf324...

BloodHound v9.6.0-rc2

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound leverages grap...

CVE-2026-72878

creationtimestamp| type| source ---|---|--- 2026-08-10 20:26:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msqwowoee625 2026-08-11 15:14:50+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mssvrauood2p 2026-08-11 15:15:01+00:00| seen|...

CVE-2026-68403

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-68328

In the Linux kernel, the following vulnerability has been resolved: nfp: Check resource mutex allocation nfpcppresourcefind allocates a CPP mutex handle for the matching resource-table entry and then reports success. nfpresourcetryacquire immediately passes that handle to nfpcppmutextrylock...

CVE-2026-68269

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Add missing nospec on parallel submit slot Add missing Spectre mitigation for userspace controlled parallel submission slot. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry...

CVE-2026-68253

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...

CVE-2026-68248

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Return NULL on error in activeinstance Avoid returning &node-base when node is NULL due to OOM during GFPATOMIC allocation. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry picked...

CVE-2026-59899

creationtimestamp| type| source ---|---|--- 2026-08-10 13:20:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msq6vheark2o 2026-08-13 08:46:23+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0991 2026-09-20 05:20:11+00:00| seen|...

DEBIAN-CVE-2026-68254

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered by coincidence through the checks in intelvrriscapable and intelvrrisinrange, but be more...

DEBIAN-CVE-2026-68247

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...

CVE-2026-68242

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix NULL deref on schedengine alloc failure Avoid using intelcontextput before intelcontextinit in execlistscreatevirtual as the krefput inside would lead to NULL deref on the IOCTL path when schedengine allocation...

UBUNTU-CVE-2026-68244

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Do not leak siblings on proto context error After a successful BALANCE/PARALLELSUBMIT extension on context creation, error during processing of next user extension leaks the siblings array. Fix that. Discovered usin...