Rocky Linux 9 [CIQ] Security Update: runc / runc-debuginfo / runc-debugsource (crlsa-2022_8090)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20228090 advisory. runc: incorrect handling of inheritable capabilities CVE-2022-29162 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 8 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2022_1566)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221566 advisory. podman: Default inheritable capabilities for linux container should be empty CVE-2022-27649 buildah: Default inheritable capabilities for linux container...

Distillation Defenses Easily Break after Reinforcement Learning

Distillation attacks copy the reasoning capabilities of closed-source large language models, allowing bad actors to replicate state-of-the-art performance at low cost. Attackers systematically collect a large volume of frontier model reasoning traces and then train i.e., "distill" their own model...

PT-2026-98362

Name of the Vulnerable Software and Affected Versions Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress versions prior to 4.8.7 Description An issue exists due to missing permission enforcement on the publicly accessible REST route POST...

Erlang/OTP DoS

The vulnerability of the Erlang/OTP software platform is related to deficiencies in prediction capabilities. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

dockerlabs-los-3-hackers

🐳 DockerLabs — Los 3 Hackers Write-up Autor de la máquina...

CVE-2026-94487

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-94487 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-94487 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

EUVD-2026-85480

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-94487

The PublishPress Capabilities WordPress plugin, in versions

WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Intrudify in WordPress Plugin PublishPress Capabilities versions = 2.50.1...

PT-2026-97465

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-94487: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

GHSA-XP3C-3JW3-4VCR OpenBao Skips Stricter Deny Policy for LIST operations

Impact When a policy operator has written capabilities = "deny" on a path with a trailing wildcard but allowed a broader list operation e.g., a deny on secrets/metadata/restricted/ but allowed list on secrets/metadata/, OpenBao would incorrectly allow the operation. This did not impact other...

SUSE CVE-2026-92574

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, nonewprivs, and seccomp state from the checkpoint instead ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bluez (UTSA-2026-054081)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054081 advisory. BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in...

FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling

A vulnerability in FreeRDP's server-side RDSTLS allows remote, unauthenticated attackers to bypass authentication. By sending a crafted capabilities PDU instead of the expected authentication request, an attacker can gain an authenticated session without valid credentials...

Should you care about an “AI slowdown?”

Welcome to this week's edition of the Threat Source newsletter. There's been a lot of talk recently about slowing down the pace of AI development. And yes, there are legitimate moral, ethical, geopolitical, and safety concerns with the use of AI. It's not clear yet whether an AI slowdown could...

CVE-2026-92956 vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...