DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover

A new exploit kit for Apple iOS devices designed to steal sensitive data from is being wielded by multiple threat actors since at least November 2025, according to reports from Google Threat Intelligence Group GTIG, iVerify, and Lookout. According to GTIG, multiple commercial surveillance vendors...

wolfSSL security vulnerabilities

wolfSSL CyaSSL is a small, portable embedded SSL programming library developed by the American company wolfSSL, designed for developers working with embedded systems. There is a security vulnerability in wolfSSL. This vulnerability stems from a protection mechanism that fails in the post-quantum...

MiracleLinux 8 : container-tools:rhel8 (AXSA:2026-338:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-338:01 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

dev.jcputney:keycloak-theme-additional-info-extension (>=1.1.4, <=1.1.5), org.keycloak:keycloak-crypto-fips1402 (23.0.2) +13 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-services (23.0.2)

org.keycloak:keycloak-services MAVEN version 23.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - dev.jcputney:keycloak-theme-additional-info-extension =1.1.4, =1.1.5 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.11), com.github.vzakharchenko:cisco-radius-plugin (1.4.11) +22 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-services (21.0.0)

org.keycloak:keycloak-services MAVEN version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.11 -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (2.0.0), fr.cnieg.keycloak:attribute-login-provider (1.3.5) +59 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (21.1.2)

org.keycloak:keycloak-server-spi-private MAVEN version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 2.0.0 -...

fr.cnieg.keycloak:attribute-login-provider (1.3.5), io.phasetwo.keycloak:keycloak-magic-link (0.15) +14 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-services (21.1.2)

org.keycloak:keycloak-services MAVEN version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.5 - io.phasetwo.keycloak:keycloak-magic-link 0.15 -...

de.arbeitsagentur.opdt:keycloak-extension-filestore (>=1.0.2-25.0, <=1.0.4-25.0), org.keycloak:keycloak-crypto-fips1402 (25.0.5) +13 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-services (25.0.5)

org.keycloak:keycloak-services MAVEN version 25.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-extension-filestore =1.0.2-25.0, =1.0.4-25.0 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.11), com.github.vzakharchenko:cisco-radius-plugin (1.4.11) +62 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (21.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.11 -...

fr.cnieg.keycloak:attribute-login-provider (>=1.3.9, <=1.3.10), io.phasetwo.keycloak:keycloak-events (>=0.21, <=0.22) +41 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (22.0.5)

org.keycloak:keycloak-server-spi-private MAVEN version 22.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - fr.cnieg.keycloak:attribute-login-provider =1.3.9, =0.21, =0.44, =3.2.8.final,...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (4.0.2-25.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (4.0.2-25.0) +33 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (25.0.4)

org.keycloak:keycloak-server-spi-private MAVEN version 25.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension 4.0.2-25.0 -...

io.kokuwa.keycloak:keycloak-event-metrics (0.2.1), org.keycloak:keycloak-crypto-fips1402 (21.1.0) +13 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-services (21.1.0)

org.keycloak:keycloak-services MAVEN version 21.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics 0.2.1 - org.keycloak:keycloak-crypto-fips1402 21.1.0 -...

Fake Pudgy World site steals your crypto passwords

A phishing site impersonating the newly-launched Pudgy World browser game is targeting crypto users with a technique that goes well beyond a convincing logo and matching color scheme. Pudgy World is a free-to-play browser game built around the Pudgy Penguins NFT brand. Players explore a virtual...

New Vidar 2.0 Infostealer Spreads via Fake Game Cheats on GitHub, Reddit

The new infostealer campaign spreads Vidar 2.0 via fake game cheats on GitHub and Reddit, stealing crypto, login tokens, and files while targeting young gamers ignoring security warnings...

crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leaka...

@0xcurvy/curvy-sdk (0.0.8-rc.1), @acyclic/keythereum (>=1.1.0, <=1.1.2) +456 more potentially affected by CVE-2026-4258 via sjcl (>=1.0.0, <=1.0.8)

sjcl NPM version =1.0.0, =1.1.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.1.5, =9.0.7, =9.0.7, =11.5.2, =11.5.2, =1.0.1, =1.0.7 and more Source cves: CVE-2026-4258 Source advisory: OSV:GHSA-2W8X-224X-785M...

container-tools:rhel8 security update

An update is available for module.skopeo, aardvark-dns, crun, module.udica, module.cockpit-podman, module.criu, conmon, runc, containernetworking-plugins, python-podman, toolbox, module.oci-seccomp-bpf-hook, module.containers-common, podman, module.aardvark-dns, module.libslirp, fuse-overlayfs,...

CVE-2026-4258

Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH...

Important: Red Hat Security Advisory: container-tools:rhel8 security update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...