ceph: ceph: RGW STS session tokens vulnerable to CBC bit-flip attack enabling admin privilege escalation

A flaw was found in Ceph RGW's STS Security Token Service session token implementation. The STS tokens use the same unauthenticated AES-128-CBC encryption as CephX, which lacks message authentication and uses a hardcoded initialization vector. Because there is no integrity protection on the token...

CacheTrap

CacheTrap Repository for "CacheTrap: Unveiling a Stealthier Gray-Box Trojan against LLMs" , IEEE/ACM International Conference on Computer-Aided Design ICCAD, 2026. arXiv CacheTrap searches for a single bit flip in the KV cache of a fine-tuned LLM classifier and measures the resulting attack succe...

PT-2026-106648

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drm pending vblank event leak in error path for out fence ptr When an out fence ptr is provided but DRM MODE PAGE FLIP EVENT is not set, a drm pending vblank event will be allocated. If later, there is an allocation...

BARE-AI: Bit-Flip Attack Resilience in AI Hardware through Built-In Performance Monitors

Deep Neural Networks DNNs are integral to many safety critical systems, yet they remain highly vulnerable to bit-flip attacks BFAs, where a few memory level perturbations can drastically degrade accuracy. Existing defenses incur significant hardware overhead, depend on retraining, or fail against...

fish-live-in-trees

الأسماك تعيش في الأشجار حقن سياق مواءمة وقت تشغيل LLM في بيئة الإنتاج RACI المؤلف: شون كافاناغ التاريخ: 2026-02-16 البيئة: Gemini 3 Flash الطبقة المجانية - واجهة الإنتاج العامة نوع الاستغلال: محور سياقي الدقة الواقعية ← الأصالة التفاعلية لا حمولات كسر حماية. لا أدوات خاصة. مجرد إعادة تأطير. أفضل...

Astra Linux – Vulnerability in libstb

stbimage is a single-file library licensed under MIT that is used for processing images. When stbisetflipverticallyonload is set to TRUE, and reqcomp is set to a value that does not match the actual number of components per pixel, the library attempts to flip the image vertically. A specially...

Online AutoML: Evaluating Poisoning Attacks on Adversarial Training Defense Strategy in IoT Networks

Machine learning ML-powered poisoning attack vectors are adversarial maneuvers whereby an attacker intentionally inserts, corrupts, or alters training data to distort an ML model's learning process. The objective is to diminish model efficacy, instill biases, induce misclassifications, or include...

Security-Enhanced Seed-Based Weight Quantization for Large Language Models

Large language models LLMs incur substantial storage, memory-bandwidth and energy costs, motivating compact weight representations. Existing seed-based compression methods reconstruct weights from compact pseudo-random representations but do not explicitly account for the non-uniform sensitivity ...

ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers

Large language models are being integrated into malware triage workflows as reasoning components that summarize static evidence and produce analyst-facing verdicts. This paper shows that the same reasoning capability introduces a new attack surface. We present ALIBI, a semantic cover story attack...

PT-2026-93457

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Direct Rendering Manager DRM when PAGE FLIP EVENT is used and a signal is sent to the thread. Specifically, if an event is allocated in the prepare signaling...

Astra Linux – Vulnerability in libstb

stbimage is a single-file library licensed under MIT, used for processing images. If stbiloadgifmain in stbiloadgiffrommemory fails, it returns a null pointer and may leave the z variable uninitialized. If the caller also sets the vertical flipping flag, the process continues by calling...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm: Do not accidentally unreference the same framebuffer multiple times due to deadlock handling. If a deadlock occurs after the fb lookup in drmmodepageflipioctl, we proceed to unreference the fb and then retry the entire proce...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fixed a null pointer crash in mtkdrmcrtcfinishpageflip. It is possible that mtkcrtc-event is NULL in mtkdrmcrtcfinishpageflip. The pendingneedsvblank value is set by mtkcrtc-event. However, in mtkdrmcrtcatomicFlush,...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net/tls: Fixed the reversed sign in calls to tlserrabort. sk-skerr seems to expect a positive value, a convention that ktls doesn’t always follow, leading to memory corruption in other code. For example: c kworker...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/gma500: Fixed a bug where a sleeping function called from an invalid context caused errors. The function gmacrtcpageflip held the eventlock spinlock while calling crtcfuncs-modesetbase, which requires the wwmutex. The only...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Fixed out-of-bounds accesses in RX fixup The function aqc111rxfixup contains several out-of-bounds accesses that can be triggered by a malicious or defective USB device. Specifically: - The metadata array...

Linux Distros Unpatched Vulnerability : CVE-2026-90648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a table flip attack. It does not...

CVE-2026-90648

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc in wasmrtallocatefuncreftable wasm2c/wasm-rt-impl-tableops.inc. When the funcref table allocation...

DEBIAN-CVE-2026-89520

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's picknexttask operates on all sibling rqs under one acquisition of the shared core-wide lock. A -picktask that releases the rq lock leaves every...

CVE-2026-89520 sched/core: Make core-sched flips wait for in-flight selections

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's picknexttask operates on all sibling rqs under one acquisition of the shared core-wide lock. A -picktask that releases the rq lock leaves every...