snuffleupagus

Snuffleupagus php7 および php8 用セキュリティモジュール - バグクラスを排除し、残りは仮想パッチで対応! 主な機能 • ダウンロード • 使用例 • ドキュメント • ライセンス • 謝辞 Snuffleupagus は、PHP 7+ および 8+ 用のモジュールで、バグクラス全体を排除することで、Webサイトに対する攻撃のコストを大幅に引き上げることを目的としています。また、強力な仮想パッチシステムを提供し、管理者が PHP コードに触れることなく、特定の脆弱性を修正し、不審な動作を監査できるようにします。 主な機能 顕著なパフォーマンスへの影響なし...

insmod_block

insmodblock Linux: - - - - - - - 作者：nu11secur1ty: https://github.com/nu11secur1ty/linux-nu11secur1ty Linux: - - - - - - - 作者：nu11secur1ty: https://gitlab.com/nu11secur1ty/linux-nu11secur1ty txt Linux Kernel security modules by nu11secur1ty GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007...

snuffleupagus

Snuffleupagus 适用于 php7 和 php8 的安全模块 - 消除 bug 类别并对其余进行虚拟补丁！ 主要特性 • 下载 • 示例 • 文档 • 许可证 • 致谢 Snuffleupagus 是一个 PHP 7+ 和 8+ 模块，旨在通过消除整个 bug 类别来大幅提高攻击网站的成本。它同时还提供了一个强大的虚拟补丁系统，使管理员无需修改 PHP 代码即可修复特定漏洞并审计可疑行为。 主要特性 无明显的性能影响 强大但易于编写的虚拟补丁规则 消除几类漏洞 基于反序列化的代码执行 基于 mail 的代码执行 窃取 Cookie 的 XSS 基于文件上传的代码执行 弱 PRN...

CrowArmor

CrowArmor：Linux 驱动程序 什么是 CrowArmor？ CrowArmor 是一款面向 Linux 的系统安全驱动程序，我们利用 LSM 接口来增强内核安全性，为 MalDec-EDR 提供支持。代码文档及安装指南请参阅 Documentation 开发流程 标准做法是：在 main 分支及带标签的分支中，为客户提供最新的稳定生产版本。test 分支作为 development 分支的镜像，需经过一系列测试和质量保证（QA）流程。与此同时，development（dev）分支专门用于项目的持续开发、功能增强与调整。 +-----------+ | feature1 |...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fscrypt: destroy keyring after securitysbdelete The function fscryptDestroykeyring must be called after all potentially-encrypted inodes have been evicted; otherwise, it cannot safely destroy the keyring. Since inodes that are...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: LSM: General protection fault in legacyparseparam The usual LSM hook mechanism of “bailing on failure” doesn’t work in cases where a security module returns an error code indicating that it doesn’t recognize an input. In this...

Astra Linux – Vulnerability in Containerd

Containerd is a container runtime. A bug was discovered in containerd versions prior to 1.4.8 and 1.5.4, where pulling and extracting a specially crafted container image could result in changes to Unix file permissions for existing files in the host’s filesystem. Changes to file permissions could...

snuffleupagus v0.14.0

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

EUVD-2026-59360

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the skctx Currently updateskctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the referenc...

EUVD-2026-59359

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label with fnlabelbuildinscope before the nonewprivs subset check. The build helper can fail and return NULL or an ERRPTR, but the result was...

PT-2026-72648

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the AppArmor module where the aa change profile function utilizes fn label build in scope to create a replacement label before performing a no new privs subset check. ...

CVE-2026-68179 misc: nsm: only unlock nsm_dev on post-lock error paths

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...

EUVD-2026-55280

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

CVE-2026-69257

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list...

Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Summary Flowise's HTTP security module httpSecurity.ts fails to normalize IPv4-mapped IPv6 addresses e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254 before checking them against the deny list. Due to an ipaddr.js kind mismatch ipv6 vs ipv4, all IPv4 CIDR deny rules are silently skipped for...

CVE-2026-64393

In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SETINFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and LSM checks using the...