Comment on Friday Squid Blogging: Rotting Squid on a Beached California Boat by Clive Robinson
Clive Robinsonschneier.com
Advisories
Vulnerabilities, security writing, standards and rules as they were filed.
| Name | By | Where | When |
|---|---|---|---|
| Comment on On the NSA’s Supercomputer from the 1960s by Weather | Weather | schneier.com | 1h ago |
| Comment on Friday Squid Blogging: Rotting Squid on a Beached California Boat by Weather | Weather | schneier.com | 2h ago |
| Comment on Friday Squid Blogging: Rotting Squid on a Beached California Boat by r | r | schneier.com | 2h ago |
| Comment on How Candidates Could Use AI for Good by Q | Q | schneier.com | 3h ago |
| Comment on How Candidates Could Use AI for Good by Vesselin Bontchev | Vesselin Bontchev | schneier.com | 3h ago |
| Airworthiness Directives; Pratt & Whitney Engines | federalregister.gov | ||
| Comment on On the NSA’s Supercomputer from the 1960s by Pomsky Puppies | Pomsky Puppies | schneier.com | 5h ago |
| Comment on On the NSA’s Supercomputer from the 1960s by Präzisions waffen | Präzisions waffen | schneier.com | 5h ago |
| Comment on 25 Years of Mass Surveillance Is Enough by Bulldoggenwelpen | Bulldoggenwelpen | schneier.com | 5h ago |
| How Candidates Could Use AI for Good | Bruce Schneier | schneier.com | 21h ago |
| Fake CAPTCHA Scams | Bruce Schneier | schneier.com | 1d ago |
| 25 Years of Mass Surveillance Is Enough | Bruce Schneier | schneier.com | 2d ago |
| Notice of Determinations; Culturally Significant Objects Being Imported for Exhibition-Determinations: “Masterpieces of Printmaking: 1460-Now” Exhibition | federalregister.gov | ||
| On the NSA’s Supercomputer from the 1960s | Bruce Schneier | schneier.com | 2d ago |
| Upcoming Speaking Engagements | Bruce Schneier | schneier.com | 3d ago |
| Using AI for Weapons Development | Bruce Schneier | schneier.com | 3d ago |
| Microsoft’s Patching | Bruce Schneier | schneier.com | 3d ago |
| Waltham, Massachusetts, USA | B. Schneier | schneier.com | 5d ago |
| Friday Squid Blogging: Rotting Squid on a Beached California Boat | Bruce Schneier | schneier.com | 6d ago |
| Science and Technology Reinvention Laboratory (STRL) Personnel Demonstration Project (PDP); Defense Health Agency (DHA) Research and Development (R&D) Activity, Fort Detrick, Frederick, Maryland | federalregister.gov | ||
| My Talk at DEF CON | Bruce Schneier | schneier.com | 6d ago |
| Cliff Stoll’s DEF CON Talk | Bruce Schneier | schneier.com | 6d ago |
| CVE-2026-11496The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs. | nist.gov | Sep 11 | |
| CVE-2026-11446The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data. | nist.gov | Sep 11 | |
| CVE-2026-88260Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM (Build 109). | nist.gov | Sep 11 | |
| CVE-2026-89151Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature. | nist.gov | Sep 11 | |
| Oil Country Tubular Goods From the Socialist Republic of Vietnam: Final Results of Antidumping Duty Administrative Review; 2023-2024 | federalregister.gov | ||
| CVE-2026-78135libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass. | nist.gov | Sep 11 | |
| CVE-2026-88914A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash. | nist.gov | Sep 11 | |
| CVE-2026-89092The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service. | nist.gov | Sep 11 | |
| CVE-2026-89145Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails. | nist.gov | Sep 11 | |
| CVE-2026-78127libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser. | nist.gov | Sep 11 | |
| CVE-2026-78129 | strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption. | nist.gov | Sep 11 |
| Airworthiness Directives; Airbus SAS Airplanes | federalregister.gov | ||
| CVE-2026-78130strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser. | nist.gov | Sep 11 | |
| CVE-2026-78131strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser. | nist.gov | Sep 11 | |
| CVE-2026-78132strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax. | nist.gov | Sep 11 | |
| CVE-2026-78133libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling. | nist.gov | Sep 11 | |
| CVE-2026-78134strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity. | nist.gov | Sep 11 | |
| CVE-2026-78123strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin. | nist.gov | Sep 11 | |
| Airworthiness Directives; ATR-GIE Avions de Transport Régional Airplanes | federalregister.gov | ||
| CVE-2026-78124strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime. | nist.gov | Sep 11 | |
| CVE-2026-78126strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin. | nist.gov | Sep 11 | |
| CVE-2026-84941An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information. | nist.gov | Sep 11 | |
| CVE-2026-81905Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued for one purpose can be redeemed for another: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to set a new password on the target account, and a password-reset hash can be submitted to the email-validation endpoint to activate an account. Exploitation requires the attacker to first obtain a valid hash through a separate channel (for example email interception, log exposure, or SSRF against an internal mail relay), so the flaw amplifies the impact of any hash disclosure rather than creating a standalone entry point. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting. | nist.gov | Sep 11 | |
| CVE-2026-81906Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully authenticated for the callback response, with the login recorded and login events dispatched. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting. | nist.gov | Sep 11 | |
| CVE-2026-77807The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled. | nist.gov | Sep 11 | |
| Information Collection Activities; Submission to the Office of Management and Budget (OMB) for Review and Approval; Comment Request; iEdison System | federalregister.gov | ||
| CVE-2026-18121Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lightbox endpoint (/ccm/calendar/view_event/{bID}/{occurrence_id}) does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the occurrence directly from an attacker‑supplied, sequential identifier without confirming that it belongs to the calendar configured on the referenced block. An unauthenticated visitor who can render any public calendar block with lightbox properties enabled could therefore supply an arbitrary occurrence identifier and disclose event metadata — title, date, description, page link, and configured event attributes — from calendars they are not permitted to view. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting. | nist.gov | Sep 11 | |
| CVE-2026-17176An OS command injection vulnerability in the TDDP module of Deco BE11000 allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability | nist.gov | Sep 11 |