apple

A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. [...]

Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cybersecurity defense, landing a firm lead in SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitation, and

Apple’s latest updates include a fix for a CoreGraphics bug that may have been exploited in targeted attacks. The fix is now available for older iPhones and iPads. Apple released security updates on October 26. Apple first fixed the flaw in iOS 26.7.1. Its latest updates also bring the fix to older devices that can’t run iOS 26, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad. The iOS 18.7.11 update is a backport: it brings a fix from a newer software version to an older one. Here, Apple has made the fix available to older devices running iOS 18, so they can be protected without upgrading to an operating system they don’t support. Updates for your particular device The table below shows which updates are available and links to Apple’s security information for each one. Name and information link Available for iOS 27.2 and iPadOS 27.2 iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later iOS 26.7.2 and iPadOS 26.7.2 iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later iOS 18.7.11 and iPadOS 18.7.11 iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation macOS Golden Gate 27.2 macOS Golden Gate macOS Tahoe 26.7.2 macOS Tahoe macOS Sequoia 15.8.2 macOS Sequoia tvOS 27.2 Apple TV 4K 2nd generation and later watchOS 27.2 Apple Watch Series 9 and later visionOS 27.2 Apple Vision Pro (all models) Safari 27.2 macOS Sequoia and macOS TahoetvOS 26.6.1 (no published CVE entries)Apple TV HD and Apple TV 4K 1st generationHow to update your Apple devicesHow to update your iPhone or iPad For iOS and iPadOS users, here’s how to check if you’re using the latest software version: Go to  Settings  >  General  >  Software Update . You will see if there are updates available and be guided through installing them. Turn on  Automatic Updates  if you haven’t already—you’ll find it on the same screen. How to update your Mac To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps: Click the Apple menu in the upper-left corner of your screen. Choose  System Settings  (or  System Preferences  on older versions). Select  General  in the sidebar, then click  Software Update  on the right. On older macOS, just look for  Software Update  directly. Your Mac will check for updates automatically. If updates are available, click  Update Now  (or  Upgrade Now  for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these  instructions . Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process). Keep your Mac plugged in and connected to the internet until the update is done. How to update your Safari browser Safari updates are included with macOS updates, so installing the latest version of macOS will also update Safari. To check manually: Open the Apple menu  > System Settings > General > Software Update . If you see a Safari update listed separately, click  Update Now  to install it. Restart your device when prompted. Technical details The headline bug is CVE-2026-86950 , in CoreGraphics, Apple’s framework for drawing graphics, images and PDF content. It’s an out-of-bounds write flaw, where software writes data outside the memory set aside for it. The result is that “processing a maliciously crafted file may lead to arbitrary code execution.” Apple says it is aware of a report that the flaw may have been exploited in an “extremely sophisticated attack against specific targeted individuals” on versions of iOS before iOS 27. That wording indicates Apple believes the bug was used in real attacks against a limited group of users. Usually, journalists, activists and officials are the targets of this kind of attack. If you think you could be a target of highly sophisticated spyware, you should update, restart your phone, and consider applying Apple’s Lockdown Mode . Scammers know more about you than you think.   Malwarebytes Mobile Security protects you from phishing , scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.  .wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}ul.menu .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;padding:var(--kb-btn-padding);margin:var(--kb-btn-margin);box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);} Try it now

Apple heeft meerdere kwetsbaarheden verholpen in macOS, met name in de versies Golden Gate 27.2, Sequoia 15.8.2, Tahoe 26.7.2 en Monterey 12.7.5. De kwetsbaarheden betroffen diverse beveiligingsaspecten binnen macOS, waaronder onvoldoende validatie van symbolische links (symlinks), onjuiste permissiecontroles, onvolledige autorisatiemechanismen, en fouten in geheugenbeheer zoals out-of-bounds reads en writes, use-after-free, buffer overflows, en race conditions. Deze fouten konden door lokale of remote aanvallers worden misbruikt om privileges te escaleren, sandbox-beperkingen te omzeilen, gevoelige gebruikersdata of kernelgeheugen te benaderen, of om denial-of-service condities te veroorzaken door onverwachte systeem- of applicatiecrashes. Daarnaast werden problemen opgelost in Gatekeeper, de beveiligingscomponent die code-integriteit en app-verificatie afdwingt, waarbij bypasses werden voorkomen. Ook werden kwetsbaarheden in de verwerking van diverse bestandstypen zoals afbeeldingen, video’s, audio, fonts, PDF’s en ZIP-archieven aangepakt om geheugenbeschadiging en ongeautoriseerde code-uitvoering te voorkomen. De fixes omvatten verbeterde validatie van invoer, strengere toegangscontroles, verbeterde geheugenbeheer en state management, en het versterken van sandbox- en privacymechanismen. De updates zijn ook doorgevoerd in andere Apple-platforms zoals tvOS, visionOS en watchOS, waarbij consistentie in beveiligingsverbeteringen werd nagestreefd.

An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of

Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]

Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file. Patches for the flaw were released last month by Apple in

Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones. The post iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 appeared first on SecurityWeek .

A reverse engineer claims that their Samsung smart TV has been collecting audio without their consent. The researcher, who calls themselves “log4j,” said in an X thread that their 2025 Samsung TV was delivering ads that seemed suspiciously relevant to them. Investigating, they claim to have found a package called “always on voice,” which uses the TV’s built-in microphone to collect sounds from the room. The software logged events such as dogs barking and babies crying, log4j said, adding that these events are counted and reported back to Samsung. Samsung advertises similar features on some of its AI-enabled TVs. The company says its Pet Care and Family Care features use on-device AI to detect a dog barking or a baby crying and alert users. This doesn’t confirm log4j’s claims about the package or the data it reports. However, log4j says that on TVs without microphones, the software searches for connected devices such as soundbars or Bluetooth microphones and uses those to listen instead. The TV was also collecting geolocation data and mapping local networks, they said, adding that it ran a service on the TV that analyzes traffic on the local network. log4j also says that the system uses a neural network tailored to a particular region to analyze your viewing habits. A neural network is a type of machine-learning model. log4j said : “…in youtube it’s looking for videos you watch, ads you skip, progress in a video, etc.” The tracking that’s on the record While log4j’s claims haven’t been independently verified, Samsung has used automatic content recognition (ACR), a system that identifies what’s on screen. Earlier this year, Texas Attorney General Ken Paxton settled with Samsung, getting the company to agree that it would get Texans’ express consent before collecting or processing ACR viewing data. A class action complaint filed in New York in January also accused Samsung of using ACR to record video and audio passing through the TV. The complaint accused Samsung of using machine-learning algorithms to analyze and link this data back to consumers. This includes information displayed when the TV is used as a computer monitor, it said, adding that the information can be linked to different people using the TV. The case was voluntarily dismissed in July. The New York complaint added: “Samsung exploits this Sensitive Information by (a) selling targeted advertisements to its corporate advertising clients, and (b) providing it to third-party advertising companies such as Google and X (f/k/a Twitter) for targeted advertising.” A separate class action complaint filed in California this month accuses Samsung Electronics America of not being transparent about its ACR data collection. This isn’t the first time that Samsung has been criticized for allegedly picking up in-room audio. In 2015, privacy group EPIC filed a complaint with the FTC, accusing Samsung of recording conversations and relaying them elsewhere. The nonprofit said at the time: “Everything a user says in front of the Samsung SmartTV is recorded and transmitted over the internet to a third party regardless of whether it is related to the provision of the service.” EPIC identified text-to-speech company Nuance as the third party. What you can do We can’t confirm all of log4j’s allegations, and Samsung doesn’t appear to have commented. But there have been multiple complaints about the data smart TVs collect. You can turn off features such as ACR, internet-based advertising, and voice recognition where possible. log4j has also raised concerns about whether monitoring services are truly off. They said : “ACR off via your preferences menu on samsung TVs should not be assumed to actually disable ACR telemetry. i’ve found several instances where the checks (whether deliberate or not) are either incorrectly implemented or not checked at all.” log4j says disconnecting your TV from Wi-Fi is the best option for immediate peace of mind, though that also means losing internet-based TV features. They also suggest using an Apple TV or a modifiable Android TV box with open-source software. What do cybercriminals know about you? Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online. SCAN NOW

​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]

Apple ha rilasciato aggiornamenti di sicurezza per risolvere 327 nuove vulnerabilità, di cui 20 con gravità “critica” e 231 con gravità “alta”, nei prodotti iOS, iPadOS, macOS Golden Gate, macOS Tahoe, macOS Sequoia, tvOS, watchOS, visionOS e Safari.

Apple heeft kwetsbaarheden verholpen in iOS en iPadOS. De kwetsbaarheden betreffen diverse beveiligingsproblemen zoals onvoldoende validatie van symbolische links, onjuiste permissiecontroles, out-of-bounds lees- en schrijffouten, use-after-free fouten, integer overflows, race conditions, type confusion, en logische fouten in state management. Deze kunnen leiden tot ongeautoriseerde toegang tot gevoelige gebruikersdata, geheugenbeschadiging, onverwachte systeem- of applicatiecrashes, privilege escalatie, sandbox escapes, en denial-of-service condities. Aanvallers kunnen deze kwetsbaarheden misbruiken door speciaal vervaardigde bestanden, netwerkverkeer, of webcontent aan te bieden, of door lokale toegang te hebben tot het apparaat. De kwetsbaarheden zijn aanwezig in verschillende versies van de genoemde Apple besturingssystemen en beïnvloeden onder andere de verwerking van afbeeldingen, video’s, audio, fonts, PDF-bestanden, webcontent, en systeemcomponenten zoals de Keychain, Bluetooth, en Thread-netwerk. Er zijn geen specifieke proof-of-concept details vermeld, maar de beschrijvingen geven aan dat misbruik mogelijk is via diverse aanvalsvectoren.

As the news from last week has settled down, it would seem this headline was pretty spot on. The foretold apocalypse didn't eventuate, and there were no internet-destroying outages. In fact, it took days before I could find a single story of PHP2Shell being reliably attributed back to a breach. And I don't think we can say the relatively benign outcome was only achieved because we did take it so seriously either; there's a massive trove of sites out there that have been left to rot and would have every opportunity to be pwned by a bug of this magnitude that was readily exploitable , yet here we are. Which is good 🙂

Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.

Serbian strongman leader Aleksandar Vučić on Sunday admitted defeat in his race for prime minister, a loss that follows a series of incidents of digital repression that galvanized the opposition.

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain

We've spent the past several decades using duct tape, string, and chewing gum to chain the world's computers together into this thing we call the internet, so there's really no good reason to be surprised that most of it is full of software containing vulnerabilities that are practically just as old. You can listen to the latest episode of The Kettle right here on this page, as well as on Spotify, Apple Music, or YouTube. Those platforms also let you subscribe to Kettle, so you are always notified when the latest episode goes live. The world is still reeling from the PHP2Shell revelations that hit the news cycle this week, and on The Kettle there's no better topic for host Brandon Vigliarolo, cybersecurity editor Jessica Lyons, and FOSS reporter Liam Proven to tease apart. Join us to discuss what exactly is going on, how AI was key to finding another issue no human likely ever would have discovered on their own, and why exposing more bad code in the backbone of the world's computers might be just what we need to rethink the whole thing for the better. A lightly edited transcript follows: Brandon (00:01) Hi everyone, and welcome to the latest episode of The Register's Kettle podcast. I'm your host, Reg reporter Brandon Vigliarolo. And hey, there's only one thing we could focus on for this week's episode, given all the hubbub around it, and that's the PHP apocalypse. It turns out most of the internet is running software that could allow remote code execution on host systems via a pair, or as of today apparently three, vulnerabilities that have come to collectively be known as PHP2Shell. So that's not great. With me to talk about this is our security editor Jessica Lyons and open source reporter Liam Proven, who has a few things to say about PHP itself and why it's probably not surprising we're finding ourselves in this mess. Thanks to you both for coming on. Liam Proven (00:43) Absolute pleasure. Jessica Lyons (00:43) Nice to be here. Brandon (00:44) So Jess, let's start with the basics. What is this? How big of a problem is it? And where do we stand on getting things fixed? Jessica Lyons (00:51) Great. The short answer is it's a very big problem. So we have these two related memory safety vulnerabilities, and they are in the PHP core. Collectively they're called PHP2Shell, and they affect every version that's been released in the last decade affected by one or both of these, going back to about version 5.4. So the general consensus is this is about 70 percent of all of the websites on the internet are running this code. So it basically affects everyone at this point. What happened here is that this dates actually back to August. An independent researcher first spotted this, and then we can talk a little bit more later about who found more of the exploits and what the (PHP) Foundation did with that. But so he found this vulnerability. There was a coordinated disclosure process with the PHP Foundation, and then that broke a little bit starting over the weekend, and then onto Monday, there were some leaks. There was a video posted that purported to show this exploit. And so we get this emergency warning from the PHP Foundation late Monday saying, "Hey, we are going to be releasing these emergency patches, so everybody get ready so you can implement them as soon as possible. It's very serious." So by Wednesday, they did release these, and there's this mass attempt to patch before any of the attackers get a hold of this and are able to attack websites with it. And one of the issues too is that some websites are running really, really old versions and so they aren't able to patch. So they're just sitting there, these legacy servers are still vulnerable. Brandon (02:52) So there's no direct update path for those old versions, right? It's basically shut this down and reinstall it kind of thing. Jessica Lyons (02:59) Exactly. So basically they're both these memory corruption vulnerabilities and by exploiting them, an attacker can kind of shape the memory that PHP trusts. And then they can use that to hijack what happens next. And that can mean remote code execution. They can take over the websites, they can steal data. And so people are visiting these websites they trust and they don't realize that the underlying code is stealing their data or delivering malware to their computer. And again, this is potentially 70 percent of the internet. So it's a big deal. Brandon (03:36) Quite a few sites were offline. I know even some big services. I stopped playing because I had a baby, but I used to play Final Fantasy XIV pretty religiously. And I know that the entire login server was offline a couple days ago Jessica Lyons (03:50) Right. Brandon (03:50) They were like, "You've got to fix this. Sorry, no one can play the game. If you're not logged in right now, you're not getting logged in for the foreseeable future." It's just insane how much of the internet was affected by this. Now It's under exploit, is that correct? But maybe not successfully exploited yet? Jessica Lyons (04:11) Right. So after the patches were released on Wednesday, later Wednesday, AWS came out and said, "We've seen exploitation attempts at least four days before the patches were released." So that kind of caused another frenzy that, "My God, it's under attack, the whole internet is on fire." There haven't been any successful attacks to date. There's been a ton of attempts. There's a lot of POCs; some work, some don't. But as of Friday, according to the Foundation and according to all of the security experts that I've spoken to, we haven't seen any evidence of successful exploitation. I don't think that means we're in the clear. I think it just means it's taking a while for people – and honestly AIs – to develop successful attacks, but that's where we are right now. Brandon (05:06) Because it's a complicated attack chain, correct? Jessica Lyons (05:10) Right. Yes. Brandon (05:11) So basically, right. This is not working yet, but especially with some of these older websites that are running older versions of PHP that are going to have to take a more thorough approach to getting this fixed and possibly going down for some time, this could be one of those problems that remains serious for a while. And let's not forget, 70 percent of the websites on the internet, that's almost three-quarters of the entire internet. I don't know how many hundreds of thousands or millions of sites that is, but some of those are probably never going to get patched. Jessica Lyons (05:41) Right. Exactly. Brandon (05:43) Just the way it goes. Right. This is going to be the sort of thing that we end up hearing about months or years from now. Jessica Lyons (05:49) I would say years. Brandon (05:53) I'm sure there'll be some bank somewhere that eventually ends up getting – we'll hear about some breach disclosure letter from the state of Maine in four or five years. Jessica Lyons (06:02) And local governments, federal and state governments, I think these are the ones that we're going to be hearing about quite a while from now. Brandon (06:09) Because that's one of the things I was thinking about even for me in my tiny little town in northern Michigan. I wonder if my township or the county is going to be all over it to update their PHP server. Does their IT guy, who probably is a retired dude who lives in the area, even know this is a problem? It really is one of those things that is a big deal, but if you're not kind of following the news on this, it could probably go completely unnoticed. And for many websites, I'm sure it will. Jessica Lyons (06:37) Right. Exactly. Brandon (06:37) So, it's pretty crazy. Liam, you're working on a story, I think, as we are recording this, about some of the history of PHP and how it really probably wasn't very well designed or intended to become so ubiquitous on the internet. What's going on there? Liam Proven (06:53) I've seen one angle on this, which is people saying, "This is 1990s code and it has 1990s problems," which is one way to look at it. But I'm a 1980s internet guy; that's when I started exploring it. My primary email address is older than the web, and it still works. My gods, it gets a lot of spam, but it still works. I've watched the rise and rise of PHP since the first releases. Now, I have no personal interest in web development. I can program, but I don't because I'm really bad at it and nobody needs to have my code inflicted upon them. The guy that wrote PHP in the first place, Rasmus Lerdorf, is my age. I've never met him; I'm sure he's a nice guy. But he said in a very early interview about it, "I really don't like programming. I built this tool to program less so that I could just reuse code." And that was about 1993. He built a little tool that allowed him to put macros in HTML for his own website, and it's just grown. In a later interview, he said something along the lines of, "I don't know anything about writing programming languages. I'm just improvising this as I go and people seem to like it." It originally stood for "Personal Home Page," I think, and later was given a recursive acronym of "PHP: Hypertext Preprocessor." This is a programming language that you mix in with the HTML of a website. It predates the modern model of building websites where a database contains the text and a content management system of some kind assembles on the fly the pages that each person sees. This is an older model where you're running programs that are part of the markup language, which was not a good idea, but that was how he did it. There was a lovely blog post. I've got an old friend who's an extremely skilled and talented programmer who has built a career on PHP, and he said to me, "Look, those criticisms that you've mentioned are of the really early versions and it's changed now." And if he hears this, he's going to be cross with me. But my favorite summary was from a blog called Eev.ee way back when that called PHP "a fractal of bad design." Whatever level you look at it, it was done badly. If you look at the whole plan of "let's just intermingle program code in with the markup language," not a good idea. If you look at the details of how it was implemented, not a good idea. If you look down at low-level details of how the functions return values, not a good idea: inconsistent syntax, inconsistent functions, functions that do really weird things, by default no stack traces, not great error reporting. Now, I'm sure a lot of this has been papered over now, but really there is one reason PHP is still around and still so big: Zuck. Facebook was built in PHP. And Facebook makes lots and lots of money and it's been throwing money at making PHP faster and more reliable and more scalable for decades. Brandon (11:03) Have they been big contributors to it? Liam (11:06) Yeah. They even built a compiler for it, which I suspect is still in use. Now, how much of Facebook today is in PHP? I don't know, possibly none, but for a long time basically the world's biggest and busiest public-facing website that wasn't owned by Google – only because Google have failed to ever make a successful social network – was built on PHP. And it's big, it's complicated. Like Linux itself, nobody fully understands how the whole thing works anymore and hasn't probably for decades. And now people have got bots that they can throw against it and ask them to analyze it. I think this is probably just the first, and I think there's going to be many more. A friend of mine who's a senior developer had a look at the patch, and he's not a C guy, but he said – I'm quoting from comments on Mastodon – that the patch to the current version is 13,000 lines of C. That's a doozy of a patch. Brandon (12:17) That's huge. Liam Proven (12:20) A bunch of people have been working like crazy for quite some time. Some people who've looked at this say it looks handwritten to me. Others have said, "No, I think this is bot-generated." I think the truth is probably a bit of both: some from one, some from the other. Brandon (12:32) Bit of both. I mean, you can't pump out thirteen thousand lines that quickly and have it tested. God, I hope they tested it. Liam Proven (12:41) Right. But that's just for the current version, and this hole affects every published version. So if they do manage to fix this one, how long till the next one comes along? Because I think there's going to be – Brandon (12:56) Especially with the speed at which vulnerabilities are being discovered now. I feel like every time I turn around, I've written one Patch Tuesday article in the past few months, and that one broke the previous two records. And I think since then every month has included more patches, and a lot of those are probably – Jessica Lyons (13:14) October at this point is the record: over a thousand for Microsoft alone. So, yep. Brandon (13:21) That's insane. Like you said, it is a fractal of bad design all the way down, and is going to probably have more vulnerabilities discovered. Jessica Lyons (13:32) Right. Brandon (13:32) Seventy percent of all websites on the internet are using this. What can we do? Are we stuck? Liam Proven (13:35) Well, there's a reason for that, and it's one that doesn't get talked about an awful lot: Facebook aren't the only people that use it extensively, because WordPress is also built on PHP, and it's far from alone. Another senior Linux techie friend of mine gave me a free shell account on the machine that he runs for a few friends years ago, and I thought of resurrecting my old 1990s hand-coded HTML webpage for fun. So I found it on the Internet Archive and found a tool to scrape it and turn it back into HTML again. I looked at some CMSes and asked him if there was any CMS on the machine. He went, "No." And I went, "Well, would you install one?" He went, "No." "Well, why not?" He said, "Well, all the big ones are implemented in PHP, and I won't let that near any server I run." "Well, that's a bit dramatic, isn't it?" And he goes, "No, that's pragmatic. I run a bunch of public-facing servers on my own, and this is how I keep them secure. No containers, no Docker, no PHP, nothing built in any of these technologies." And I went, "Wow, what about..." So I went looking for non-PHP CMSes. There are a lot of CMSes out there. I got a commission about a decade ago to write a comparative assessment of the CMS market versus a company's proprietary Windows product. I went and did a survey and came back and said, "I've found 1,300 so far." And they said, "OK, we can give you five thousand words instead of a thousand words." And I said, "You realize I'm going to have to go and look at 1,300 pieces of software here. Even if I only write three or four words about each one, 'Mostly harmless,' I'm still going to have to look at over a thousand bits of software. It will take me a year." And they went, "Well, how can how can we do it quicker?" And I said, "You can't. I cannot do this survey you want. Give me a full-time job and I'll get it back to you in a couple of years' time." I found a few CMSes that weren't built in PHP. Most of those were built in Ruby instead. And he went, "Yeah, I'm not keen on having that on my server either." So it's not even a case of people that have PHP deployments needing to update. They don't know. They built it on something else which was built on something that was built in PHP. Jessica Lyons (16:15) I was just going to say, Liam, you said, "How long until the next one happens?" And we found out today from the PHP Foundation that there is a third one. They won't be pushing an emergency release for this. They said it'll be published with the next regular release cycle. The Foundation told me that this one, quote, "requires a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use." So, there's already another one. Liam Proven (16:45) So weeks then. Brandon (16:47) Yeah. Jessica Lyons (16:48) I mean, and even with this, it's hard to exploit. You can mitigate it with a configuration setting. But that was part of the thing we've heard with these other two. And then we did have researchers yesterday who developed this new exploit; this was Vulncheck. And that shows how even ASLR can be bypassed to attack these vulnerabilities on x86 machines. So saying it can be fixed with a configuration setting isn't always a guarantee. Brandon (17:25) That brings me kind of to the elephant in the room of this whole story: AI. because of course it all comes back to AI nowadays. OpenAI and two other security firms reported this. I think Jess, one of your stories or one of the ones Lindsay wrote said that they all used AI to find this, right? Jessica Lyons (17:49) Right. So the companies: Calif, they are a newer startup doing AI pen testing and they're part of OpenAI's partner program, so they used OpenAI models working with OpenAI to find this. And then independently, Wiz, which is owned by Google, also did. So this happened back in August, and then they have been all working with the PHP Foundation on the patch since that point. They have all said these are vulnerabilities that probably wouldn't have been found by humans alone. By all accounts, they've existed for decades and wouldn't have just been found by human researchers. Brandon (18:34) Right. So either these are things that have never been discovered and would have never been exploited theoretically – the exploit path is complex, they're not obvious vulnerabilities, so they needed an AI to find them – or perhaps this is the kind of thing that was known about but was privately held in the hands of some bug hunting company that sells exploits to governments. Who knows? Maybe that's the case. I remember talking to a guy one time at Black Hat who basically said his company's in the business of finding really sensitive vulnerabilities and then selling them to the highest bidder. So there are companies like that that exist. So there's probably plenty of vulnerabilities in software that are not well known that governments and high-level functions are aware of. But in this case, this probably wasn't the case. This is an incredibly difficult-to-find vulnerability. I've seen a lot of chatter online in the past few days about how the internet's on fire and the AI bug-pocalypse has arrived. It seems like we're having another case of people getting all freaked out because this is the end of time, history is over, and AI is going to kill us all. It just seems to me like this is another example of: well, maybe not. This has been getting hammered by potentially bad actors or pen testers, and no one's managed, as far as we know, to successfully use this yet. Is this as serious as it seems, or is this another case of a serious vulnerability that is so complicated and convoluted that it's not really going to be that big of a deal? Liam Proven (20:25) I want to note parenthetically that you described OpenAI as a security company, and if I had been drinking coffee, that would have been very bad for my keyboard. Brandon (20:32) Okay, whoops. Let me take that back. Jessica Lyons (20:31) Ha ha ha. Liam Proven (20:36) Calif is interesting because I just wrote about them. They found a hole in OpenBSD, and there aren't many of those. And only about a week ago, they found a hole which they dubbed "Big Fish" in OpenBSD, and it was just days before OpenBSD 8 shipped. It looks like that had been there for 37 years, which is a neat trick because OpenBSD was founded 30 years ago. So this is in – going to pronounce this carefully – Berkeley Software Distribution Unix in the eighties. But there are doubtless more, and I'm an arch AI skeptic. Some people will claim that this will be the sort of problem that you can solve with AI by getting it to rewrite your stack. Well yes, but then you'll replace it with a new stack that nobody ever understood any of. But there are ways to design, host, and run websites, forums, and chat channels without using any of this stuff. And it could be a net positive if holes like this keep getting found that people will be forced to go back to – sounds crazy, but – static websites serving pre-written code off a disk. One of my favourite websites – recently I discovered there's a whole chain of them, and I hope you won't mind me swearing; maybe you have to beep me. But there's a marvellous website called "This Is a Motherfucking Website and It's Perfect." And recently somebody rewrote it and the new one looks almost identical: "This Is a Modern Motherfucking Website and It's Perfect." He's written it with more CSS or something, but apparently there's a whole chain of these things and they are extremely low on programming code. They contain interactive elements that you can do with just HTML, and you don't need a whole web framework behind it. And the same AI companies are busily scraping the whole web multiple times a day to feed their training engines. Maybe we just have to suck it up, scrape some of these big websites, and redo them as simpler tech with fewer interpreted languages. We are all collectively victims of the sunk cost fallacy. We've got millions of websites. We spent billions and trillions of dollars building all this. We can't just throw it all away. Well, maybe you have to. Brandon (23:27) Sunk cost was something that kept coming to my mind as I was writing up the script for this episode and just thinking about this. It seems like a whole big case of, "Well, all the websites in the world are now on PHP, so I guess we're stuck." Liam Proven (23:42) We have a script? Brandon (23:46) Well, not a formal script, just notes. Liam Proven (23:48) Haha. Well I didn't get the memo. Jessica Lyons (23:50) I think that's part of the problem though: it illustrates this larger issue with AI in general. AI bug hunting and exploit detection kind of illustrates this bigger problem about the internet, especially these legacy systems that underpin government services and critical infrastructure. It is literally held together by duct tape and string. So it's a massive problem. Again, it takes some work to actually make anything of these vulnerabilities and chain them together. AI is getting better at that. So whether or not this ends up being the end of the world for the internet as we know it, it does illustrate a real problem. Brandon (24:42) Like Liam said, maybe this is the sort of catalyst that the wider internet community needs to realize that these systems – this duct tape and string – simply won't keep working forever. We need to maybe modernize all the underlying infrastructure and make it simpler and less kludged together with all these different things over the years. PHP is poor design all the way down, right? It's like: well, maybe we need to tear it out and start over. Even if these vulnerabilities are impractical to exploit and hard to find, the fact that they're being discovered does illustrate that most of our code is a mess. Liam Proven (25:28) I am reminded , the other day I was talking in the comments about A/UX, Apple's original Unix for the Mac, and Apple paid another company to develop A/UX because the US military had a tick box on the form that said to buy systems, they have to be able to run POSIX. The US Army at one point hosted its website on Classic Mac OS. And it wasn't exactly security by obscurity. They said virtually all web server attacks in the mid-1990s were based on getting a remote shell, and Classic macOS didn't have a shell at all, anywhere. There was no way to get a remote shell because you couldn't get a shell if you were sitting in front of it. So they said, "They try and inject bits of x86 code: well, it's not an x86. They try and get a shell: it hasn't got one. They try and get it to run scripts: it doesn't run scripts." They said, "We just sit there and watch people throwing themselves at it. All the best attacks, and none of it works because the operating system's kind of too primitive to do any of that stuff." I don't believe many customers actually ever used A/UX, but it got Apple some lucrative deals. Maybe we're going to see a new trend of super primitive, super basic websites. There'll be a new difficulty in trying to scale the things because Kubernetes expects a lot of this to be dynamically generated by microservices. But bring it on; I'd love to see that. Brandon (27:09) That's a Kubernetes problem, right? Liam Proven (27:12) Yeah. Brandon (27:14) I feel like I would love a simpler internet. It would be amazing if I could just wake up in the morning, go to a news site, and just get the headlines. So often, I feel like – and I think The Register is good at having a relatively simple design, but – so often I feel like the news aggregators that I go to... I look for ones that are as minimal as possible. I look for websites that are simple. I don't need all this in-your-face stuff; it's not necessary. I think we probably are all pretty sick of it in a lot of ways. Jessica Lyons (27:49) But do we really think this is going to happen though? Brandon (27:52) No. Jessica Lyons (27:53) I feel extremely pessimistic about this. I think it's much more profitable to just keep marketing solutions to the problem as opposed to a safe coding overhaul. Brandon (28:04) Unfortunately. Liam Proven (28:06) Geopolitics might yet get in the way. I wrote a piece about OpenEuler, one of the big Chinese enterprise server Linuxes, and one of only two companies actually showing off an OS at the Open Source Summit. The other was also Chinese: OpenKylin, which is more desktop focused. China makes its own chips, China makes its own operating systems, and it's got its own programming languages. They're all open source, taken from European and American developed software by and large, but they could still invade Taiwan and cut off much of the world's chip supply. And suddenly it won't just be that memory is way more expensive than it used to be; it will be that you can't get more memory anymore and you have to keep using 10-year-old chips. And people will be potentially forced to find ways to keep getting more out of the same hardware until we can build new chip fabs, which will take a lot of time and a lot of money. And then quite possibly they'll get blown away in a climate-change-induced hurricane and then we'll have to start again. So, I hope they're going to start building them in the north of Norway and places like that. But yeah we've got bigger problems coming down the pipe and it's all a giant snowball of superficially unrelated things: AI attacks on overcomplicated stacks on one side, and the other kind of attack which involves whistling noises and large explosions on the other side, which cuts off the hardware market. It's hard to plan for this, but nobody's even trying yet. Brandon (29:52) Who would have thought a talk about a PHP vulnerability would have turned into geopolitical chaos and the endof modern technology as we know it? Break out the sundial, people. Liam Proven (30:07) Excuse me, I've just got to go and wind the web server. Hang on. Brandon (30:11) All right, guys. Thanks for coming on. I think this was a really valuable discussion and it shows just how interconnected all these issues in tech are right now. I mean, it is interesting how we're kind of hurtling toward something in a lot of ways. AI will surely be a part of it, as will expensive chips and lots and lots of vulnerabilities being found every day. Hopefully we'll still be here to cover it as that continues to happen. Jessica Lyons (30:40) If AI doesn't kill us. Brandon (30:41) Right. If AI doesn't kill us all. Well, if it doesn't, we'll be here on the Kettle to talk about it. And we hope that you, from whatever bunker you're hiding in, will join us on future episodes. Liam Proven (30:53) Yeah, we'll be publishing a telephone number so you can phone into future Kettle episodes. Brandon (30:59) All right, folks, we'll talk soon. ®

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: A critical PHP security release is coming today, so get ready to update! The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0. The project will publish those details, along with the patched version numbers, when the release goes out. … More → The post Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw appeared first on Help Net Security .

È stata resa pubblica la compromissione delle chiavi private associate ai certificati di otto autorità di certificazione (CA) intermedie di eMudhra , sei destinate all'emissione di certificati TLS e due alla firma del codice. Risultano interessate anche le corrispondenti versioni dei certificati intermedi oggetto di certificazione incrociata (cross-signing) da parte di Sectigo.

eMudhraは、世界向けSSL/TLS証明書事業から自主的に撤退すると発表した。中間証明書の秘密鍵が容易に復元可能だった問題を受けた措置。対象事業の売上比率は約1％と低く収益性も悪化していた。既存顧客には他社製への無償切り替えを提供し、国内向け電子署名などの主要事業は継続する。

The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its

Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42 .

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. [...]

インドの認証局eMudhraの中間証明書8件で、秘密鍵が第三者でも瞬時に復元可能な状態だったと判明した。悪用されればWebサイトのなりすましが可能になる。主要Webブラウザは遮断し悪用は確認されていないが、失効検証機能が標準で働かない非ブラウザ環境向けにGo開発チームなどが緊急修正を配布した。

Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million digital certificates. A security researcher known as Wayne discovered the flaw on October 17 while running a check against the Common CA Database (CCADB). To prove the keys were compromised, he signed … More → The post eMudhra security blunder left trusted CA signing keys exposed to anyone appeared first on Help Net Security .

Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into their computer's operating system, thereby bypassing conventional security controls. As part of

A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up. The vulnerability, tracked as CVE-2026-113380 ( CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications. The flaw concerns how Signal’s calling library shuts down a call. It does not affect how it encrypts conversations. According to the published vulnerability description , another participant could overwhelm a call’s internal event queue and interfere with the steps that should disconnect it when you end the call. The main concern is unwanted listening after someone believes a conversation has ended. If a malicious call participant successfully triggered the flaw, they could potentially continue hearing audio that the other person no longer intended to share. That might include an offhand remark, a conversation with someone nearby, or other private background sound. The vulnerability description also mentions that video might remain active, but does not confirm that behavior or explain what affected users would see on screen. It also doesn’t specify how long any continued transmission might last. There are no known reports of exploitation in the wild. The vulnerability concerns only how a call is shut down. It does not involve stolen passwords, compromised accounts, or exposed message histories that would call for a password reset. What to do The developers updated the code to make shutdown more resilient when a call’s internal queue is full or another termination step fails. Install any available Signal updates on your devices. The fix is available in the underlying RingRTC library, but the affected and first-fixed Signal app versions have not yet been confirmed publicly in the sources reviewed. Personally, I found an update in the Google Play Store which brought my Android app to version 8.32.2. I did not find one in the Apple App Store, although this might be because I have automatic updates enabled . The current version on my iPad is listed as 8.32 (1910). While I think that means it’s all patched, this is hard to confirm from Signal’s website. I’ve emailed Signal for clarification and will update this article when I hear back. Scammers know more about you than you think.   Malwarebytes Mobile Security protects you from phishing , scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.  .wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}ul.menu .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;padding:var(--kb-btn-padding);margin:var(--kb-btn-margin);box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);} Try it now

The private keys associated with eight certificates were compromised, and root programs and trust stores are blocking them. The post Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys appeared first on SecurityWeek .

Safari blocks trackers that turn your email into a tracking ID Apple’s new anti-tracking protections in Safari and WebKit, the open-source web engine used by Safari, block connections to identity resolution services that turn email addresses into persistent tracking identifiers. How email addresses become tracking IDs This “post-cookie” tracking method allows a third party to collect a user’s email address when they log in to a website or sign up for a newsletter. The provider sends the address to its servers, creates a tracking ID permanently linked to it, and returns that identifier to the webpage. “The tracking ID is stored on the website and can from thereon be used for arbitrary purposes linked to your email address, such as building a profile of your browsing or targeting ads at you across websites,” the WebKit team explained. Logging out or unsubscribing leaves the identifier and email address stored with the third party. Identity graph example (Source: WebKit) Providers can build profiles known as identity graphs from information users share when visiting websites and filling in forms. These may contain names, phone numbers, home and email addresses, IP addresses, website accounts, and first-party cookies. Email addresses and phone numbers can link a person’s activity across websites and devices. People often keep the same email address for years or decades, making it a lasting identifier. Providing it to access an account or receive a newsletter can expose users to tracking they did not expect. Identity resolution providers can combine information from multiple websites, devices, and companies to support profiling and ad targeting. WebKit says its protections are designed to preserve first-party personalization. How Safari and WebKit block identity resolution These services use infrastructure embedded in webpages to collect email addresses users enter, often without any visible indication. Safari and WebKit block network access to that infrastructure, preventing webpages from sending email addresses to the providers’ servers. The protection operates at the domain level, preventing providers from bypassing it simply by changing the structure of a network request. Blocking network access (Source: WebKit) Users can further limit email-based tracking through services such as Apple’s Hide My Email, available with iCloud+. It creates unique, randomized addresses for individual websites and forwards messages to the user’s inbox. The WebKit team said identity resolution shows the tracking industry’s continued efforts to follow users after browsers blocked cross-site cookies. The protections are included in Apple’s iOS 27, iPadOS 27, macOS 27, and visionOS 27 releases.

In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole . In this new operation, the group employed an updated malware chain that included both their old and new malware, which we disclosed in full, and used another mandatory South Korean security software program as a part of infection chain using a watering‑hole strategy. Notably, the group targeted victims more selectively, sending spear‑phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target. We dubbed this activity Operation FlashHole. Operation FlashHole attack flow during initial compromise Our examination reveals that the earliest evidence of this new operation dates back to July 2025. This suggests the group began preparing for the campaign shortly after ending Operation SyncHole, which lasted at least four months. We identified a minimum of three organizations impacted by the campaign in South Korea’s software, construction, and wired communication equipment manufacturing sectors. These sectors differ from those affected by Operation SyncHole, indicating that the group has expanded its target scope over time. Background After more than a year since the first observation of Operation SyncHole, we detected a suspicious execution chain originating from legitimate South Korean software. This chain mirrors the one from the previous operation; however, this time, the attacker abused CrossWeb EX instead of Cross EX, which was abused in Operation SyncHole. Both applications appear to be maintained by the same vendor, and both are related to financial security. CrossWeb EX is a financial security solution that is required to access widely used online banking and government websites. It encrypts communications between the user’s browser and the web server using public key infrastructure (PKI). This is not the first time Lazarus has abused this software. It was also used in 2021 to deploy the Racket downloader and again in 2022 and 2023 . Although the exact method by which CrossWeb EX was abused remains unclear, we determined that the attack chain ultimately leads to the execution of the malware in memory. We noted that the spawned process was running with a high integrity level. The parent process, INISAFECrossWebEXSvc.exe , originates from the installation bundle of INISAFE CrossWeb EX V3 version 3.4.1.2, released in 2023 after KrCERT’s public advisory . As we already mentioned in our SyncHole blog post, this pattern closely mirrors the long‑standing strategy employed by the Lazarus Group to target South Korea. Since CrossWeb EX and similar software is mandatory for South Korean users and typically runs in the background to interact with the browser, it has been leveraged as a critical attack vector by the group. In 2025, a paper was presented at the USENIX Security Symposium that investigated vulnerabilities in South Korea’s mandatory security software and demonstrated how such software can unintentionally create a massive attack surface. In July 2026, the South Korean government and several local security vendors also published a joint security advisory covering typical Lazarus attack techniques, including exploitation of financial security software. While this advisory overlaps with our findings from Operation FlashHole and Operation SyncHole, and AhnLab’s detailed analysis report Operation Double Barrel covers a wide range of recent Lazarus Group activities, we are conducting a more granular classification based on their TTPs. We will discuss this further in the attribution section. Initial infection vector Although we could not precisely determine what triggered the infection chain, our analysis uncovered a suspicious website hosted on GitHub Pages that is associated with the GitHub account used as the C2 channel. The GitHub account was created last September, and the initial version of the site was designed to showcase the résumé of a senior network appliance developer. In January, however, this site was replaced with another featuring an interior design showcase. The first site was likely accessed by an employee of a wired communication manufacturing company, while the second site likely affected a target in the construction sector. Appearance of the malicious websites The first site with the résumé had a photograph supposedly of a job seeker, but the lack of EXIF metadata and the unnatural texture of the image indicate that it was generated by AI. This suggests the Lazarus Group has incorporated AI into its long‑standing strategy, like other Korean‑speaking threat actors ( 1 , 2 ). The group most likely also used AI to create the lure site: the job seeker’s name resembles the Korean version of “John Doe,” and the portfolio was populated with seemingly meaningless details and random companies. The generated site was then manually tailored to specific targets. Suspected use of an AI-generated image on the résumé site The websites contained embedded links that loaded an external JavaScript file via a script tag. Malicious link embedded in the résumé site: hxxps://javadevhouse.co[.]kr/ajax/libs/jquery/1.7.3/jquery.min.js Malicious link embedded in interior design site: hxxps://pythonapischool[.]com/api/detach Based on the analysis, we assess with medium-to-high confidence that the targets received phishing emails containing links to the malicious site hosted on GitHub Pages (using the domain <username>.github.io). The research results showed a high possibility that visiting the malicious site initiated an infection process involving CrossWeb EX software. This assessment aligns with Lazarus’s recent approach, as detailed in the joint advisory published by the South Korean government and security companies. Full infection chain Following the initial compromise, the legitimate Windows binary fsquirt.exe was executed under the CrossWeb EX process and injected with shellcode containing a malicious DLL – TechHub malware. From our extensive and thorough examination, we identified several malicious payloads and reconstructed the complete infection chain. The infection chain is rather complex and reveals the Lazarus Group’s advanced operational techniques on targeted hosts. These techniques conceal their malicious payloads, intent and their sophisticated malware delivery framework. The latter was updated extensively compared to the previous campaign, despite the new operation starting less than a year later. Significantly, the execution chain below exists only in memory during the initial infiltration, highlighting the attackers’ considerable efforts to hide the initial compromise. Initial infection chain Following the initial compromise, the group sought to maintain persistence on the network by installing a pair of malware strains – TouchHub and TouchShift – leveraging DLL side‑loading under the name mscoree.dll . TouchHub was deployed by the first instance of TechHub. It then used DLL side-loading to launch TouchShift, which led to the in‑memory execution of another TechHub instance. After launching the second time, TechHub deployed another pair, ClientHub and LPEClient, rather than executing Cubridge directly. Only minimal traces of these files were found on disk; the remainder of the malicious code persisted exclusively in memory. Expanded infection chain after gaining persistence Since Cubridge remains only in memory at the initial compromise stage, we suspect the group designed this indirect, multistage chain to deliberately redeploy Cubridge after gaining persistence, as it serves as the most sophisticated orchestrator of the attack. Malware set The full chain comprises advanced variants of the known Lazarus malware strains, including TechHub, Cubridge, TouchShift, LPEClient, and the newly identified TouchHub and ClientHub. TechHub – the start of the chain TechHub, a downloader that plays a central role in this attack, communicates with GitHub using a Personal Access Token (PAT). It serves as the initial payload, providing the top of the chain with sufficient functionality to profile compromised hosts and facilitate subsequent payloads. This variant is a more advanced version of the malware named CLOUDBURST by Mandiant and NickelLoader by ESET. According to their reports, the earlier version communicated with a C2 server via HTTP(S) to fetch additional payloads. The latest iteration we found, however, communicates with GitHub instead and has updated command strings. We identified three variants of TechHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service. Depending on which stage loads the malware, it contacts a private GitHub repository via the GitHub API using either hard‑coded credentials or credentials retrieved from its configuration file. When TechHub loads, it creates a 4‑byte hexadecimal identifier (ID) in the range 0x1000–0xFFFF or reads one from the configuration file, enabling the attackers to distinguish between compromised hosts. TechHub then checks a GitHub issue by sending the request GET /issues?state=[open/closed] to determine whether any previous communication remains active and removes any traces of it if found. It then proceeds with the handshaking process. It creates a new issue titled 1[ID] with the body “hel” using the POST /issues request, and sets its status to open. It then retrieves a file from the repository containing the 2[ID] value in its name. This file contains the RSA public key. It generates a random 16‑byte XOR key, encrypts it with the provided RSA public key, and uploads the result, prefixed with 1[ID] , to the repository. The hard‑coded IV is XORed with the generated 16‑byte key and then used after the handshake. During file exchange, filenames follow the pattern [1|2][ID][random-16-byte-key] throughout communication. The “2” prefix indicates delivery from the repository to TechHub, while “1” indicates delivery from TechHub to the repository. The random 16‑byte key in the filename is used for AES encryption or decryption of each file’s contents, employing either a hard‑coded IV or an updated IV. After the key exchange is complete, TechHub reads a file with the prefix “2” once again and verifies that the delivered data equals “hel”. If the check passes, TechHub gathers extensive information from the infected host. This data is then encrypted and sent to the repository. After transmitting the device information, the process concludes by updating the body of the previously created issue from “hel” to “hey” using PATCH /issues/[issue number] . The malware is now fully prepared to receive commands from the repository. TechHub supports four commands. The laeca command deploys a payload packaged in shellcode that reflectively loads the embedded payload directly into memory. Command Description mqdrz Collect information about the device and its running processes laeca Directly invoke the received shellcode in memory aqvxp Terminate the current process rtcya Beaconing after finishing the handshake process Cubridge – the framework orchestrator Cubridge, deployed via TechHub on the compromised host, is capable of retrieving various payloads through multiple methods. It serves as the central orchestrator of the entire malware framework, supporting a range of plugins, modules, and tools. An earlier version of Cubridge was also disclosed in the reports covering the previous version of TechHub. In those reports, Mandiant identified it as SIDESHOW, and ESET identified one of its modules as LightlessCan. To establish communication with the C2 server, Cubridge randomly selects one of the predefined C2 servers and constructs a dedicated C2 URL for every request, using the pattern [C2_URL]/[page1]/[page2]/[page3] . This is achieved by concatenating terms from predefined word lists. Our analysis identified a single hardcoded C2 server – hxxps://cubedesign[.]co[.]kr/news/AABBCC – associated with the examined instance that is configured to version 5.1. During URL generation, AABBCC is substituted with a null value. The page3 segment is assigned a randomly generated integer between 10000000 and 99999999 . Consequently, each generated URL is designed to appear authentic and remain unique for each request. The predefined list for page1 is shown below. TechHub randomly selects one item from the list. economy, opinion, politics, national, international, medical, investment, sports, lifestyle, shopping, culture The predefined word list for page2 is shown below. article, list, story This means the hardcoded URL can later be transformed, for example, into hxxps://cubedesign[.]co[.]kr/news/economy/article/12345678 by following the steps described above. Authentication using the POST request with the C2 server requires three parameters in the form of key‑value pairs. Each key is randomly generated using a different predefined word dictionary, and the associated values consist of a randomly generated 8‑byte hexadecimal bot ID, a fixed authentication token ( KW4Ofw982CNJjxd51AVqkGAop ), and a randomly generated 16‑byte hexadecimal session ID. Cubridge employs a more robust handshaking process than TechHub, combining the RSA and RC6 algorithms. Unlike TechHub, it skips the profiling step and proceeds directly to command and control after the handshake. During communication, the malware mimics browser requests, using X‑CSRF‑Token and X‑Requested‑With headers for authentication and the Upgrade‑Insecure‑Requests header to request additional data. Cubridge’s communication sequence Cubridge contains extensive functionality, with a particular focus on loading subsequent‑stage payloads. The commands employ various techniques, such as DLL injection, reflective loading, and section‑mapping injection. The payloads may be delivered in various forms: Plugins – reusable extensions that add functionality as needed and can be invoked at any time (in shellcode and DLL form); Tools (in DLL form) – independent utilities that perform one-off tasks; Modules – components that are loaded once and remain active providing an extended set of functionalities. It is anticipated that the commands for plugins and shellcode will load identical types of plugins because both support a similarly formed exported function for subsequent activity. The shellcode can be generated using the open‑source sRDI tool to package a DLL‑style plugin. The capabilities of a single DLL are likely utilized to load a tool that works independently because when a single DLL is loaded, only its DllMain entry point and its parameters are accessible; no other exported functions are exposed. Command Payload type Description 0 – Collect device info including the computer name, time zone, PID, and other similar details 1 Archive the specified file/directory using the legacy ZipCrypto algorithm and the hard‑coded password: xdkiTajAAxc3i/w[<881fnC!G*cb1Dit2sh.gAk/ 2 Create a file at the specified path 3 Possibly plugin Inject the provided DLL payload into the target process and load it reflectively using reflective DLL injection 4 Plugin Reflectively load a plugin in DLL format 5 Retrieve the address of the specified exported function from the target plugin and run it with the provided parameters 6 Retrieve all information about the loaded plugins 7 Unload the specified plugin 8 Shellcode Inject the provided shellcode into the target process and load it using section mapping injection 9 Load the provided shellcode directly into memory 10 Retrieve the address of the specified export function from the target shellcode (likely a plugin in shellcode form) and run it with the provided parameter 11 Retrieve all information about the loaded shellcode 12 Unload the specified shellcode 13 – Set the scheduled Cubridge execution time (in minutes) by updating a global variable 14 Set the scheduled Cubridge execution time (in minutes) by updating a global variable, while disabling monitoring by also updating another global variable 15 Terminate in a controlled manner 16 Get the configuration for Cubridge: retrieve the global flags, the number of C2 servers, the C2 addresses, etc. 17 Update the global flags, the number of C2 servers, the C2 addresses, etc. 18 Tool Load a DLL reflectively with the specified parameter 19 Configure the parameters for loading a single DLL 20 Unload the single DLL 21 Module Load the “action module” ( ActionModule.dll ) reflectively and invoke its AppinfoView export function 22 Load the “function module” ( FunctionModule.dll ) reflectively and invoke its PresentationFontConfig export function Commands 21 and 22 each load a different module. As their internal names imply, the action module manages basic file and process operations, while the function module implements Windows’ default commands. The action module covers commands 23–41 , and the function module handles commands 42–79 . The action module handles system operation commands, file system interactions, and process behavior. It is invoked by passing the appropriate command and parameters to its AppinfoView export function. The module supports 19 commands, numbered 23 through 41 . Execution results are first sent to Cubridge, which then forwards them to the C2 server. Command Role 23 Get local disk space for each drive 24 Get information about the specified file or directory 25 Execute the provided command 26 Get information about the specified file or directory (similar to command 24) 27 Execute the provided command under the target process (PPID spoofing) 28 Execute the provided command under the target process within the provided session (PPID spoofing + session impersonation) 29 Get detailed information about processes 30 Terminate the provided process 31 Suspend all threads belonging to the specified process 32 Resume all threads belonging to the specified process 33 Permanently delete the file by overwriting its entire contents with the sequence: 0 → 1 → random bytes → 1 → 0 34 Rename the provided file to :EFS (the alternate data stream area) and delete it using the native API SetFileInformationByHandle 35 Set the current working directory 36 Copy the specified file to the provided path 37 Delete the specified directory 38 Move the specified file to the provided path 39 Create the provided directory 40 Initiate a non‑blocking connection attempt to the specified IP address and port (possibly for port scanning) 41 Read the specified file The function module implements commands that emulate Windows’ built-in commands. Similar to the action module, its DllMain routine initializes all supported command functions, which are later accessed through the PresentationFontConfig export. Altogether, the module offers 38 commands, numbered from 42 to 79 . While we believe this module is based on the previous LightlessCan, this is the first time we’ve seen it in the form of a separate module. Command Role 42 Capture all displays and archive them using the legacy ZipCrypto algorithm with the hard‑coded password: xdkiTajAAxc3i/w[<881fnC!G*cb1Dit2sh.gAk/ 43 Synchronize the MAC (Modified, Accessed, and Created) times of the file provided in the second argument to match those of the file provided as the first argument 44 Get information about the specified directory 45 Get information about the specified drive 46 Inject the provided DLL payload into the target process 47 Unload the specified DLL from the specified process 48 Implementation of the ipconfig command 49 Implementation of the net command 50 Implementation of the netsh advfirewall firewall command 51 Implementation of the netstat command 52 Implementation of the ping -6 command 53 Implementation of the reg command 54 Implementation of the sc command 55 Implementation of the ping command 56 Implementation of the whoami command 57 Implementation of the nslookup command 58 Implementation of the schtasks command 59 Implementation of the systeminfo command 60 Implementation of the arp command 61 Call the CryptUnprotectData function to retrieve the AES key that DPAPI protects. Extract the key using the encrypted_key keyword from Chromium’s Local State file located at: %LOCALAPPDATA%\Google\Chrome\User Data\Local State 62 Not implemented 63 Not implemented 64 Read the specified file and decrypt it using an XOR operation with the key 0x59 . Then extract the paths from the decrypted buffer and archive files and directories at these paths with the legacy ZipCrypto algorithm, using the hard‑coded password: xdkiTajAAxc3i/w[<881fnC!G*cb1Dit2sh.gAk/ 65 ~ 79 Not implemented Besides the modules, we also observed that the actor deployed various plugins and tools. Type of payload Name Description Plugin ADFinder ( AdFinder.dll ) Launches LDAP queries in an Active Directory environment, taking six arguments such as log file path, ADsPath, search filter, and attribute names Plugin FileCollector ( Dll.dll ) Recursively scans every subdirectory and file in the provided directory, gathering detailed information about each Tool Browser stealer Can be injected into Chromium-based browsers, such as Google Chrome, Microsoft Edge, and Brave. Once injected, it extracts files and credentials from the victim’s browsers, including stored passwords, bookmarks, history, preferences, and cookies Tool Process collector Iterates over all running processes, collecting each process’s ID, path, and command line TouchHub installs a service for TouchShift During our analysis, we obtained a previously unknown malware sample from TechHub’s private GitHub repository, which served as a parent installer for TouchShift. We dubbed this malware TouchHub. Upon execution, it copies the legitimate printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe , registers it as a service, and places an embedded TouchShift payload named mscoree.dll in the same directory. Following creation, the malware synchronizes the MAC timestamps of C:\Windows\System32\drivers\monitor.sys with those of the newly written file, hindering forensic analysis. It then goes through the service registration process by collecting up to 100 legitimate service names that are registered under the netsvcs svchost group in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost . It randomly selects one of these names, appends two random alphabetic characters to form a new service name, and uses this name to create a service that runs the hard‑coded command line C:\Windows\System32\RasConv\ImeBroker.exe -TimeBroker with the description Microsoft Service . The newly created service is started immediately. Overall, TouchHub creates three files in the designated directory to launch TouchShift with SYSTEM privileges. Path Type Description C:\Windows\System32\RasConv\ImeBroker.exe Executable file registered as a service Copied from C:\Windows\System32\printfilterpipelinesvc.exe C:\Windows\System32\RasConv\mscoree.dll Side-loaded TouchShift payload Dropped by TouchHub. It contains encrypted payloads and includes portions of a legitimate DLL’s contents, which significantly inflates its size C:\Windows\System32\RasConv\ActivationStore.dat TechHub’s configuration file Dropped by TouchHub after extracting configuration values TouchShift, a prevalent loader employed across multiple infection chains The version of TouchShift dropped by TouchHub is almost identical to the version described in Mandiant’s blog post , even sharing the same malicious export function, LockClrVersion . It takes the argument supplied by TouchHub and XORs it with a hard‑coded key. The resulting value is XORed once more with the executable’s filename, and this result is used as the AES key. All strings involved in this process (the argument, the XOR key, the filename) must be exactly 16 bytes long. If a string is shorter, it is padded with NULL bytes ( \x00 ); if it is longer, it is truncated to 16 characters. For example, one of the string combinations in the obtained sample was: Argument: -TimeBroker\x00\x00\x00\x00\x00 (padded with NULL) Hard-coded XOR key: x809G736iC3f8Wp8 Executable filename: ImeBroker.exe\x00\x00\x00 (padded with NULL) After deriving the key, the malware decrypts the embedded payload using AES‑CBC‑128 without padding. The decrypted data is shellcode that starts with a call instruction. It wraps the next‑stage payload – identified as the third version of TechHub (DLL side-loading with a registered service) – that reads the ActivationStore.dat file as an external configuration. ClientHub We also identified a new piece of malware stored in TechHub’s private repository, which we named ClientHub. It supports various commands formed using a bitmask. There are at least two versions of ClientHub: one that communicates with websites via HTTP(S) and one that interacts with the Dropbox API using credentials. Depending on the version, its configuration is sourced from internal resources or the external configuration file C:\Program Files\Common Files\System\msadc\msadc.inc. The configuration comprises keys and IVs for the SNOW 1.0 algorithm, scheduled execution times, and C2 server addresses encrypted with the SNOW stream cipher. The SNOW cipher is a family of high‑speed stream ciphers used for secure data encryption in telecommunications and wireless networks. This is the first time it has been observed in the malware of the Lazarus Group. To establish C2 communication, the malware initially generates a 32‑byte random array. It subsequently overwrites portions of this array with data collected from the compromised device. The resulting 32‑byte array comprises a blend of random bytes and relevant information. This array is later used as the key for the SNOW algorithm to decrypt data received from the C2 server. Finally, the key array is encrypted with a hard‑coded RSA public key and encoded in Base64. Offset Size Field value 0 4 Current process ID 4 4 First four bytes of the decrypted C2 server information. 8 7 Randomly generated bytes 15 1 Calculated flag value that indicates a state machine . 16 8 Current system time, represented as a FILETIME structure. 24 8 Randomly generated bytes The ciphertext is delivered to the C2 server via GET requests. Each request contains headers that are atypical for malware: Sec-CH-UA , Sec-CH-UA-Platform , Sec-CH-UA-Mobile , Sec-Fetch-Mode , and Sec-Fetch-Dest . These headers are normally used by legitimate Chromium‑based browsers and enable malware to imitate legitimate traffic and evade detection. The C2 server replies with commands in a custom header and message body. struct header { int has_more_data // whether more body data remains int body_checksum;// ROR13 checksum for the body data int body_type; // specifies the body type int unknown; int body_length; // Length of the body data int IV[2]; // Random IV used to encrypt the body data }; The body_type field in the header determines how the subsequent payload is processed. This value functions as a bitmask, with each bit representing a distinct flag (e.g., 0x1 , 0x2 , 0x4 , etc.). The resulting behavior also depends on whether the least‑significant bit (bit 0) is set: when the value is odd, the malware interprets the incoming message body as an additional payload that is subsequently loaded into memory. Conversely, when the value is even, the malware invokes the previously loaded payload. The odd value supports four distinct loading methods based on the received message body and ensures that each method executes only once. Bitmask Value in decimal Description Result sent to the C2 0x00000001 1 DLL loading: load the received body reflectively along with the provided parameter The payload’s image base 0x00000011 3 Plugin: load the received body reflectively, obtain the address of a function in the payload, and then invoke that function along with the provided parameter The payload’s image base, the address of the invoked function, and the execution result 0x00000101 5 Plugin: load the received body reflectively, obtain the address of a function in the payload, but refrain from invoking it immediately The payload’s image base, the address of the function 0x00001011 11 Plugin: execute the behavior associated with value 3, then unload immediately after invoking the plugin – 0x00010001 17 DLL loading: load the received body reflectively with the provided parameter, maintaining stateful communication via a persistent interactive session using a shared buffer The payload’s image base, the address of the interactive shared buffer, and the execution result The even value provides two distinct invocation methods for DLLs and plugins that have already been loaded and are associated with the odd‑value bitmask. The 2 (0x10) flag allows the payload previously loaded with the 1 , 3 , or 5 bitmask to be reused and invoked directly. The value 16 (0x10000) corresponds to the 17 (0x10001) flag in loading mode and uses the established interactive shared buffer to exchange data. All values are guaranteed to act independently. Bitmask Value in decimal Description Result sent to the C2 0x00000010 2 Invoke the previously loaded DLLs and plugins along with the provided parameter The execution result 0x00000100 4 Not implemented – 0x00001000 8 Unload the previously loaded DLLs and plugins The execution result 0x00010000 16 Send the updated parameter to the payload loaded by the command with the value 17, and exchange data through the interactive session. This command also determines whether to retrieve the execution result or unload the payload The execution result Taking into account the loading mechanism, we identified four plugins deployed to the target that work perfectly with ClientHub. Plugin Description File archiver Archives the provided file using the legacy ZipCrypto algorithm (without password protection) and returns the compressed data File collector Searches for all files matching the provided search pattern and collects metadata including filename, MAC timestamps, file size, and attribute values File cleaner Overwrites the provided file with NULL bytes, renames it to a randomly generated filename of the same length, and then deletes it. If a directory with a search pattern is provided, it locates all matching files, renames each to a randomly generated name of identical length to its original name, and deletes them Drive and session monitor Monitors remote session changes and local drive changes for the provided duration (in 10-minute intervals) and returns the collected status information In addition to the plugins, ClientHub supports the loading of LPEClient malware and communication with it. We found that ClientHub’s body_type values 16 and 17 correspond to LPEClient’s C2 communication mechanism. LPEClient LPEClient is the only malware that was also observed in Operation SyncHole, indicating that the actor relies heavily on it for sophisticated victim profiling and payload delivery across multiple operations. LPEClient first appeared in 2019, and was discovered in 2020 . Since then, the tool has been widely observed in the Dream Job and Cascade Hole campaigns that targeted South Korea. Recent research conducted by Check Point revealed that LPEClient was used to deploy the FudModule malware using a zero-day. LPEClient has evolved continuously over time, but we discovered that it recently underwent a major operational revamp. It no longer contains the C2 server address itself; instead, it interacts with ClientHub via a shared buffer. We believe this change is intended to enhance concealment. Timeline of LPEClient The previous version collected the computer name, memory status, CPU specifications, operating system details, version of the ntoskrnl.exe file, firmware table, antivirus name, domain name, user name, the integrity level of the current process, and a random byte sequence of 1,568 bytes. The newly updated LPEClient variant mostly collects the same information; however, it also introduces several changes. It does not collect the version of the ntoskrnl.exe file by querying the FileVersion value. Instead, depending on the specific build, it reads either the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR registry key or the SYSTEM_BUILD_VERSION_INFORMATION structure to retrieve the revision portion of the Windows build number. These values can be used to infer the system’s cumulative update or patch level. To collect information about installed antivirus products, it switched from querying a WQL command to reading the WMI repository file directly. It now reads C:\Windows\System32\wbem\Repository\OBJECTS.DATA and searches for keywords such as AntiVirusProduct, companyName, and displayName to identify the installed products. It also collects low‑level Windows security mitigation states. To achieve this, it queries the SYSTEM_KERNEL_VA_SHADOW_INFORMATION structure for the Kernel VA Shadow mitigation status and the SYSTEM_SHADOW_STACK_INFORMATION structure for the Shadow Stack (CET) protection status. Additionally, it generates a 32‑byte random unique identifier by using the HighwayHash algorithm and an XOR operation with the current system time. The collected information, including the generated identifier, is compressed with the XPRESS Huffman algorithm using the maximum compression setting. The compressed data is then concatenated with the message ID 0xF07D6B34 and encrypted using GOST (also known as Magma), Russia’s national cryptographic standard that employs a DES‑like structure, before being sent to the ClientHub via a shared buffer. Initially, KrCERT described the algorithm as a custom DES‑like scheme. However, further analysis by us and Check Point confirmed that it is actually the GOST algorithm. The key is randomly generated by a proprietary key‑generation algorithm and prepended to the encrypted message. The next request handles the key exchange by delivering the message ID 0xA39CF278 together with the generated unique identifier. The response is decrypted using the AES‑CBC‑256 algorithm. The SHA‑256 hash of the previously generated 1,568‑byte random value, which was originally sent to the C2 server during the collection phase, serves as the key for this decryption. Through this process, LPEClient obtains a byte array comprising four 1,568‑byte blocks from the C2 response. Each block contains an ML‑KEM‑1024 public key, where ML‑KEM is a NIST‑standardized post‑quantum key encapsulation mechanism derived from CRYSTALS‑Kyber. LPEClient then generates four distinct pairs of shared keys and ciphertexts from these blocks, encrypts the ciphertexts with the GOST algorithm, and transmits them to the C2 server via ClientHub together with the message identifier 0xEF8C0D51 and the associated identifier. Now that the preparation phase for receiving payloads is complete, the malware is ready to receive payloads forwarded by ClientHub from the C2 server, along with the necessary parameters. The use of post-quantum cryptography shows that the group intends to hide subsequent payloads. The response to the 0xEF8C0D51 message is decrypted with the Threefish algorithm using a 256-byte key, composed of the four distinct shared keys. Threefish is a tweakable block cipher that accepts a ‘tweak’ value alongside the key and the message. The concept of a tweak is similar to that of a nonce or initialization vector, which are used in different types of ciphers. In LPEClient communication, the tweak for the decryption is derived by XORing the unique identifier with 165 (0xA5) . The first four bytes of the decrypted message must specify the parameter’s length, followed by the parameter itself and then the payload. The payload must be larger than 4 KB and start with the characters 'MZ' , which indicates that the decrypted payload is an executable file. The payload is then reflectively loaded into memory. After successful loading, LPEClient sends the message ID 0xCB790A25 to the C2 server. Before loading the acquired payload, LPEClient takes measures to bypass security products. Instead of invoking VirtualProtect directly, the malware uses the identified HeapPageAllocator::ProtectPages in jscript9.dll to modify the memory page protection of the MD4Update function. The beginning of the function is then overwritten with a hard‑coded opcode sequence that serves as a syscall stub with the required arguments. LPEClient then uses the syscall stub to disable a user‑mode syscall instrumentation hook. We identified the final payload that was ultimately loaded as Cubridge. The overall communication process is as follows. Data relay flow between LPEClient and C2 via ClientHub Comparison of plugins and modules Throughout the engagement, we identified a variety of payloads deployed by TechHub, Cubridge, and ClientHub. These payloads have been categorized as tools, plugins, and modules that constitute the group’s modular malware framework. While we have not yet ascertained which payloads are deployed under specific conditions, the evidence suggests that the Lazarus Group’s toolkit is becoming increasingly sophisticated and segmented into specialized components rather than a single comprehensive backdoor. We also believe that TechHub and Cubridge may share similar tools. Deployed via Type of payload Family TechHub/Cubridge Tool Process collector, Browser stealer Cubridge Module Action module, Function module Cubridge Plugin ADFinder, FileCollector ClientHub Plugin File archiver, File collector, File cleaner, Drive/session monitor These modularizations are not confined to the instances within this campaign. As previously noted, similar patterns have been identified in CookiePlus, MISTPEN, SIGNBT, and IMETHOD. Note that we have reclassified the ThreatNeedle variant used in Operation SyncHole as the latest version of IMETHOD, the predecessor of ThreatNeedle in use since at least 2016. Infrastructure Based on the information we obtained from the TechHub malware, we identified at least three primary repositories used as the C2 server and one fallback repository. The earliest evidence indicates that the group has been leveraging GitHub as a C2 server since at least July 2025. We suspect that all the accounts were created using hijacked email accounts, and disguised as normal repositories by copying or creating normal projects to avoid suspicion. For the Cubridge and ClientHub C2 servers, the Lazarus Group employed only a minimal number of compromised yet legitimate South Korean media and interior design websites. Later, we observed that a broader range of compromised legitimate sites across various industries were also exploited. In addition, one ClientHub sample that we detected used Dropbox as a C2 channel. Victims We have identified at least three firms from the software, construction, and wired communication equipment industries in South Korea that were targeted by Operation FlashHole. As with the previous operation, however, we remain confident that a considerably larger number of organizations across a broader spectrum of industries have been affected. The software sector was the only sector targeted in both the SyncHole and FlashHole campaigns. This suggests the actor is eager to compromise the sector, steal source code, and exploit vulnerabilities for further attacks. Attribution and links to other campaigns Operation FlashHole is the latest wave in the broader Cascade Hole campaign, which involves the use of South Korean software as a potential entry point to deliver malware targeting the country. Although the malware chain has advanced significantly since last year, we assess with medium-to-high confidence that the same actor is responsible for both the SyncHole and FlashHole operations based on the initial vector, targets, multi‑stage chain, and technical and operational improvements. The use of LPEClient in particular is a strong indicator supporting this assessment. The malware strains used in the attack are historically linked to the toolsets observed in the Lazarus Group’s notorious Dream Job campaign. Earlier versions of TechHub (also known as CLOUDBURST and NickelLoader), Cubridge (also known as SIDESHOW and LightlessCan), and TouchShift were all observed in that campaign, especially between 2022 and 2023. We also discovered that both CookiePlus and ClientHub have significant overlaps in class name, configuration path, and plugins. Based on these similarities, we assess with medium‑high confidence that ClientHub is an advanced version of CookiePlus. Since July, around the time Operation SyncHole began winding down, we have also observed several notable attacks against South Korea employing the COPPERHEDGE backdoor and targeting various South Korean organizations. Interestingly, the start times of these activities align with the earliest evidence we have identified for Operation FlashHole. Although the backdoor was part of the second phase of Operation SyncHole, it has been operating independently with its custom loader since then. These incidents featured malware chains and tools that were distinct from those used in Operation SyncHole and FlashHole. As AhnLab noted in their report , the same backdoor was likely observed in atypical activity, specifically the Gunra ransomware infection. Our investigation further revealed that one instance of a backdoor infection ultimately resulted in the exfiltration of data to a dark web leak site, which clearly differed from Gunra’s. The site appears to have been crafted exclusively for this activity. In summary, unlike other attacks, the backdoor was used in conjunction with both ransomware and data exfiltration. Data leakage site linked to the COPPERHEDGE backdoor on the dark web Another noteworthy point is that the recent Dream Job campaign employs an updated malware chain that, since around 2024, has primarily involved MISTPEN and ForestTiger rather than the earlier arsenal that included tools such as TechHub and Cubridge. However, the updated versions of this older malware have now re-emerged as part of Operation FlashHole. Considering these changes and all aspects of each attack’s TTPs, we have organized a classification for each attack. Overlaps between the recent attacks by Lazarus Group Conclusion Our analysis shows that the Lazarus Group begins preparing for its next operation shortly after completing the previous one, ultimately deploying an enhanced malware chain by refining existing tools. The group continues to use the advanced version of LPEClient for profiling and payload delivery, indicating that the tool is meticulously managed and well maintained. Ironically, the group seems to have adopted more secure post-quantum cryptography faster than many legitimate security products. These observations suggest the involvement of a dedicated developer, with others orchestrating comprehensive attack scenarios against newly targeted software. We anticipated that specialized attacks targeting South Korea would persist. However, we did not foresee multiple attack campaigns being executed simultaneously, each leveraging different types of software and tools. Notably, the COPPERHEDGE cluster appears to be involved in monetizing the attacks, while Operation FlashHole is focused on espionage. We are closely monitoring these changes to understand their motivations and ultimate goals. In October 2025, the South Korean government unveiled a comprehensive cybersecurity plan that will phase out the mandatory installation of security software for users beginning in 2026. We estimate that operations exploiting this software will remain highly active for some time, maximizing efficiency, before the software is fully eliminated or mitigated. Kaspersky products detect the exploits and malware used in this attack with the following verdicts: MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.*, Trojan.Win64.Lazarus.*. Indicators of compromise File hashes TouchShift ec84d6cb2ae7974767aedac246b50a3e              mscoree.dll a28cba214058fcae2883d8cffc883abd                 mscoree.dll c105d6b16f544582772de0159f24c00a                mscoree.dll 2f8475a90a25624ed02f1d18d4e6d65d               mscoree.dll 676fabe30a28b53925fba98e34b35986               mscoree.dll b4a7eff35f048f06fb0a2d7631f23a7d                   mscoree.dll ClientHub Loader ff07641dc56914dd90ee0bd7404d7ad7                liblzma.dll File paths C:\ProgramData\Dell\Dell1.tmp C:\ProgramData\Dell\Dell3.tmp C:\ProgramData\Package.txt C:\ProgramData\RasConv\mscoree.dll C:\ProgramData\Apple\mscoree.dll C:\ProgramData\ssh\mscoree.dll C:\ProgramData\qorestor\mscoree.dll C:\ProgramData\Dell\mscoree.dll C:\ProgramData\Dell\Dell1.tmp C:\ProgramData\Dell\Dell3.tmp C:\Windows\System32\RasConv\mscoree.dll C:\Windows\System32\RasConv\ActivationStore.dat C:\Windows\System32\DrvConh\mscoree.dll C:\Windows\System32\DrvConh\ActivationStore.dat C:\Program Files\Common Files\System\msadc\msadc.inc C:\ProgramData\desktops.ini C2 servers javadevhouse.co[.]kr pythonapischool[.]com hxxps://cubedesign[.]co[.]kr/news             C2 of Cubridge hxxps://cubedesign[.]co[.]kr/mobile/fashion             C2 of Cubridge hxxps://fp-news[.]co[.]kr/shop/cart                                 C2 of Cubridge hxxps://k-wbc[.]co[.]kr/skin/social/social_view.php          C2 of ClientHub hxxps://rcsh[.]co[.]kr/modules/bbs/tiles/bbs_div/inputForm.php     C2 of ClientHub hxxps://www[.]ksog[.]org/insert_file/handle.php                    C2 of ClientHub

Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. Major browsers and operating systems trusted the compromised certificates, potentially allowing attackers to impersonate legitimate websites and intercept encrypted communications. A security researcher known as Wayne discovered the weakness on October 17 while scanning publicly available certificate data. According to Mozilla's incident report, all eight certificates used P-384 private keys generated in April 2025 that had values smaller than 256, allowing anyone to recover them by testing just 256 possible numbers. To demonstrate the weakness, security researcher Flüpke published one of the compromised private keys on GitHub, showing that the private key for eMudhra's "EM OV TLS CA - G3C" certificate had a value of just 4. BleepingComputer independently verified that the published key matches one of the revoked certificates. In a response to Mozilla, eMudhra blamed the issue on an error in a script used to generate the certificates in April 2025. The company said the error generated a second set of weaker keys that were mistakenly selected for certificate signing because they had labels similar to the properly generated keys. Some of the resulting certificates were also submitted to Sectigo for cross-signing. eMudhra said most of the affected intermediate certificates were never used in production and that it had found no evidence they were used to issue certificates to end users. However, attackers could have recovered and abused the weak keys since their creation in April 2025, though there is no evidence that this happened. Following the disclosure, eMudhra revoked the eight compromised certificates and stopped issuing new certificates under its G3 root. Browser makers and software vendors release fixes Mozilla said it blocked the compromised certificates through Firefox's OneCRL system on October 17, protecting users without requiring a browser update or restart. Google Chrome also blocked the six compromised intermediates authorized to issue TLS certificates that day, while Apple added protections on October 19. Mozilla also released Firefox 158.0.1 and updates for its ESR releases on October 20 to protect users whose browser configurations prevented them from receiving the earlier revocation updates. However, software that uses its own certificate stores or doesn't check certificate revocations may keep trusting the compromised intermediates until it is updated. The Go development team released versions 1.27.3 and 1.26.10 to address the issue, tracked as CVE-2026-111943. Mozilla cryptography engineer Dennis Jackson has also published an incident tracking website listing affected software and available security updates. Jackson also warns that macOS's built-in /usr/bin/curl utility may continue trusting the compromised certificates because its certificate bundle does not check revocation information. Administrators can use the advisory's test endpoints and mitigation instructions to determine whether their systems are still affected. Users and administrators should install available software updates to ensure the compromised certificates are no longer trusted. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Apple just released a system called “Reference Image.” It can verify the image is exactly as taken by an iPhone—new models only—without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other industry solutions require a photographer or institution to vouch for an image using their own credentials. We are concerned this puts some photographers, such as those operating in conflict zones, in a difficult position; it should not be necessary to forgo anonymity in order to prove image authenticity. We built Apple Reference Image to avoid using an explicit, public credential for photographers, and to avoid even implicit public association between different photos taken by the same sensor. The final reference image is instead signed by Apple’s signing service, after validation by PCC. That signature is backed by Apple’s strongest technical guarantees. Our implementation also protects the confidentiality of the image itself, including from Apple. Merely capturing a reference image should never expose the actual pixels to Apple or anyone else. We achieve this through the exceptional privacy properties of PCC—the nodes themselves are architected so that not even Apple can access image data, just as Apple cannot see the information processed for Apple Intelligence in PCC. While the revocation service must maintain a private record of photo GUIDs and associated sensors to allow for revocation, it never has access to the image data, and does not allow for public access to this record. And as final revocation checks occur using on-device lists, a device never reveals to anyone which photo it’s looking at in order to find out whether it’s still valid. The report makes for good reading; the details are interesting.

In August, the Malwarebytes research team reported on a new malicious turnkey kit that makes it possible for almost anyone to launch a sophisticated online scam. The kit was not simply a fake website. It bundled the command center, victim tracking, and administrative tools into a ready-to-use package, reducing the technical knowledge needed to operate a scam. The discovery highlights an important feature of the cybercrime economy: criminals don’t necessarily need to build their own infrastructure from scratch. Instead, they can buy ready-made services that handle much of the complicated work for them. The same pattern is well established in phishing . Scam emails are no longer limited to poorly written, easily spotted phishing attempts. Cybercriminals now use complete, subscription-based platforms that make launching convincing attacks as easy as signing up for a monthly service. One of the most dangerous examples of this trend is BlueKit , a phishing-as-a-service (PhaaS) toolkit designed to automate and scale account hijacking. BlueKit allows attackers to manage entire phishing campaigns through a single dashboard without needing deep technical knowledge.  BlueKit thread on underground cybercrime forum “petrushka” (Russian for parsley), the operator behind BlueKit BlueKit’s origin s The Malwarebytes research team has been tracking BlueKit’s development since the service first appeared on a prominent cybercrime forum in April. Rather than simply documenting its initial capabilities, our researchers followed its evolution over time, watching how the service developed and what its growing capabilities could mean for cybercriminal operations. BlueKit offered by the threat actor “petrushka” A template library targeting familiar brands  As of September, BlueKit boasts an extensive template library supporting 97 distinct brands across 176 variants . The service’s operators describe these phishing pages as:  “pixel-perfect and ready to deploy in one click.” The offer of “BlueKit” (extended) BlueKit’s website Phishing kits list on BlueKit’s website Our analysis shows that the platform targets both consumer and business platforms . Its phishing kit templates include: Consumer services: Templates impersonating major providers, including Amazon, Booking.com, Google/Gmail, and Apple. Finance and cryptocurrency: Templates impersonating financial institutions such as American Express and Bank of America, alongside numerous cryptocurrency exchanges. Social media and communications: Templates impersonating major social media platforms including TikTok, Facebook, and X. Generative AI platforms: Templates designed to steal login details for services including OpenAI and Anthropic. Below is a video demo of a phishing page impersonating the crypto wallet provider Trezor: .kadence-column471581_a23f77-44 > .kt-inside-inner-col{display:flex;}.kadence-column471581_a23f77-44{max-width:801px;margin-left:auto;margin-right:auto;}.wp-block-kadence-column.kb-section-dir-horizontal:not(.kb-section-md-dir-vertical)>.kt-inside-inner-col>.kadence-column471581_a23f77-44{-webkit-flex:0 1 801px;flex:0 1 801px;max-width:unset;margin-left:unset;margin-right:unset;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col,.kadence-column471581_a23f77-44 > .kt-inside-inner-col:before{border-top-left-radius:0px;border-top-right-radius:0px;border-bottom-right-radius:0px;border-bottom-left-radius:0px;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col > .kb-image-is-ratio-size{align-self:stretch;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col > .wp-block-kadence-advancedgallery{align-self:stretch;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col > .aligncenter{width:100%;}.kt-row-column-wrap > .kadence-column471581_a23f77-44{align-self:center;}.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44{align-self:auto;}.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column471581_a23f77-44{position:relative;}@media all and (min-width: 1025px){.wp-block-kadence-column.kb-section-dir-horizontal>.kt-inside-inner-col>.kadence-column471581_a23f77-44{-webkit-flex:0 1 801px;flex:0 1 801px;max-width:unset;margin-left:unset;margin-right:unset;}}@media all and (max-width: 1024px){.kt-row-column-wrap > .kadence-column471581_a23f77-44{align-self:center;}}@media all and (max-width: 1024px){.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44{align-self:auto;}}@media all and (max-width: 1024px){.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 1024px){.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}}@media all and (max-width: 767px){.kt-row-column-wrap > .kadence-column471581_a23f77-44{align-self:center;}.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44{align-self:auto;}.kt-inner-column-height-full:not(.kt-has-1-columns) > .wp-block-kadence-column.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}.wp-block-kadence-column.kb-section-sm-dir-vertical:not(.kb-section-sm-dir-horizontal):not(.kb-section-sm-dir-specificity)>.kt-inside-inner-col>.kadence-column471581_a23f77-44{max-width:801px;-webkit-flex:1;flex:1;margin-left:auto;margin-right:auto;}.kadence-column471581_a23f77-44 > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}} Beyond consumer-oriented attacks, BlueKit also presents an acute threat to businesses by providing the tools necessary to target corporate logins.  Our team found support for critical business infrastructure and single sign-on (SSO) gateways. This includes customer relationship and marketing automation platforms, such as Salesforce and HubSpot, developer and source control environments like GitHub, and security services including Check Point, Citrix, Cloudflare, and Cisco. Business-oriented phishing templates on BlueKit’s website A toolkit that never stops updating One of the interesting things about BlueKit is that its creators are constantly adding new features, much like a legitimate software company releasing updates for its apps. For example, on July 26, the BlueKit team used its official Telegram channel to announce an upcoming upgrade: a built-in SMS sender. Less than a month later, on August 10, they announced its release. The new tool allows scammers to send text messages directly from the BlueKit dashboard. Alongside phishing emails, attackers can now easily send scam texts (called “smishing”) to trick people into clicking malicious links. The operators say the update even lets attackers use local US phone numbers, which could make the messages appear more trustworthy. It gives them an entirely new, highly effective way to deliver scams from one control panel. SMS sender announcement in BlueKit’s Telegram channel SMS sender module on BlueKit’s website But BlueKit’s creators aren’t just focused on adding shiny new tools like the SMS sender. They’re also constantly working behind the scenes to improve their core product. A September update, for example, improved their fake website templates to make them look even more convincing, and upgraded the hidden technology they use to steal and manage sessions. BlueKit’s September updates Three ways BlueKit makes phishing easier for scammers After monitoring BlueKit’s development and analyzing its capabilities, our research team identified three ways the service lowers the barrier to launching sophisticated phishing attacks: setting up a site, capturing account access, and using AI to support the attack. 1. Quick setup BlueKit is an “easy-to-install” phishing service, highlighting just how quickly sophisticated phishing infrastructure can be deployed.  According to its operators, an attacker can connect a domain and have a phishing site ready in around 10 minutes. The cheapest subscription costs $250 for seven days, and an attacker could potentially go from purchasing the service to launching a sophisticated phishing campaign in a matter of minutes. Description of BlueKit’s easy setup procedure 2. More than password theft When most people think of phishing, they picture a scammer tricking them into handing over a username and password. But BlueKit goes much deeper than a basic smash-and-grab. Behind the scenes, this tool secretly collects a complete digital profile of your computer , including a device fingerprint, cookie sessions, and even passkeys.  Device fingerprint: BlueKit records your IP address, web browser details, and device characteristics. Together, details such as screen size, operating system, and hidden hardware settings can form a “fingerprint” that helps distinguish one browser or device from another. Many modern security systems look for familiar devices to double-check that it’s really you trying to log in. So by stealing this background information alongside your password, an attacker can mimic your device to bypass security checks. Session cookies: When you log into a website like your email or online bank, the site doesn’t make you retype your password every time you open a new page. Instead, it places a tiny file on your device called a session cookie to recognize that you’ve already signed in. Think of a session cookie like a VIP wristband given to you at a concert entrance. Once the guard checks your ticket—your login—they give you a wristband. While you’re wearing that wristband, you can walk freely in and out of the venue without showing your ticket again. Instead of just stealing your ticket, BlueKit also steals the wristband itself . Once the attacker takes your session cookie, they can paste it into their own browser and walk straight into your active account. They don’t need to guess your password, and they don’t need to ask for a two-factor code. The website already thinks they are you. Description of BlueKit’s data-capturing capabilitie s Live demos using real credentials, shared by the BlueKit team 3. A built-in AI assistant What makes BlueKit especially interesting right now is that it comes with its own built-in, “no-rules” artificial intelligence. Think of it like a malicious version of ChatGPT, built directly into the scammer’s toolkit. Usually, AI tools have safety filters to prevent people from doing illegal things. BlueKit’s creators, however, have removed those guardrails, advertising that their custom AI will answer “even extreme prompts” and help with “fraud-related questions.” Instead of writing convincing scam emails from scratch, an attacker can simply ask the AI to write phishing emails and fake text messages. This is a huge development. BlueKit illustrates how advanced AI features are not just for legitimate businesses. They are being packaged and sold as standard features in cybercriminal services, making it easier for attackers to launch highly convincing attacks. BlueKit’s advertised AI capabilities AI features advertised on BlueKit’s website The business behind BlueKit BlueKit’s claimed customer numbers also point to a potentially significant revenue stream. On August 29, the operators announced that the service had passed 1,000 customers. Based on the advertised subscription prices, we can illustrate the potential revenue generated so far, although the actual distribution of subscriptions is unknown. BlueKit’s announcement claiming more than 1,000 customers If all 1,000 customers purchased one 7-day subscription at $250: $250,000 in gross revenue. If all 1,000 customers purchased one 30-day subscription at $940: $940,000 in gross revenue. If purchases were split roughly equally between the 7-day ($250), 14-day ($480), and 30-day ($940) plans: Approximately $557,000 in gross revenue. These are hypothetical calculations, but even so, the figures are a striking example of the economics behind phishing-as-a-service: operators can potentially generate hundreds of thousands of dollars in revenue by selling access to their infrastructure to other criminals.  BlueKit’s advertised subscription prices What this means for you Phishing has officially evolved beyond obvious scam pages filled with typos and blurry logos. BlueKit combines convincing login pages, a built-in AI assistant, and subscription access to tools that once required more technical skills.  Services like these make sophisticated phishing easier to launch, allowing scammers to generate a highly convincing, customized phishing attack from scratch in as little as 10 minutes. Ultimately, services like BlueKit mean that advanced, highly deceptive cyberattacks are no longer limited to elite hackers. They are now fast, cheap, and accessible to anyone with a few dollars to spare. Polished wording and familiar branding are not proof that a message or login page is genuine.  Open the app or website yourself. If a message asks you to sign in, use the official app or a saved bookmark rather than the link in the email or message. Check the website address before signing in. Scammers can use lookalike addresses with small spelling changes, known as typosquatting. A password manager can help as it will only autofill logins on the correct site, while Malwarebytes Browser Guard can help block phishing pages.  Use passkeys where available, and keep two-factor authentication enabled. These are still valuable protections, although some phishing techniques can capture sessions after a user completes a login.  If you signed in through a suspicious link, secure your account through the official app or website. Change your password, review your account activity, and sign out of all sessions. Pro tip: Malwarebytes Scam Guard can also help you assess a suspicious message before you act on it. “One of the best cybersecurity suites on the planet.”   According to CNET.  Read their review →

A North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music in a massive streaming royalty fraud scheme. [...]

On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. [...]

Citing growing risks posed by more capable and autonomous AI agents, Apple will introduce additional controls. The post Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks appeared first on SecurityWeek .

404Media is reporting (alternate link ) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone into a more secure state if it hasn’t been used for 72 hours. The new technology to get around inactivity reboot was developed by Magnet Forensics, the company behind GrayKey, a popular tool sold to law enforcement agencies that allows them to unlock and access data stored in iPhones and Android smartphones . Magnet has developed a new device called GrayKey Preserve and a feature for its regular GrayKey devices called Evidence Preservation Mode, according to the video. “This is an absolute game changer for iOS forensics and a function that I wish we had years ago,” a Magnet employee says in the leaked video, specifically mentioning that the solution is targeted at the iPhone’s inactivity reboot feature and the data it makes unavailable. GrayKey Preserve and Evidence Preservation Mode are also designed to combat another iPhone feature that automatically deletes certain data ­- such as cached locations, and recently deleted photos and iMessages ­- after a certain number of days. “We’re gonna be able to preserve that data for an infinite amount of time.” Presumably, now that Apple engineers know that this flaw exists they can find and fix it. AI turns out to be really good at this sort of thing. Another news article .

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - User-space API (UAPI); - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - Android drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Bluetooth drivers; - Cdrom driver; - Character device driver; - Hardware random number generator core; - TPM device driver; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - DAX dirext access to differentiated memory framework; - DMA engine subsystem; - FireWire subsystem; - Arm Firmware Framework for ARMv8-A(FFA); - ARM SCMI message protocol; - Intel Stratix 10 firmware drivers; - FPGA Framework; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - Intel Trace Hub HW tracing drivers; - I2C subsystem; - IIO subsystem; - IIO ADC drivers; - IIO Magnetometer sensors drivers; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Mouse) drivers; - IOMMU subsystem; - IRQ chip drivers; - LED subsystem; - Multiple devices driver; - Media drivers; - MemoryStick subsystem; - Multifunction device drivers; - Fastrpc Driver; - MMC subsystem; - MTD block device drivers; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - Texas Instruments network drivers; - MediaTek network drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - Parport drivers; - PCI subsystem; - Pin controllers subsystem; - Generic PM domains; - System reset/shutdown drivers; - Power supply drivers; - RapidIO drivers; - Voltage and Current Regulator drivers; - Reset controller framework; - S/390 drivers; - SCSI subsystem; - SLIMbus drivers; - SPI subsystem; - Media staging drivers; - Media Oriented Systems Transport (MOST) driver; - NVIDIA Tegra embedded controller (NVEC) staging driver; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - Trusted Execution Environment drivers; - Thermal drivers; - Thunderbolt and USB4 drivers; - TTY drivers; - USB DSL drivers; - Cadence USB3 driver; - USB Device Class drivers; - ULPI bus; - DesignWare USB2 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - USB ChaosKey driver; - Siemens ID Mouse USB driver; - IOWarrior USB driver; - LD Didactic USB driver; - LEGO USB Tower driver; - USS720 USB parallel port adapter driver; - MediaTek USB3 DRD driver; - USB Serial drivers; - USB Type-C support driver; - USB Type-C Port Controller Manager driver; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - vDPA drivers; - VFIO drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - Watchdog drivers; - Xen hypervisor drivers; - AFS file system; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - exFAT file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - HFS file system; - HFS+ file system; - Journaling layer for block devices (JBD2); - Network file system (NFS) client; - Network file system (NFS) server daemon; - NILFS2 file system; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - SMB network file system; - UDF file system; - XFS file system; - Key management; - Software nodes and device properties; - Glob pattern matching library; - KVM subsystem; - Networking core; - Netfilter; - Socket messages infrastructure; - Network sockets; - Memory Management; - Network traffic control; - IPv6 networking; - Bluetooth subsystem; - IP tunnels definitions; - IPv4 networking; - SCTP protocol; - XFRM subsystem; - io_uring subsystem; - IPC subsystem; - Audit subsystem; - BPF subsystem; - Control group (cgroup); - Kernel CPU control infrastructure; - Kernel exit() syscall; - Kernel futex primitives; - Locking primitives; - Scheduler infrastructure; - Signal handling mechanism; - Timer subsystem; - Tracing infrastructure; - Cryptographic library; - Debug objects infrastructure; - Resizable hashtable library; - Memory management; - 6LoWPAN network protocol; - IEEE 802 network protocols; - 9P file system network protocol; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - CAN network layer; - Ceph Core library; - Ethtool driver; - HSR network protocol; - IEEE802154.4 network protocol; - IFE protocol; - IUCV driver; - KCM (Kernel Connection Multiplexor) sockets driver; - Logical Link layer; - MAC80211 subsystem; - IEEE 802.15.4 subsystem; - Management Component Transport Protocol (MCTP); - MultiProtocol Label Switching driver; - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NetLabel subsystem; - NFC subsystem; - Open vSwitch; - Packet sockets; - Phonet protocol; - Packet sampling (psample); - Qualcomm IPC Router (QRTR); - RDS protocol; - SMC sockets; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - AppArmor security module; - Integrity Measurement Architecture(IMA) framework; - Apple Onboard Audio ALSA driver; - ALSA framework; - Generic PCM loopback sound driver; - FireWire sound drivers; - ESS Solo-1 ALSA driver; - HD-audio driver; - Simple audio multiplexer codec driver; - SoC Audio for Freescale CPUs drivers; - NVIDIA Tegra ASoC drivers; - USB sound devices; - Perf tools; (CVE-2023-54125, CVE-2023-54271, CVE-2025-22026, CVE-2025-23131, CVE-2025-39863, CVE-2025-39929, CVE-2025-39931, CVE-2026-23364, CVE-2026-31449, CVE-2026-31451, CVE-2026-31610, CVE-2026-31700, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-31715, CVE-2026-43064, CVE-2026-43216, CVE-2026-43219, CVE-2026-43350, CVE-2026-43355, CVE-2026-43491, CVE-2026-43492, CVE-2026-45850, CVE-2026-45930, CVE-2026-45991, CVE-2026-45999, CVE-2026-46003, CVE-2026-46021, CVE-2026-46026, CVE-2026-46038, CVE-2026-46052, CVE-2026-46056, CVE-2026-46065, CVE-2026-46069, CVE-2026-46078, CVE-2026-46086, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46103, CVE-2026-46116, CVE-2026-46159, CVE-2026-46160, CVE-2026-46169, CVE-2026-46180, CVE-2026-46191, CVE-2026-46193, CVE-2026-46196, CVE-2026-46208, CVE-2026-46252, CVE-2026-46291, CVE-2026-46292, CVE-2026-46299, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-52909, CVE-2026-52910, CVE-2026-52913, CVE-2026-52917, CVE-2026-52918, CVE-2026-52923, CVE-2026-52927, CVE-2026-52928, CVE-2026-52929, CVE-2026-52930, CVE-2026-52933, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939, CVE-2026-52942, CVE-2026-52943, CVE-2026-52947, CVE-2026-52948, CVE-2026-52977, CVE-2026-53080, CVE-2026-53090, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53139, CVE-2026-53146, CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53157, CVE-2026-53158, CVE-2026-53159, CVE-2026-53161, CVE-2026-53163, CVE-2026-53167, CVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53189, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53199, CVE-2026-53208, CVE-2026-53213, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53223, CVE-2026-53227, CVE-2026-53238, CVE-2026-53239, CVE-2026-53245, CVE-2026-53249, CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53273, CVE-2026-53275, CVE-2026-53325, CVE-2026-53329, CVE-2026-53331, CVE-2026-53332, CVE-2026-53337, CVE-2026-53339, CVE-2026-53352, CVE-2026-53356, CVE-2026-53357, CVE-2026-53358, CVE-2026-53381, CVE-2026-53382, CVE-2026-53383, CVE-2026-53385, CVE-2026-53388, CVE-2026-53391, CVE-2026-53392, CVE-2026-53393, CVE-2026-53397, CVE-2026-53399, CVE-2026-53400, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794, CVE-2026-63796, CVE-2026-63798, CVE-2026-63801, CVE-2026-63803, CVE-2026-63806, CVE-2026-63807, CVE-2026-63809, CVE-2026-63810, CVE-2026-63814, CVE-2026-63815, CVE-2026-63817, CVE-2026-63818, CVE-2026-63822, CVE-2026-63823, CVE-2026-63824, CVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830, CVE-2026-63831, CVE-2026-63833, CVE-2026-63834, CVE-2026-63835, CVE-2026-63836, CVE-2026-63867, CVE-2026-63868, CVE-2026-63870, CVE-2026-63875, CVE-2026-63889, CVE-2026-63890, CVE-2026-63891, CVE-2026-63892, CVE-2026-63893, CVE-2026-63895, CVE-2026-63897, CVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63908, CVE-2026-63913, CVE-2026-63914, CVE-2026-63915, CVE-2026-63916, CVE-2026-63917, CVE-2026-63919, CVE-2026-63920, CVE-2026-63921, CVE-2026-63925, CVE-2026-63926, CVE-2026-63927, CVE-2026-63928, CVE-2026-63930, CVE-2026-63931, CVE-2026-63933, CVE-2026-63934, CVE-2026-63942, CVE-2026-63947, CVE-2026-63948, CVE-2026-63954, CVE-2026-63956, CVE-2026-63957, CVE-2026-63960, CVE-2026-63961, CVE-2026-63964, CVE-2026-63967, CVE-2026-63971, CVE-2026-63975, CVE-2026-63976, CVE-2026-63985, CVE-2026-63990, CVE-2026-63991, CVE-2026-64002, CVE-2026-64004, CVE-2026-64005, CVE-2026-64009, CVE-2026-64010, CVE-2026-64011, CVE-2026-64012, CVE-2026-64014, CVE-2026-64090, CVE-2026-64093, CVE-2026-64094, CVE-2026-64095, CVE-2026-64116, CVE-2026-64118, CVE-2026-64123, CVE-2026-64126, CVE-2026-64137, CVE-2026-64170, CVE-2026-64187, CVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64206, CVE-2026-64222, CVE-2026-64225, CVE-2026-64234, CVE-2026-64237, CVE-2026-64242, CVE-2026-64243, CVE-2026-64246, CVE-2026-64249, CVE-2026-64266, CVE-2026-64268, CVE-2026-64269, CVE-2026-64271, CVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276, CVE-2026-64277, CVE-2026-64279, CVE-2026-64296, CVE-2026-64298, CVE-2026-64299, CVE-2026-64301, CVE-2026-64303, CVE-2026-64304, CVE-2026-64306, CVE-2026-64312, CVE-2026-64313, CVE-2026-64315, CVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64329, CVE-2026-64330, CVE-2026-64331, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334, CVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338, CVE-2026-64340, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344, CVE-2026-64346, CVE-2026-64347, CVE-2026-64350, CVE-2026-64351, CVE-2026-64352, CVE-2026-64355, CVE-2026-64359, CVE-2026-64360, CVE-2026-64361, CVE-2026-64362, CVE-2026-64363, CVE-2026-64364, CVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373, CVE-2026-64374, CVE-2026-64375, CVE-2026-64379, CVE-2026-64380, CVE-2026-64381, CVE-2026-64390, CVE-2026-64401, CVE-2026-64403, CVE-2026-64408, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413, CVE-2026-64420, CVE-2026-64422, CVE-2026-64423, CVE-2026-64425, CVE-2026-64428, CVE-2026-64429, CVE-2026-64430, CVE-2026-64432, CVE-2026-64435, CVE-2026-64436, CVE-2026-64438, CVE-2026-64440, CVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444, CVE-2026-64445, CVE-2026-64446, CVE-2026-64448, CVE-2026-64450, CVE-2026-64452, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456, CVE-2026-64461, CVE-2026-64462, CVE-2026-64465, CVE-2026-64468, CVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64475, CVE-2026-64478, CVE-2026-64483, CVE-2026-64484, CVE-2026-64487, CVE-2026-64488, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496, CVE-2026-64497, CVE-2026-64500, CVE-2026-64503, CVE-2026-64504, CVE-2026-64505, CVE-2026-64510, CVE-2026-64512, CVE-2026-64514, CVE-2026-64524, CVE-2026-64527, CVE-2026-64528, CVE-2026-64529, CVE-2026-64530, CVE-2026-64532, CVE-2026-64533, CVE-2026-64534, CVE-2026-64535, CVE-2026-64536, CVE-2026-64537, CVE-2026-64538, CVE-2026-64540, CVE-2026-64541, CVE-2026-64543, CVE-2026-64544, CVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64548, CVE-2026-64549, CVE-2026-64550, CVE-2026-64551, CVE-2026-64553, CVE-2026-64554, CVE-2026-64560, CVE-2026-64562, CVE-2026-64563, CVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64569, CVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64576, CVE-2026-64578, CVE-2026-64579, CVE-2026-64582, CVE-2026-64583, CVE-2026-64584, CVE-2026-64593, CVE-2026-64594, CVE-2026-64599, CVE-2026-64600, CVE-2026-64602, CVE-2026-64604, CVE-2026-68088, CVE-2026-68090, CVE-2026-68091, CVE-2026-68104, CVE-2026-68106, CVE-2026-68111, CVE-2026-68115, CVE-2026-68117, CVE-2026-68121, CVE-2026-68123, CVE-2026-68125, CVE-2026-68127, CVE-2026-68129, CVE-2026-68131, CVE-2026-68135, CVE-2026-68137, CVE-2026-68140, CVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68144, CVE-2026-68151, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155, CVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68160, CVE-2026-68175, CVE-2026-68176, CVE-2026-68180, CVE-2026-68182, CVE-2026-68183, CVE-2026-68184, CVE-2026-68186, CVE-2026-68187, CVE-2026-68188, CVE-2026-68190, CVE-2026-68192, CVE-2026-68195, CVE-2026-68196, CVE-2026-68197, CVE-2026-68199, CVE-2026-68204, CVE-2026-68209, CVE-2026-68212, CVE-2026-68213, CVE-2026-68214, CVE-2026-68215, CVE-2026-68216, CVE-2026-68217, CVE-2026-68218, CVE-2026-68222, CVE-2026-68223, CVE-2026-68226, CVE-2026-68227, CVE-2026-68229, CVE-2026-68231, CVE-2026-68234, CVE-2026-68243, CVE-2026-68244, CVE-2026-68248, CVE-2026-68249, CVE-2026-68250, CVE-2026-68284, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299, CVE-2026-68300, CVE-2026-68301, CVE-2026-68304, CVE-2026-68309, CVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322, CVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327, CVE-2026-68328, CVE-2026-68331, CVE-2026-68333, CVE-2026-68335, CVE-2026-68338, CVE-2026-68340, CVE-2026-68349, CVE-2026-68350, CVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354, CVE-2026-68355, CVE-2026-68357, CVE-2026-68360, CVE-2026-68361, CVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68368, CVE-2026-68369, CVE-2026-68370, CVE-2026-68373, CVE-2026-68376, CVE-2026-68377, CVE-2026-68388, CVE-2026-68395, CVE-2026-68397, CVE-2026-68398, CVE-2026-68402, CVE-2026-68403, CVE-2026-68405, CVE-2026-68406, CVE-2026-68410, CVE-2026-68411, CVE-2026-68413, CVE-2026-68414, CVE-2026-68417, CVE-2026-68422, CVE-2026-68425, CVE-2026-68428, CVE-2026-68430, CVE-2026-68432, CVE-2026-68433, CVE-2026-68444, CVE-2026-68446, CVE-2026-68449, CVE-2026-68450, CVE-2026-68451, CVE-2026-68452, CVE-2026-68456, CVE-2026-68459, CVE-2026-68460, CVE-2026-68461, CVE-2026-68466, CVE-2026-68467, CVE-2026-68469, CVE-2026-68474, CVE-2026-68475, CVE-2026-68477, CVE-2026-68478, CVE-2026-68479, CVE-2026-68480, CVE-2026-72004, CVE-2026-72005, CVE-2026-72010, CVE-2026-72013, CVE-2026-72014, CVE-2026-72019, CVE-2026-72020, CVE-2026-72021, CVE-2026-72022, CVE-2026-72024, CVE-2026-72025, CVE-2026-72033, CVE-2026-72036, CVE-2026-72038, CVE-2026-72039, CVE-2026-72047, CVE-2026-72048, CVE-2026-72049, CVE-2026-72052, CVE-2026-72054, CVE-2026-72055, CVE-2026-72056, CVE-2026-72061, CVE-2026-72066, CVE-2026-72067, CVE-2026-72068, CVE-2026-72074, CVE-2026-72076, CVE-2026-72078, CVE-2026-72079, CVE-2026-72081, CVE-2026-72082, CVE-2026-72083, CVE-2026-72084, CVE-2026-72085, CVE-2026-72086, CVE-2026-72088, CVE-2026-72102, CVE-2026-72105, CVE-2026-72107, CVE-2026-72108, CVE-2026-72109, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115, CVE-2026-72116, CVE-2026-72117, CVE-2026-72118, CVE-2026-72119, CVE-2026-72120, CVE-2026-72121, CVE-2026-72122, CVE-2026-72123, CVE-2026-72124, CVE-2026-72125, CVE-2026-72126, CVE-2026-72129, CVE-2026-72133, CVE-2026-72135, CVE-2026-72136, CVE-2026-72138, CVE-2026-72140, CVE-2026-72146, CVE-2026-72153, CVE-2026-72159, CVE-2026-72160, CVE-2026-72163, CVE-2026-72164, CVE-2026-72165, CVE-2026-72166, CVE-2026-72167, CVE-2026-72171, CVE-2026-72181, CVE-2026-72182, CVE-2026-72192, CVE-2026-72193, CVE-2026-72194, CVE-2026-72195, CVE-2026-72197, CVE-2026-72215, CVE-2026-72218, CVE-2026-72219, CVE-2026-72223, CVE-2026-72224, CVE-2026-72225, CVE-2026-72226, CVE-2026-72228, CVE-2026-72229, CVE-2026-72230, CVE-2026-72231, CVE-2026-72232, CVE-2026-72233, CVE-2026-72234, CVE-2026-72235, CVE-2026-72238, CVE-2026-72240, CVE-2026-72241, CVE-2026-72245, CVE-2026-72247, CVE-2026-72250, CVE-2026-72251, CVE-2026-72256, CVE-2026-72264, CVE-2026-72265, CVE-2026-72267, CVE-2026-72268, CVE-2026-72269, CVE-2026-72270, CVE-2026-72271, CVE-2026-72272, CVE-2026-72274, CVE-2026-72275, CVE-2026-72276, CVE-2026-72282, CVE-2026-72289, CVE-2026-72296, CVE-2026-72297, CVE-2026-72298, CVE-2026-72306, CVE-2026-72307, CVE-2026-72310, CVE-2026-72314, CVE-2026-72316, CVE-2026-72319, CVE-2026-72322, CVE-2026-72326, CVE-2026-72339, CVE-2026-72347, CVE-2026-72348, CVE-2026-72349, CVE-2026-72350, CVE-2026-72351, CVE-2026-72371, CVE-2026-72374, CVE-2026-72378, CVE-2026-72389, CVE-2026-72392, CVE-2026-72396, CVE-2026-72400, CVE-2026-72406, CVE-2026-72409, CVE-2026-72414, CVE-2026-72418, CVE-2026-72421, CVE-2026-72422, CVE-2026-72428, CVE-2026-72433, CVE-2026-72435, CVE-2026-72441, CVE-2026-72447, CVE-2026-72448, CVE-2026-72450, CVE-2026-72459, CVE-2026-72460, CVE-2026-72466, CVE-2026-72476, CVE-2026-72479, CVE-2026-72481, CVE-2026-72483, CVE-2026-72484, CVE-2026-72489, CVE-2026-72491, CVE-2026-72492, CVE-2026-72502, CVE-2026-74255, CVE-2026-74256, CVE-2026-74262, CVE-2026-74265, CVE-2026-74267, CVE-2026-74276, CVE-2026-74279, CVE-2026-74280, CVE-2026-74281, CVE-2026-74282, CVE-2026-74283, CVE-2026-74284, CVE-2026-74287, CVE-2026-74288, CVE-2026-74292, CVE-2026-74293, CVE-2026-74295, CVE-2026-74297, CVE-2026-74305, CVE-2026-74312, CVE-2026-74313, CVE-2026-74320, CVE-2026-74321, CVE-2026-74327, CVE-2026-74329, CVE-2026-74330, CVE-2026-74331, CVE-2026-74339, CVE-2026-74340, CVE-2026-74346, CVE-2026-74348, CVE-2026-74349, CVE-2026-74351, CVE-2026-74359, CVE-2026-74363, CVE-2026-74376, CVE-2026-74379, CVE-2026-74382, CVE-2026-74384, CVE-2026-74390, CVE-2026-74394, CVE-2026-74395, CVE-2026-74398, CVE-2026-74399, CVE-2026-74402, CVE-2026-74408, CVE-2026-74410, CVE-2026-74416, CVE-2026-74424, CVE-2026-74426, CVE-2026-74427, CVE-2026-74438, CVE-2026-74443, CVE-2026-74444, CVE-2026-74453, CVE-2026-74455, CVE-2026-74456, CVE-2026-74457, CVE-2026-74458, CVE-2026-74459, CVE-2026-74460, CVE-2026-74461, CVE-2026-74463, CVE-2026-74464, CVE-2026-74465, CVE-2026-74467, CVE-2026-74468, CVE-2026-74469, CVE-2026-74471, CVE-2026-74473, CVE-2026-74475, CVE-2026-74478, CVE-2026-74480, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485, CVE-2026-74488, CVE-2026-74490, CVE-2026-74492, CVE-2026-74493, CVE-2026-74495, CVE-2026-74497, CVE-2026-74498, CVE-2026-74499, CVE-2026-74505, CVE-2026-74507, CVE-2026-74508, CVE-2026-74512, CVE-2026-74518, CVE-2026-74519, CVE-2026-74523, CVE-2026-74525, CVE-2026-74540, CVE-2026-74546, CVE-2026-74547, CVE-2026-74548, CVE-2026-74549, CVE-2026-74556, CVE-2026-74557, CVE-2026-74563, CVE-2026-74564, CVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74577, CVE-2026-74578, CVE-2026-74579, CVE-2026-74580, CVE-2026-74581, CVE-2026-74583, CVE-2026-74584, CVE-2026-74585, CVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74597, CVE-2026-74598, CVE-2026-74604, CVE-2026-74609, CVE-2026-74613, CVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74620, CVE-2026-74622, CVE-2026-74625, CVE-2026-74630, CVE-2026-74635, CVE-2026-74636, CVE-2026-74641, CVE-2026-74648, CVE-2026-74649, CVE-2026-74650, CVE-2026-74651, CVE-2026-74654, CVE-2026-74656, CVE-2026-74657, CVE-2026-74658, CVE-2026-74659, CVE-2026-74660, CVE-2026-74664, CVE-2026-74667, CVE-2026-74669, CVE-2026-74671, CVE-2026-74673, CVE-2026-74675, CVE-2026-74676, CVE-2026-74679, CVE-2026-74680, CVE-2026-74682, CVE-2026-74683, CVE-2026-74688, CVE-2026-74691, CVE-2026-74692, CVE-2026-74693, CVE-2026-74694, CVE-2026-74696, CVE-2026-74697, CVE-2026-74701, CVE-2026-74704, CVE-2026-74705, CVE-2026-74717, CVE-2026-74719, CVE-2026-74720, CVE-2026-74726, CVE-2026-74730, CVE-2026-80591, CVE-2026-80593, CVE-2026-80594, CVE-2026-80595, CVE-2026-80597, CVE-2026-80598, CVE-2026-80599, CVE-2026-80600, CVE-2026-80601, CVE-2026-80603, CVE-2026-80605, CVE-2026-80609, CVE-2026-80613, CVE-2026-80619, CVE-2026-80622, CVE-2026-80626, CVE-2026-80627, CVE-2026-80630, CVE-2026-80644, CVE-2026-80645, CVE-2026-80646, CVE-2026-80647, CVE-2026-80649, CVE-2026-80652, CVE-2026-80659, CVE-2026-80664, CVE-2026-80677, CVE-2026-80679, CVE-2026-80680, CVE-2026-80681, CVE-2026-80706, CVE-2026-80707, CVE-2026-80708, CVE-2026-80714, CVE-2026-80716, CVE-2026-80717, CVE-2026-80718, CVE-2026-80722, CVE-2026-80731, CVE-2026-80732, CVE-2026-80733, CVE-2026-80867, CVE-2026-80875, CVE-2026-80876, CVE-2026-80877, CVE-2026-80879, CVE-2026-80880, CVE-2026-80881, CVE-2026-80886, CVE-2026-80890, CVE-2026-80902, CVE-2026-89774)

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114) It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - User-space API (UAPI); - ARM32 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - Android drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Bluetooth drivers; - Cdrom driver; - Character device driver; - Hardware random number generator core; - TPM device driver; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - DAX dirext access to differentiated memory framework; - DMA engine subsystem; - FireWire subsystem; - Arm Firmware Framework for ARMv8-A(FFA); - ARM SCMI message protocol; - Intel Stratix 10 firmware drivers; - FPGA Framework; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - Intel Trace Hub HW tracing drivers; - I2C subsystem; - IIO subsystem; - IIO ADC drivers; - IIO Magnetometer sensors drivers; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Mouse) drivers; - IOMMU subsystem; - IRQ chip drivers; - LED subsystem; - Multiple devices driver; - Media drivers; - MemoryStick subsystem; - Multifunction device drivers; - Fastrpc Driver; - MMC subsystem; - MTD block device drivers; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - Texas Instruments network drivers; - MediaTek network drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - Parport drivers; - PCI subsystem; - Pin controllers subsystem; - Generic PM domains; - System reset/shutdown drivers; - Power supply drivers; - RapidIO drivers; - Voltage and Current Regulator drivers; - Reset controller framework; - S/390 drivers; - SCSI subsystem; - SLIMbus drivers; - SPI subsystem; - Media staging drivers; - Media Oriented Systems Transport (MOST) driver; - NVIDIA Tegra embedded controller (NVEC) staging driver; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - Trusted Execution Environment drivers; - Thermal drivers; - Thunderbolt and USB4 drivers; - TTY drivers; - USB DSL drivers; - Cadence USB3 driver; - USB Device Class drivers; - ULPI bus; - DesignWare USB2 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - USB ChaosKey driver; - Siemens ID Mouse USB driver; - IOWarrior USB driver; - LD Didactic USB driver; - LEGO USB Tower driver; - USS720 USB parallel port adapter driver; - MediaTek USB3 DRD driver; - USB Serial drivers; - USB Type-C support driver; - USB Type-C Port Controller Manager driver; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - vDPA drivers; - VFIO drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - Watchdog drivers; - Xen hypervisor drivers; - AFS file system; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - exFAT file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - HFS file system; - HFS+ file system; - Journaling layer for block devices (JBD2); - Network file system (NFS) client; - Network file system (NFS) server daemon; - NILFS2 file system; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - SMB network file system; - UDF file system; - XFS file system; - Key management; - Software nodes and device properties; - Glob pattern matching library; - KVM subsystem; - Networking core; - Netfilter; - Socket messages infrastructure; - Network sockets; - Memory Management; - Network traffic control; - IPv6 networking; - Bluetooth subsystem; - IP tunnels definitions; - IPv4 networking; - SCTP protocol; - XFRM subsystem; - io_uring subsystem; - IPC subsystem; - Audit subsystem; - BPF subsystem; - Control group (cgroup); - Kernel CPU control infrastructure; - Kernel exit() syscall; - Kernel futex primitives; - Locking primitives; - Scheduler infrastructure; - Signal handling mechanism; - Timer subsystem; - Tracing infrastructure; - Cryptographic library; - Debug objects infrastructure; - Resizable hashtable library; - Memory management; - 6LoWPAN network protocol; - IEEE 802 network protocols; - 9P file system network protocol; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - CAN network layer; - Ceph Core library; - Ethtool driver; - HSR network protocol; - IEEE802154.4 network protocol; - IFE protocol; - IUCV driver; - KCM (Kernel Connection Multiplexor) sockets driver; - Logical Link layer; - MAC80211 subsystem; - IEEE 802.15.4 subsystem; - Management Component Transport Protocol (MCTP); - MultiProtocol Label Switching driver; - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NetLabel subsystem; - NFC subsystem; - Open vSwitch; - Packet sockets; - Phonet protocol; - Packet sampling (psample); - Qualcomm IPC Router (QRTR); - RDS protocol; - SMC sockets; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - AppArmor security module; - Integrity Measurement Architecture(IMA) framework; - Apple Onboard Audio ALSA driver; - ALSA framework; - Generic PCM loopback sound driver; - FireWire sound drivers; - ESS Solo-1 ALSA driver; - HD-audio driver; - Simple audio multiplexer codec driver; - SoC Audio for Freescale CPUs drivers; - NVIDIA Tegra ASoC drivers; - USB sound devices; - Perf tools; (CVE-2023-54125, CVE-2023-54271, CVE-2025-22026, CVE-2025-23131, CVE-2025-39863, CVE-2025-39929, CVE-2025-39931, CVE-2026-23364, CVE-2026-31449, CVE-2026-31451, CVE-2026-31610, CVE-2026-31700, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-31715, CVE-2026-43064, CVE-2026-43216, CVE-2026-43219, CVE-2026-43350, CVE-2026-43355, CVE-2026-43491, CVE-2026-43492, CVE-2026-45850, CVE-2026-45930, CVE-2026-45991, CVE-2026-45999, CVE-2026-46003, CVE-2026-46021, CVE-2026-46026, CVE-2026-46038, CVE-2026-46052, CVE-2026-46056, CVE-2026-46065, CVE-2026-46069, CVE-2026-46078, CVE-2026-46086, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46103, CVE-2026-46116, CVE-2026-46159, CVE-2026-46160, CVE-2026-46169, CVE-2026-46180, CVE-2026-46191, CVE-2026-46193, CVE-2026-46196, CVE-2026-46208, CVE-2026-46252, CVE-2026-46291, CVE-2026-46292, CVE-2026-46299, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-52909, CVE-2026-52910, CVE-2026-52913, CVE-2026-52917, CVE-2026-52918, CVE-2026-52923, CVE-2026-52927, CVE-2026-52928, CVE-2026-52929, CVE-2026-52930, CVE-2026-52933, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939, CVE-2026-52942, CVE-2026-52943, CVE-2026-52947, CVE-2026-52948, CVE-2026-52977, CVE-2026-53080, CVE-2026-53090, CVE-2026-53131, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53139, CVE-2026-53146, CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53157, CVE-2026-53158, CVE-2026-53159, CVE-2026-53161, CVE-2026-53163, CVE-2026-53167, CVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53186, CVE-2026-53189, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53199, CVE-2026-53208, CVE-2026-53213, CVE-2026-53216, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53221, CVE-2026-53223, CVE-2026-53227, CVE-2026-53238, CVE-2026-53239, CVE-2026-53245, CVE-2026-53249, CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53273, CVE-2026-53275, CVE-2026-53325, CVE-2026-53329, CVE-2026-53331, CVE-2026-53332, CVE-2026-53337, CVE-2026-53339, CVE-2026-53352, CVE-2026-53354, CVE-2026-53355, CVE-2026-53356, CVE-2026-53357, CVE-2026-53358, CVE-2026-53381, CVE-2026-53382, CVE-2026-53383, CVE-2026-53385, CVE-2026-53388, CVE-2026-53391, CVE-2026-53392, CVE-2026-53393, CVE-2026-53397, CVE-2026-53398, CVE-2026-53399, CVE-2026-53400, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794, CVE-2026-63796, CVE-2026-63798, CVE-2026-63800, CVE-2026-63801, CVE-2026-63803, CVE-2026-63806, CVE-2026-63807, CVE-2026-63808, CVE-2026-63809, CVE-2026-63810, CVE-2026-63814, CVE-2026-63815, CVE-2026-63817, CVE-2026-63818, CVE-2026-63822, CVE-2026-63823, CVE-2026-63824, CVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830, CVE-2026-63831, CVE-2026-63833, CVE-2026-63834, CVE-2026-63835, CVE-2026-63836, CVE-2026-63867, CVE-2026-63868, CVE-2026-63870, CVE-2026-63875, CVE-2026-63887, CVE-2026-63888, CVE-2026-63889, CVE-2026-63890, CVE-2026-63891, CVE-2026-63892, CVE-2026-63893, CVE-2026-63895, CVE-2026-63897, CVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63908, CVE-2026-63912, CVE-2026-63913, CVE-2026-63914, CVE-2026-63915, CVE-2026-63916, CVE-2026-63917, CVE-2026-63919, CVE-2026-63920, CVE-2026-63921, CVE-2026-63922, CVE-2026-63924, CVE-2026-63925, CVE-2026-63926, CVE-2026-63927, CVE-2026-63928, CVE-2026-63930, CVE-2026-63931, CVE-2026-63933, CVE-2026-63934, CVE-2026-63942, CVE-2026-63947, CVE-2026-63948, CVE-2026-63954, CVE-2026-63956, CVE-2026-63957, CVE-2026-63960, CVE-2026-63961, CVE-2026-63964, CVE-2026-63967, CVE-2026-63971, CVE-2026-63975, CVE-2026-63976, CVE-2026-63984, CVE-2026-63985, CVE-2026-63990, CVE-2026-63991, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-64002, CVE-2026-64004, CVE-2026-64005, CVE-2026-64007, CVE-2026-64009, CVE-2026-64010, CVE-2026-64011, CVE-2026-64012, CVE-2026-64014, CVE-2026-64090, CVE-2026-64091, CVE-2026-64093, CVE-2026-64094, CVE-2026-64095, CVE-2026-64116, CVE-2026-64118, CVE-2026-64123, CVE-2026-64126, CVE-2026-64137, CVE-2026-64170, CVE-2026-64187, CVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64206, CVE-2026-64222, CVE-2026-64225, CVE-2026-64234, CVE-2026-64237, CVE-2026-64242, CVE-2026-64243, CVE-2026-64246, CVE-2026-64249, CVE-2026-64266, CVE-2026-64268, CVE-2026-64269, CVE-2026-64271, CVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276, CVE-2026-64277, CVE-2026-64279, CVE-2026-64296, CVE-2026-64298, CVE-2026-64299, CVE-2026-64301, CVE-2026-64303, CVE-2026-64304, CVE-2026-64306, CVE-2026-64312, CVE-2026-64313, CVE-2026-64315, CVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64329, CVE-2026-64330, CVE-2026-64331, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334, CVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338, CVE-2026-64340, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344, CVE-2026-64346, CVE-2026-64347, CVE-2026-64350, CVE-2026-64351, CVE-2026-64352, CVE-2026-64355, CVE-2026-64359, CVE-2026-64360, CVE-2026-64361, CVE-2026-64362, CVE-2026-64363, CVE-2026-64364, CVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373, CVE-2026-64374, CVE-2026-64375, CVE-2026-64379, CVE-2026-64380, CVE-2026-64381, CVE-2026-64390, CVE-2026-64401, CVE-2026-64403, CVE-2026-64408, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413, CVE-2026-64420, CVE-2026-64422, CVE-2026-64423, CVE-2026-64425, CVE-2026-64428, CVE-2026-64429, CVE-2026-64430, CVE-2026-64432, CVE-2026-64435, CVE-2026-64436, CVE-2026-64438, CVE-2026-64440, CVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444, CVE-2026-64445, CVE-2026-64446, CVE-2026-64448, CVE-2026-64450, CVE-2026-64452, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456, CVE-2026-64461, CVE-2026-64462, CVE-2026-64465, CVE-2026-64468, CVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64475, CVE-2026-64478, CVE-2026-64483, CVE-2026-64484, CVE-2026-64487, CVE-2026-64488, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496, CVE-2026-64497, CVE-2026-64500, CVE-2026-64503, CVE-2026-64504, CVE-2026-64505, CVE-2026-64510, CVE-2026-64512, CVE-2026-64514, CVE-2026-64524, CVE-2026-64527, CVE-2026-64528, CVE-2026-64529, CVE-2026-64530, CVE-2026-64532, CVE-2026-64533, CVE-2026-64534, CVE-2026-64535, CVE-2026-64536, CVE-2026-64537, CVE-2026-64538, CVE-2026-64540, CVE-2026-64541, CVE-2026-64543, CVE-2026-64544, CVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64548, CVE-2026-64549, CVE-2026-64550, CVE-2026-64551, CVE-2026-64553, CVE-2026-64554, CVE-2026-64560, CVE-2026-64562, CVE-2026-64563, CVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64569, CVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64576, CVE-2026-64578, CVE-2026-64579, CVE-2026-64582, CVE-2026-64583, CVE-2026-64584, CVE-2026-64593, CVE-2026-64594, CVE-2026-64599, CVE-2026-64600, CVE-2026-64602, CVE-2026-64604, CVE-2026-68088, CVE-2026-68090, CVE-2026-68091, CVE-2026-68104, CVE-2026-68106, CVE-2026-68111, CVE-2026-68115, CVE-2026-68117, CVE-2026-68121, CVE-2026-68123, CVE-2026-68125, CVE-2026-68127, CVE-2026-68129, CVE-2026-68131, CVE-2026-68135, CVE-2026-68137, CVE-2026-68140, CVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68144, CVE-2026-68151, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155, CVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68160, CVE-2026-68175, CVE-2026-68176, CVE-2026-68180, CVE-2026-68182, CVE-2026-68183, CVE-2026-68184, CVE-2026-68186, CVE-2026-68187, CVE-2026-68188, CVE-2026-68190, CVE-2026-68192, CVE-2026-68195, CVE-2026-68196, CVE-2026-68197, CVE-2026-68199, CVE-2026-68204, CVE-2026-68209, CVE-2026-68212, CVE-2026-68213, CVE-2026-68214, CVE-2026-68215, CVE-2026-68216, CVE-2026-68217, CVE-2026-68218, CVE-2026-68222, CVE-2026-68223, CVE-2026-68226, CVE-2026-68227, CVE-2026-68229, CVE-2026-68231, CVE-2026-68234, CVE-2026-68243, CVE-2026-68244, CVE-2026-68248, CVE-2026-68249, CVE-2026-68250, CVE-2026-68284, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299, CVE-2026-68300, CVE-2026-68301, CVE-2026-68304, CVE-2026-68309, CVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322, CVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327, CVE-2026-68328, CVE-2026-68331, CVE-2026-68333, CVE-2026-68335, CVE-2026-68338, CVE-2026-68340, CVE-2026-68349, CVE-2026-68350, CVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354, CVE-2026-68355, CVE-2026-68357, CVE-2026-68360, CVE-2026-68361, CVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68368, CVE-2026-68369, CVE-2026-68370, CVE-2026-68373, CVE-2026-68376, CVE-2026-68377, CVE-2026-68388, CVE-2026-68395, CVE-2026-68397, CVE-2026-68398, CVE-2026-68402, CVE-2026-68403, CVE-2026-68405, CVE-2026-68406, CVE-2026-68410, CVE-2026-68411, CVE-2026-68413, CVE-2026-68414, CVE-2026-68417, CVE-2026-68422, CVE-2026-68425, CVE-2026-68428, CVE-2026-68430, CVE-2026-68432, CVE-2026-68433, CVE-2026-68444, CVE-2026-68446, CVE-2026-68449, CVE-2026-68450, CVE-2026-68451, CVE-2026-68452, CVE-2026-68456, CVE-2026-68459, CVE-2026-68460, CVE-2026-68461, CVE-2026-68466, CVE-2026-68467, CVE-2026-68469, CVE-2026-68474, CVE-2026-68475, CVE-2026-68477, CVE-2026-68478, CVE-2026-68479, CVE-2026-68480, CVE-2026-72004, CVE-2026-72005, CVE-2026-72010, CVE-2026-72013, CVE-2026-72014, CVE-2026-72019, CVE-2026-72020, CVE-2026-72021, CVE-2026-72022, CVE-2026-72024, CVE-2026-72025, CVE-2026-72033, CVE-2026-72036, CVE-2026-72038, CVE-2026-72039, CVE-2026-72047, CVE-2026-72048, CVE-2026-72049, CVE-2026-72052, CVE-2026-72054, CVE-2026-72055, CVE-2026-72056, CVE-2026-72061, CVE-2026-72066, CVE-2026-72067, CVE-2026-72068, CVE-2026-72074, CVE-2026-72076, CVE-2026-72078, CVE-2026-72079, CVE-2026-72081, CVE-2026-72082, CVE-2026-72083, CVE-2026-72084, CVE-2026-72085, CVE-2026-72086, CVE-2026-72088, CVE-2026-72102, CVE-2026-72105, CVE-2026-72107, CVE-2026-72108, CVE-2026-72109, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115, CVE-2026-72116, CVE-2026-72117, CVE-2026-72118, CVE-2026-72119, CVE-2026-72120, CVE-2026-72121, CVE-2026-72122, CVE-2026-72123, CVE-2026-72124, CVE-2026-72125, CVE-2026-72126, CVE-2026-72129, CVE-2026-72133, CVE-2026-72135, CVE-2026-72136, CVE-2026-72138, CVE-2026-72140, CVE-2026-72146, CVE-2026-72153, CVE-2026-72159, CVE-2026-72160, CVE-2026-72163, CVE-2026-72164, CVE-2026-72165, CVE-2026-72166, CVE-2026-72167, CVE-2026-72171, CVE-2026-72181, CVE-2026-72182, CVE-2026-72192, CVE-2026-72193, CVE-2026-72194, CVE-2026-72195, CVE-2026-72197, CVE-2026-72215, CVE-2026-72218, CVE-2026-72219, CVE-2026-72223, CVE-2026-72224, CVE-2026-72225, CVE-2026-72226, CVE-2026-72228, CVE-2026-72229, CVE-2026-72230, CVE-2026-72231, CVE-2026-72232, CVE-2026-72233, CVE-2026-72234, CVE-2026-72235, CVE-2026-72238, CVE-2026-72240, CVE-2026-72241, CVE-2026-72245, CVE-2026-72247, CVE-2026-72250, CVE-2026-72251, CVE-2026-72256, CVE-2026-72264, CVE-2026-72265, CVE-2026-72267, CVE-2026-72268, CVE-2026-72269, CVE-2026-72270, CVE-2026-72271, CVE-2026-72272, CVE-2026-72274, CVE-2026-72275, CVE-2026-72276, CVE-2026-72282, CVE-2026-72289, CVE-2026-72296, CVE-2026-72297, CVE-2026-72298, CVE-2026-72306, CVE-2026-72307, CVE-2026-72310, CVE-2026-72314, CVE-2026-72316, CVE-2026-72319, CVE-2026-72322, CVE-2026-72326, CVE-2026-72339, CVE-2026-72347, CVE-2026-72348, CVE-2026-72349, CVE-2026-72350, CVE-2026-72351, CVE-2026-72371, CVE-2026-72374, CVE-2026-72378, CVE-2026-72389, CVE-2026-72392, CVE-2026-72396, CVE-2026-72400, CVE-2026-72406, CVE-2026-72409, CVE-2026-72414, CVE-2026-72418, CVE-2026-72421, CVE-2026-72422, CVE-2026-72428, CVE-2026-72433, CVE-2026-72435, CVE-2026-72441, CVE-2026-72447, CVE-2026-72448, CVE-2026-72450, CVE-2026-72459, CVE-2026-72460, CVE-2026-72466, CVE-2026-72476, CVE-2026-72479, CVE-2026-72481, CVE-2026-72483, CVE-2026-72484, CVE-2026-72489, CVE-2026-72491, CVE-2026-72492, CVE-2026-72502, CVE-2026-74255, CVE-2026-74256, CVE-2026-74262, CVE-2026-74265, CVE-2026-74267, CVE-2026-74276, CVE-2026-74279, CVE-2026-74280, CVE-2026-74281, CVE-2026-74282, CVE-2026-74283, CVE-2026-74284, CVE-2026-74287, CVE-2026-74288, CVE-2026-74292, CVE-2026-74293, CVE-2026-74295, CVE-2026-74297, CVE-2026-74305, CVE-2026-74312, CVE-2026-74313, CVE-2026-74320, CVE-2026-74321, CVE-2026-74327, CVE-2026-74329, CVE-2026-74330, CVE-2026-74331, CVE-2026-74339, CVE-2026-74340, CVE-2026-74346, CVE-2026-74348, CVE-2026-74349, CVE-2026-74351, CVE-2026-74359, CVE-2026-74363, CVE-2026-74376, CVE-2026-74379, CVE-2026-74382, CVE-2026-74384, CVE-2026-74390, CVE-2026-74394, CVE-2026-74395, CVE-2026-74398, CVE-2026-74399, CVE-2026-74402, CVE-2026-74408, CVE-2026-74410, CVE-2026-74416, CVE-2026-74424, CVE-2026-74426, CVE-2026-74427, CVE-2026-74438, CVE-2026-74443, CVE-2026-74444, CVE-2026-74453, CVE-2026-74455, CVE-2026-74456, CVE-2026-74457, CVE-2026-74458, CVE-2026-74459, CVE-2026-74460, CVE-2026-74461, CVE-2026-74463, CVE-2026-74464, CVE-2026-74465, CVE-2026-74467, CVE-2026-74468, CVE-2026-74469, CVE-2026-74471, CVE-2026-74473, CVE-2026-74475, CVE-2026-74478, CVE-2026-74480, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485, CVE-2026-74488, CVE-2026-74490, CVE-2026-74492, CVE-2026-74493, CVE-2026-74495, CVE-2026-74497, CVE-2026-74498, CVE-2026-74499, CVE-2026-74505, CVE-2026-74507, CVE-2026-74508, CVE-2026-74512, CVE-2026-74518, CVE-2026-74519, CVE-2026-74523, CVE-2026-74525, CVE-2026-74540, CVE-2026-74546, CVE-2026-74547, CVE-2026-74548, CVE-2026-74549, CVE-2026-74556, CVE-2026-74557, CVE-2026-74563, CVE-2026-74564, CVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74577, CVE-2026-74578, CVE-2026-74579, CVE-2026-74580, CVE-2026-74581, CVE-2026-74583, CVE-2026-74584, CVE-2026-74585, CVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74597, CVE-2026-74598, CVE-2026-74604, CVE-2026-74609, CVE-2026-74613, CVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74620, CVE-2026-74622, CVE-2026-74625, CVE-2026-74630, CVE-2026-74635, CVE-2026-74636, CVE-2026-74641, CVE-2026-74648, CVE-2026-74649, CVE-2026-74650, CVE-2026-74651, CVE-2026-74654, CVE-2026-74656, CVE-2026-74657, CVE-2026-74658, CVE-2026-74659, CVE-2026-74660, CVE-2026-74664, CVE-2026-74667, CVE-2026-74669, CVE-2026-74671, CVE-2026-74673, CVE-2026-74675, CVE-2026-74676, CVE-2026-74679, CVE-2026-74680, CVE-2026-74682, CVE-2026-74683, CVE-2026-74688, CVE-2026-74691, CVE-2026-74692, CVE-2026-74693, CVE-2026-74694, CVE-2026-74696, CVE-2026-74697, CVE-2026-74701, CVE-2026-74704, CVE-2026-74705, CVE-2026-74717, CVE-2026-74719, CVE-2026-74720, CVE-2026-74726, CVE-2026-74730, CVE-2026-80591, CVE-2026-80593, CVE-2026-80594, CVE-2026-80595, CVE-2026-80597, CVE-2026-80598, CVE-2026-80599, CVE-2026-80600, CVE-2026-80601, CVE-2026-80603, CVE-2026-80605, CVE-2026-80609, CVE-2026-80613, CVE-2026-80619, CVE-2026-80622, CVE-2026-80626, CVE-2026-80627, CVE-2026-80630, CVE-2026-80644, CVE-2026-80645, CVE-2026-80646, CVE-2026-80647, CVE-2026-80649, CVE-2026-80652, CVE-2026-80659, CVE-2026-80664, CVE-2026-80677, CVE-2026-80679, CVE-2026-80680, CVE-2026-80681, CVE-2026-80706, CVE-2026-80707, CVE-2026-80708, CVE-2026-80714, CVE-2026-80716, CVE-2026-80717, CVE-2026-80718, CVE-2026-80722, CVE-2026-80731, CVE-2026-80732, CVE-2026-80733, CVE-2026-80867, CVE-2026-80875, CVE-2026-80876, CVE-2026-80877, CVE-2026-80879, CVE-2026-80880, CVE-2026-80881, CVE-2026-80886, CVE-2026-80890, CVE-2026-80902, CVE-2026-89774)