ipv4: If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header.

Affected versions:
All versions above 2.6.27 unless they got a patch applied to them, many branches already got the patch backported to them:
• 5.10: through 5.10.271 → fixed in 5.10.272
• 5.15: through 5.15.222 → fixed in 5.15.223
• 6.1: through 6.1.189 → fixed in 6.1.190
• 6.6: through 6.6.158 → fixed in 6.6.159
• 6.12: through 6.12.112 → fixed in 6.12.113
• 6.18: through 6.18.56 → fixed in 6.18.57
• 7.2: through 7.2.10 → fixed in 7.2.11
• 7.3 release candidates: through 7.3-rc6 → fixed in 7.3-rc7

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.

If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits:
- a464d95
- 0fab003
- 94524b7
- a65f69e
- 32a8b0a
- f3e835a
- c3e3346
- 6785011

Intel 8087 chip introduced in 1980 significantly improved floating-point operations, with a speedup of almost 100 times over the 8086 processor. The microcode implementation of addition and subtraction involves complex logic to handle special cases such as infinities, zeros, and NaN values.

Broadcom’s legacy WPS Monitor software mishandles fragmented WPS setup messages carried over EAP. Its length checks don’t adequately constrain the reassembled message to the actual destination buffer.

Who’s affected?
Routers/access points using the vulnerable legacy Broadcom component, across both eCos and Linux firmware. Having a Broadcom chip alone does not establish vulnerability; the exact software and hardware revision matter.

device list (just some examples):
TP-Link: VR1600, TD-VG5612, Archer C3150, C5400, VR600, VR900, VR2800
Cisco: elected RV routers and WAP access points.

Broadcom stated that it replaced WPS Monitor with hostapd starting in 2018. Device owners need a firmware update from their OEM or ISP; older eCos-based products may have no migration path.

there is also no CVE assigned for this. Broadcom declined to request a CVE, stating that the affected software was obsolete and outside its support window.

go get go@1.27.3

sed -i \
  -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
  -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
  /etc/ca-certificates.conf && update-ca-certificates

low-severity CVEs:

CVE-2026-106070: Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation

CVE-2026-106071: Permission Model filesystem over-grant via wildcard radix lookup

CVE-2026-106073: Permission Model bypass with fs.realpathSync

This is an urgent request that requires your immediate attention tonight.
 
The PHP security team has issued an alert regarding two critical vulnerabilities in PHP, a language used by many websites.
 
Please verify whether your public-facing websites utilize PHP, and prepare to apply the security patches—scheduled for release tonight, October 21, at 11:00 PM (JST)—as soon as possible.
 
If applying the patches promptly proves difficult, temporarily taking your website offline is one effective measure to mitigate the risks.
 
Relevant information is also being shared via the X (formerly Twitter) account of the National Cyber ​​Coordination Office; please refer to that as well.
National Cyber ​​Coordination Office (Alerts & Warnings) (@cyber_forecast) / X