or1k.net
NetScaler Zero-Day, Rejetto HFS Flaw and OpenSSH 10.6: Digest for October 6, 2026
Citrix NetScaler zero-day CVE-2026-88779, Rejetto HFS session forgery CVE-2026-61500, and OpenSSH 10.6 release with post-quantum algorithms.
📰 NetScaler Zero-Day, Rejetto HFS Flaw and OpenSSH 10.6: Digest for October 6, 2026
• Citrix Patches NetScaler SAML Zero-Day Under Attack
• Rejetto HFS Forking Up Predictable Sessions for RCE
• Kubernetes Node Swap Gains GA in v1.34
• OpenSSH 10.6 Drops LZ77 to Fight Side-Channels
• Linux Kernel 7.3-rc6 Arrives on Schedule
• Mold 3.0 Linker Rewritten in Rust
• Linux ZRAM Splits Read and Write Streams
• Critical Atlassian Flaw Exposes Files Across 8 Products
• LibreOffice and OpenOffice ODB Flaw Runs Code on Open
• Google Pauses Open Source Bug Bounty Product Reports
• Linux 7.4 Adds Mainline Support for Google Tensor G5
• System76 Bans AI Code in COSMIC Pull Requests
• IBM and Red Hat Tout 400+ Vulnerabilities Found by AI
• Exchange Server Flaw Lets Users Read Mailboxes
• Realtek SDK Botnet Cling Abuses STUN for C2
https://or1k.net/digests/daily-digest-2026-10-06/
• Citrix Patches NetScaler SAML Zero-Day Under Attack
• Rejetto HFS Forking Up Predictable Sessions for RCE
• Kubernetes Node Swap Gains GA in v1.34
• OpenSSH 10.6 Drops LZ77 to Fight Side-Channels
• Linux Kernel 7.3-rc6 Arrives on Schedule
• Mold 3.0 Linker Rewritten in Rust
• Linux ZRAM Splits Read and Write Streams
• Critical Atlassian Flaw Exposes Files Across 8 Products
• LibreOffice and OpenOffice ODB Flaw Runs Code on Open
• Google Pauses Open Source Bug Bounty Product Reports
• Linux 7.4 Adds Mainline Support for Google Tensor G5
• System76 Bans AI Code in COSMIC Pull Requests
• IBM and Red Hat Tout 400+ Vulnerabilities Found by AI
• Exchange Server Flaw Lets Users Read Mailboxes
• Realtek SDK Botnet Cling Abuses STUN for C2
https://or1k.net/digests/daily-digest-2026-10-06/
or1k.net
Atlassian Zero-Day CVE-2026-21589 - LMCache RCE & Podman Conmon v3: Digest for October 7, 2026
Critical Atlassian CVE-2026-21589 file access and LMCache remote code execution vulnerabilities exploited in the wild, alongside Kubernetes cgroup v2 mandates.
📰 Atlassian Zero-Day CVE-2026-21589 - LMCache RCE & Podman Conmon v3: Digest for October 7, 2026
• Linux Backdoors Emulate Email Security Tools in Asia
• Kubernetes Drops the Hammer on Cgroup v1
• RTIPC Delivers Zero-Overhead Real-Time IPC for Linux
• Atlassian Data Center Flaw Sees Instant Exploitation
• FBI Warns FortiBleed Campaign Harvests 86k Credentials
• Raspberry Pi OS Desktop Finally Arrives for x86-64
• NVIDIA 615.78.08 Linux Driver Fixes Wayland and Latency
• OpenVPN 2.7.8 Patches Certificate and DCO Bugs
• Unpatched LMCache Flaw Allows Remote Code Execution
• Podman Community Kicks Off Rust-Based Conmon v3 Testing
https://or1k.net/digests/daily-digest-2026-10-07/
• Linux Backdoors Emulate Email Security Tools in Asia
• Kubernetes Drops the Hammer on Cgroup v1
• RTIPC Delivers Zero-Overhead Real-Time IPC for Linux
• Atlassian Data Center Flaw Sees Instant Exploitation
• FBI Warns FortiBleed Campaign Harvests 86k Credentials
• Raspberry Pi OS Desktop Finally Arrives for x86-64
• NVIDIA 615.78.08 Linux Driver Fixes Wayland and Latency
• OpenVPN 2.7.8 Patches Certificate and DCO Bugs
• Unpatched LMCache Flaw Allows Remote Code Execution
• Podman Community Kicks Off Rust-Based Conmon v3 Testing
https://or1k.net/digests/daily-digest-2026-10-07/
❤3
or1k.net
SonicWall CVE-2026-102255, Tmux 3.8 and Shai-Hulud Worm: Digest for October 8, 2026
SonicWall patches critical CVSS 10.0 SSRF CVE-2026-102255, a Shai-Hulud worm compromises the Tensorlake npm package, and Tmux 3.8 updates floating panes.
📰 SonicWall CVE-2026-102255, Tmux 3.8 and Shai-Hulud Worm: Digest for October 8, 2026
• SonicWall's Portal Flunks Basic Security with Third CVSS 10.0 SSRF
• TLD Hijackers Snatch Rogue Certificates for Google Domains
• Gentoo Needs New Infrastructure Sponsors After Supporters Pull Out
• Over Half a Million Active Credentials Rot on Public GitHub Repos
• IBM and Red Hat's $5B Lightwell Fixes 400 Unknown Java Flaws
• Tensorlake NPM Package Hijacked by Self-Propagating Worm
• HPE ProLiant Gen 13 Packs AMD EPYC 9006 and Hardened iLO 8
• Tmux 3.8 Boosts Floating Panes and Adds Automatic Themes
https://or1k.net/digests/daily-digest-2026-10-08/
• SonicWall's Portal Flunks Basic Security with Third CVSS 10.0 SSRF
• TLD Hijackers Snatch Rogue Certificates for Google Domains
• Gentoo Needs New Infrastructure Sponsors After Supporters Pull Out
• Over Half a Million Active Credentials Rot on Public GitHub Repos
• IBM and Red Hat's $5B Lightwell Fixes 400 Unknown Java Flaws
• Tensorlake NPM Package Hijacked by Self-Propagating Worm
• HPE ProLiant Gen 13 Packs AMD EPYC 9006 and Hardened iLO 8
• Tmux 3.8 Boosts Floating Panes and Adds Automatic Themes
https://or1k.net/digests/daily-digest-2026-10-08/
🥰1
or1k.net
AnyDesk Linux Exploit, NetScaler CVE-2026-107406 and Flathub AI Policy: Digest for October 9, 2026
AnyDesk Linux patch hides a pre-auth root exploit, Citrix NetScaler fixes CVE-2026-107406, and Flathub reverses its blanket ban on AI-generated apps.
📰 AnyDesk Linux Exploit, NetScaler CVE-2026-107406 and Flathub AI Policy: Digest for October 9, 2026
• Let's Encrypt moves to 64-day certificates in 2027
• AnyDesk's silent patch hides a pre-auth root exploit
• Critical Citrix NetScaler SAML bug opens door to RCE
• Anthropic launches free AI scanner for open-source code
• European Cyber Resilience Act makes private forks an expensive mistake
• CISA warns of Chinese state actors exploiting ancient bugs
• Flathub drops blanket AI ban for strict disclosure rules
• Seagate tries to squeeze Toshiba out of the hard drive market
https://or1k.net/digests/daily-digest-2026-10-09/
• Let's Encrypt moves to 64-day certificates in 2027
• AnyDesk's silent patch hides a pre-auth root exploit
• Critical Citrix NetScaler SAML bug opens door to RCE
• Anthropic launches free AI scanner for open-source code
• European Cyber Resilience Act makes private forks an expensive mistake
• CISA warns of Chinese state actors exploiting ancient bugs
• Flathub drops blanket AI ban for strict disclosure rules
• Seagate tries to squeeze Toshiba out of the hard drive market
https://or1k.net/digests/daily-digest-2026-10-09/
or1k.net
Python 3.15, KDE Frameworks 6.31.0 and Woodpecker CI 3.19: Digest for October 10, 2026
Python 3.15 lands with default UTF-8 and new built-ins, KDE Frameworks 6.31.0 drops, and Woodpecker CI 3.19 adds server-enforced agent labels.
📰 Python 3.15, KDE Frameworks 6.31.0 and Woodpecker CI 3.19: Digest for October 10, 2026
• Python 3.15 lands with UTF-8 default and new built-ins
• GhostAction campaign hits thousands of repos with fake security audits
• Solus starts relicensing package repos to clear path for aerynOS
• KDE Frameworks 6.31.0 arrives on schedule
• Woodpecker CI 3.19 locks down agent labels and fixes security bugs
• Glycin gets CMYK support for proper print color handling
• ICANN opens floodgates for over sixteen hundred new gTLDs
• FBI arrests another suspect linked to ShinyHunters contractor breach
• BentoPDF edits documents locally in your browser via WebAssembly
• QML Quick Editor plugin lands fully integrated in Qt Creator
https://or1k.net/digests/daily-digest-2026-10-10/
• Python 3.15 lands with UTF-8 default and new built-ins
• GhostAction campaign hits thousands of repos with fake security audits
• Solus starts relicensing package repos to clear path for aerynOS
• KDE Frameworks 6.31.0 arrives on schedule
• Woodpecker CI 3.19 locks down agent labels and fixes security bugs
• Glycin gets CMYK support for proper print color handling
• ICANN opens floodgates for over sixteen hundred new gTLDs
• FBI arrests another suspect linked to ShinyHunters contractor breach
• BentoPDF edits documents locally in your browser via WebAssembly
• QML Quick Editor plugin lands fully integrated in Qt Creator
https://or1k.net/digests/daily-digest-2026-10-10/
❤3
or1k.net
SPECviewperf 15.0.1, Let's Encrypt 64-Day Certificates and Deno: Digest for October 11, 2026
SPECviewperf 15.0.1 adds Arm support, Let's Encrypt cuts SSL lifetimes to 64 days, and Cloudflare acquires the Deno runtime team.
📰 SPECviewperf 15.0.1, Let's Encrypt 64-Day Certificates and Deno: Digest for October 11, 2026
• Cloudflare Buys Deno, Ceases Runtime Development in 2027
• Let’s Encrypt Cuts Default TLS Lifetimes to 64 Days
• Stable Kernels 7.2.10 and 6.18.56 Drop
• KDE Focuses on DAV Performance and Security in Q3 2026
• SPECviewperf 15.0.1 Adds Arm AArch64 Support on Linux
• Pebble Round 2 Starts Shipping After Delays
• VOXI UK Slashes Prices and Boosts 5G Data Allotments
https://or1k.net/digests/daily-digest-2026-10-11/
• Cloudflare Buys Deno, Ceases Runtime Development in 2027
• Let’s Encrypt Cuts Default TLS Lifetimes to 64 Days
• Stable Kernels 7.2.10 and 6.18.56 Drop
• KDE Focuses on DAV Performance and Security in Q3 2026
• SPECviewperf 15.0.1 Adds Arm AArch64 Support on Linux
• Pebble Round 2 Starts Shipping After Delays
• VOXI UK Slashes Prices and Boosts 5G Data Allotments
https://or1k.net/digests/daily-digest-2026-10-11/