Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

CVE-2026-118780

### Summary When a CA store created by `pki.createCaStore()` holds two or more certificates with the same subject name,

来源摘录 · GitHub Advisory

Forge: AES-GCM authentication bypass via unvalidated tagLength option

CVE-2026-119186

### Summary The AES-GCM mode in forge.cipher does not validate the tagLength option passed to start(). With a tagLength

来源摘录 · GitHub Advisory

PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

CVE-2026-119193

### Summary When PHPT tests are run with code coverage, PHPUnit 13.4.0 to 13.4.3 writes the code of each PHPT test to a

来源摘录 · GitHub Advisory

Dev Channel Update for ChromeOS / ChromeOS Flex

The ChromeOS Dev channel is being updated to OS version 16868.5.0 (Browser version 158.0.8127.5 ) for most ChromeOS devi

来源摘录 · Google Chrome Releases

From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through au

来源摘录 · Microsoft Threat Intelligence

This month in security with Tony Anscombe – October 2026 edition

The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out

来源摘录 · ESET

4 real? Tracking exploitation and patching of eMudhra’s weak keys

Four, just four: that’s the key to break into any unpatched connection on the Internet that is using eMudhra certificate

来源摘录 · Cloudflare Blog Security

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-83831

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

来源摘录 · NVD

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due...

CVE-2026-119977

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-acc

来源摘录 · GitHub Advisory

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site...

CVE-2026-116520

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / s

来源摘录 · GitHub Advisory

TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races

We present TextSeal2, a distortion-free watermark for large language models that keeps its signal under speculative deco

来源摘录 · arXiv cs.CR

Understanding and Mitigating Role Spoofing in LLMs

Despite growing capabilities, LLMs remain susceptible to prompt injections: malicious inputs that can manipulate or hija

来源摘录 · arXiv cs.CR

SEAL: Sealed Queries for Local Sanitization against Indirect Prompt Injection

Indirect prompt injection threatens local LLM agents through untrusted tool outputs, motivating defenses that suppress a

来源摘录 · arXiv cs.CR

Systematic Evaluation of Adversarial Jailbreaking Attacks and Defenses Across Seven Large Language Models

Large language models (LLMs) deployed in safety-critical settings must resist adversarial inputs designed to elicit harm

来源摘录 · arXiv cs.CR

ARBITRA: Robust Document-Level ATT&CK Extraction via Multi-Expert Argumentation

Cyber threat intelligence (CTI) reports describe adversary behavior in natural language, but converting them into struct

来源摘录 · arXiv cs.CR

AgentHeal: Evaluating Goal-Preserving Resource Recovery of Web Agents under Access Barriers

Large language model (LLM) agents have demonstrated strong capabilities in automating complex information-seeking and tr

来源摘录 · arXiv cs.CR

REALM: Identifying Minimal Task Assets for LLM Agents

Large language model (LLM) agents often receive access to more files, accounts, and services than a task requires. Promp

来源摘录 · arXiv cs.CR

Session-Bound Behavioral Watermarking for Autonomous LLM Agents

Large Language Model (LLM) agents are increasingly acting through Web interfaces and external tools. They produce trajec

来源摘录 · arXiv cs.CR

WebMaze: Defending Against LLM-Powered Web Scanners with Functionality-Coupled Deception

Large language models (LLMs) have enabled more effective vulnerability scanning of web applications. However, these capa

来源摘录 · arXiv cs.CR

GI-RTL-Fuzz: Grammar-Informed RTL Generation with LLMs for End-to-End Differential Simulator Fuzzing

Register-Transfer Level (RTL) simulators are fundamental to modern IC design workflows, yet like any complex software, t

来源摘录 · arXiv cs.CR