AI & software security
-
Next.js patches conditional code-execution flaws and Server Actions denial of service
Next.js fixes two critical remote-code-execution issues affecting particular caching and SVG processing paths, alongside a separate denial-of-service flaw in App Router Server Actions.
-
Commons committee opens long-term inquiry into AI safety and security governance
MPs will scrutinise AI safety testing, incident reporting and company accountability through a continuing parliamentary inquiry, including the relationship to proposed cyber resilience rules.
-
Nextcloud built-in CODE proxy flaw exposes installations when local service is down
Collabora reports a critical unauthenticated command-injection flaw in the optional Nextcloud richdocumentscode app when its local CODE service is not running. Version 26.4.303 contains the fix.
-
Cisco Secure Email Gateway flaw is exploited as CERT-EU urges emergency fixes
Cisco confirms exploitation of a critical Secure Email Gateway vulnerability that can allow remote, unauthenticated file writes and root-level execution in affected appliances.
-
Access vs identity: The Native agent problem
Josh King, Chief Technology Officer at &above, argues that giving AI agents distinct identities solves only part of the security problem unless access rights, expiry, and accountability are addressed.
-
Ghostscript PDF flaw exposes servers that process uploaded documents
Security researchers have detailed a Ghostscript buffer overflow that could turn some PDF-processing workflows into a route to remote code execution, including through server-side previews.
-
Google releases Chrome desktop update addressing 37 security flaws
Google has released a Chrome desktop stable-channel update with 37 security fixes, including critical memory-safety vulnerabilities, for Windows, macOS and Linux.
-
Adobe October fixes cover Commerce and enterprise application security
Adobe has issued October security updates across products including Commerce and enterprise applications, with a Commerce hotfix and credential rotation recommended for a reported flaw.
-
Fortinet discloses critical path traversal flaw in FortiSIEM
Fortinet has published a critical FortiSIEM vulnerability that could allow unauthenticated attackers to execute unauthorised commands against affected security-monitoring deployments.
-
Rockwell patches ArmorBlock industrial I/O module vulnerabilities
Rockwell Automation has issued corrections for two vulnerabilities affecting 1732E ArmorBlock I/O hardware, including a weakness involving unauthorised password changes.