Patches
Updates to install
Debian issues vim security update fixing 40 vulnerabilities
Debian advisory DSA-6600-1 covers 40 CVEs in Vim, spanning path traversal in the tar and zip plugins, buffer overflows and underflows, out-of-bounds reads and writes, crashes, and command or code injection. Several issues are reachable through netrw, NetBeans, completion, spell files and tag files, so the risk comes from opening untrusted content. Systems running Vim should install the Debian update.
Debian updates nss package to remove compromised eMudhra certificates
Debian Security Advisory DSA-6599-1 provides updated nss packages that remove three eMudhra root certificates: eMudhra emSign Root CA - G3, eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3. The advisory states that several eMudhra intermediate CA certificates were compromised, and the update removes the affected trust anchors from the system store.
Debian issues security update fixing multiple vulnerabilities in DPDK packet processing libraries
Debian Security Advisory DSA-6597-1 patches several vulnerabilities in the dpdk package, a library suite for fast packet processing. Depending on which features are enabled, crafted packets or malicious guest requests could trigger denial of service or memory corruption. Administrators running dpdk on Debian should apply the vendor update.
Microsoft fixes Windows 11 Remote Desktop failures affecting non-admin users with Administrator protection
Microsoft has resolved a Windows 11 issue where non-admin users could not connect over Remote Desktop to hosts with Administrator protection enabled, failing with error 0xC000000D and the message 'The token that was passed to the function is invalid.' The bug appeared after the 22 September non-security preview update KB5124010 or later, and affects Windows 11 24H2, 25H2, 26H1 and 26H2, with Windows Server not listed. The fix is in updates released on or after 28 October, including preview update KB5127936 for 25H2 and 26H2.
Cloudflare tracks exploitation and patching of eMudhra's weak intermediate CA keys
Cloudflare reports that eMudhra's eight intermediate private keys, one of which was simply the number 4, can be recovered from the public certificates, letting anyone forge certificates that unpatched clients not enforcing Certificate Transparency would accept. Cloudflare patched high-priority systems, including Pingora origin-facing proxies, within hours and logged about 22,000 handshakes using the weak keys, all refused where verification was enabled. About 160 handshakes carried forged certificates, one dated less than an hour after Mozilla's bug report went public, but they appeared to be servers' own default certificates rather than interception attempts.
HashiCorp fixes Nomad symlink escape and Boundary SSRF flaws in new security advisory
The Canadian Centre for Cyber Security has published advisory AV26-1106 covering HashiCorp vulnerabilities as of 29 October 2026. HCSEC-2026-52 affects Nomad, where dispatch payload writes can escape the allocation directory through symlinks. HCSEC-2026-54 affects Boundary, which is vulnerable to server-side request forgery in the Vault credential store. Administrators should review the vendor advisories and apply updates.
Google updates Chrome Dev channel to version 159.0.8130.0 on Windows, Mac and Linux
The Chrome Dev channel has been updated to 159.0.8130.0 for Windows, Mac and Linux. The notice points to the Git log for a partial list of changes and invites users to file bugs for any new issues. It mentions no security fixes or vulnerabilities.
Debian issues security update DSA-6598-1 for Thunderbird
Debian Security Advisory DSA-6598-1 provides a security update for the Thunderbird mail client. It addresses multiple security issues that could allow arbitrary code execution or information disclosure. Administrators running Debian-based systems with Thunderbird should apply the update.
Attackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 after October patch
CVE-2026-101767 is an unauthenticated SQL injection in Oracle E-Business Suite's Thin Client Framework servlet that chains to remote code execution, with a CVSS score of 9.8. Oracle patched it in its October 2026 Critical Patch Update, and Defused Cyber decoys recorded exploratory exploitation on 27 October. The Canadian Centre for Cyber Security has updated its advisory to say open source reporting indicates exploitation in the wild.
Google releases Chrome 156 stable security update fixing 52 flaws, including critical bugs
Chrome Stable 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux addresses 52 security issues, several rated critical, including CVE-2026-118331 in FileAPI and CVE-2026-118306 in FileSystem. ChromeOS 16836.30.0 (Browser 156.0.8078.77) is rolling out to Stable devices with its own list of fixes, and Beta and Dev channels have also received ChromeOS 157 builds.