The NetSec Observer Patch Watch Desk is the part of the NetSec Observer newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 79 articles so far. See the editorial policy or report an error.
Research reveals that malicious instructions in AI agent skills evade static code analysis, creating blind spots for credential theft and data exfiltration in development workflows.
A flaw in Pillow versions 5.3.0 through 12.x returns stale process memory as image pixels when decoding specific TIFF files, allowing data disclosure.
A high-severity flaw in follow-redirects versions 1.16.0 through 1.16.0.99 allows remote servers to harvest authentication headers when applications use array-based header formats.
Details on two critical PHP vulnerabilities have leaked online. The PHP project urges users to prepare for immediate patching due to mass exploitation risks.
An authenticated HTTP request can trigger arbitrary code execution in the X2000R router due to a flaw in the boa formUpload function.
An authenticated stack-based buffer overflow in the Totolink X2000R router allows remote attackers to execute arbitrary code via a crafted HTTP request.
A high-severity flaw in Astral uv versions before 0.8.22 lets attackers write files outside the intended directory via crafted symlinks in source distributions.
An authenticated HTTP request can trigger arbitrary code execution in the X2000R firmware due to stack-based buffer overflows in the DHCP DNS configuration function.
Authenticated attackers can trigger stack-based buffer overflows in the boa web server of Totolink X2000R routers to execute arbitrary code.
An unauthenticated flaw in the NativeChurch theme permits attackers to traverse directories and steal sensitive configuration files from exposed servers.
A critical missing authorization flaw in Kiro Crew allows WhatsApp group members to run arbitrary commands on operator machines unless configurations are locked down.
A missing circuit-breaker in Apache CouchDB versions prior to 3.5.3 allows replication targets to trigger infinite loops, leading to service disruption.
A high-severity flaw in the browser extension allows attackers to run code via malicious files, exposing users who open tainted documents on their systems.
ThreatBook launches a cloud platform that runs multiple AI agents simultaneously to find vulnerabilities and test attack paths in authorized targets.
A critical flaw in Signal's RingRTC library allows peers to saturate queues, preventing local hangups from tearing down audio and video tracks.
A crafted FlashPix file can crash or control Python applications using Pillow versions prior to 13.0.0 by overflowing memory buffers during image decoding.
A flaw in specific IBM access appliances allows nearby attackers to gain elevated privileges using static credentials stored within the system.
A flaw in Pillow versions prior to 13.0.0 allows zero-width images to trigger memory errors and crashes via morphology operations.
A memory corruption bug in older Pillow versions allows attackers to crash processes by triggering selective allocation failures during image transformations.
A command injection flaw in PingTools allows remote attackers to execute arbitrary code via the Watcher ICMP service host field.
A regex flaw in follow-redirects 1.16.0 allows sensitive headers to leak to attacker-controlled targets during cross-origin redirects.
A high-severity flaw in IBM MQ allows authenticated attackers to crash services or run code via malformed message handles.
A high-severity flaw in Apache Camel’s Smooks component allows attackers to read local files and probe internal networks via crafted XML messages.
Attackers can overwrite or delete JSON configuration files in Xinference 4.0.1 and earlier by injecting backslash sequences into model registration requests.