Posted by Hanno Böck on Sep 22 libheif has released another update with various security fixes: https://github.com/strukturag/libheif/releases/tag/v1.23.5 Pasting the relevant part of the release notes below. I believe this from the project's README is also relevant: "Project status (September 2026). libheif and libde265 are maintained by a single independent developer with almost no recurring funding, while 61 security advisories had to be investigated, fixed and...
Re: Vulnerabilities in libheif and libde265
About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/861
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Re: Flatpak 1.18.1 fixes multiple vulnerabilities
Posted by Simon McVittie on Sep 22 We've eventually been able to obtain CVE IDs for most of these (two are still pending). I requested CVE IDs from Github before we…
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Threat actors stole 170 private repositories using an OAuth token stolen from a former employee's computer through the TanStack npm supply chain attack.
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub…
Z.ai says sorry for slurping up your code, open sources ZCode
Chinese AI giant Z.ai has apologized after developers caught it pulling a Grok, packaging up and uploading user workspaces to cloud storage. In a case that’s highly…
Erlang security advisory (AV26-948)
Serial Number: AV26-948 Date: September 22, 2026 As of September 22, 2026, Erlang is affected by vulnerabilities in the following product: OTP 17.0 Prior to 27.3.4.18…
Public PoC Exposes Critical Veeam Agent Privilege Escalation
A Veeam Agent flaw lets local users gain SYSTEM privileges. A public PoC is available, raising the risk of exploitation on shared Windows systems. If you’re running…