Summary

In a recent article, ECTRA highlighted CVE-2026-98432 in the Linux kernel with a CVSS score of 9.8, as well as a leak of DHS employee data and 26,400 cloud/AI credentials that remain valid in public Gitee repositories. Linux servers, Apache Fineract, OpenStack, and systems with exposed credentials should be addressed first because their impact may be critical or immediately exploitable.

Linux Kernel TCP Vulnerability

  • CVE: CVE-2026-98432
  • Score: 9.8 out of 10 on the CVSS scale
  • Product and versions: TCP code in the Linux kernel; the article mentions Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions.
  • Impact: Anthropic stated on October 27 that its AI model wrote an exploit that takes advantage of this vulnerability, allowing an unauthenticated remote attacker to execute commands as root on a vulnerable Linux server.
  • Immediate action: Apply available kernel patches for the distribution in use and review server permissions and logs.

The Hacker News

DHS Employee Data Leak

  • Product and versions: Personal and work information belonging to U.S. Department of Homeland Security (DHS) employees and contractors, including CBP, ICE, HSI, CISA, and several other DHS agencies.
  • CVE and severity: No CVE or severity rating was mentioned.
  • Impact: More than 41,000 records were leaked online, containing names, work email addresses, phone numbers, job titles, office locations, and information about internal systems and applications accessible to each account.-existence of an online search tool and the leaked data also identifies officials involved in covert and undercover operations.
  • Immediate action: DHS stated that it is addressing the potential leak. Organizations and relevant parties need to review system access, check for data exposure, and strengthen this area.

SecurityWeek

SQL Injection in Apache Fineract: Search API

  • CVE: CVE-2026-64618
  • Severity: Critical
  • Product and versions: Apache Fineract through version 1.15.0.
  • Impact: The outStandingAmountPercentageCondition parameter at the /fineract-provider/api/v1/search/advance endpoint was not adequately neutralized, making SQL injection possible.
  • Immediate action: Upgrade to version 1.16.1, which fixes the issue.

oss-security mailing list

SQL Injection in Apache Fineract: ORDER BY

  • CVE: CVE-2026-65874
  • Severity: Critical
  • Product and versions: Apache Fineract through version 1.15.0.
  • Impact: The Center read endpoint (GET /api/v1/centers) and datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) directly incorporate the orderBy, sortOrder, and order sorting parameters into the SQL ORDER BY clause. Regex-based input validation can be bypassed, allowing authenticated users with read access to perform time-based blind SQL injection.
  • Immediate action: Upgrade to version 1.16.1.

oss-security mailing list

OpenStack keystonemiddleware access_rules Bypass

  • CVE: CVE-2026-115642
  • Product and versions: OpenStack keystonemiddleware; the article does not explicitly list the affected versions.
  • Impact: access_rules can be bypassed through X-Service-Token.
  • Immediate action: Apply patches for the relevant branches: 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, 2026.2/hibiscus, and 2027.1/indri (development).

oss-security mailing list

CPython Accepts Null Bytes in Host and Port

  • CVE: CVE-2026-116566
  • Severity: MEDIUM
  • Product and versions: CPython; the article refers to the CVE for the latest information on affected versions.
  • Impact: socket.getaddrinfo() accepts null bytes embedded in the host and port parameters.
  • Immediate action: Review the version information and changes in CVE-2026-116566 and PR python/cpython#160899, then apply the recommended actions.

oss-security mailing list

26,400 Cloud and AI Credentials Exposed on Gitee

  • CVE and severity: No CVE or severity rating was mentioned.
  • Product and versions: Public repositories on Gitee.
  • Impact: Researchers scanned 7.25 million public Gitee repositories and found 26,400 credentials that still worked when tested. Most were keys for cloud and AI services; anyone who copied the credentials from the code could potentially use them.
  • Immediate action: Revoke or rotate credentials that may have been copied, then remove secrets from repositories and commit history.

The Hacker News

Binance Security Incident

  • CVE and severity: No CVE or severity rating was mentioned.
  • Product and versions: Binance platform.
  • Impact: Binance stated that the security incident affected approximately $6.3 billion in assets, with nearly $3 billion in assets frozen on-chain. Tether and Circle stated that they had each frozen more than 1.567 billion USDT and 800 million, respectively, in connection with the incident.
  • Immediate action: Monitor affected accounts and assets and the status of frozen assets, and communicate updates with Binance.

The Hacker News

Checklist

  • [ ] Patch the Linux kernel and audit servers vulnerable to CVE-2026-98432.
  • [ ] Upgrade Apache Fineract to 1.16.1 for CVE-2026-64618 and CVE-2026-65874.
  • [ ] Apply the OpenStack keystonemiddleware patch for CVE-2026-115642.
  • [ ] Review the CPython version and follow up on changes for CVE-2026-116566.
  • [ ] Rotate and remove cloud/AI credentials found in public Gitee repositories.
  • [ ] Review system access permissions and DHS employee/contractor data.
  • [ ] Monitor Binance assets and accounts affected by the incident.

---

Sources summarized:

Read also