#Advisory

🔄 CSAF advisory updated (version 2.0.0)

VDE-2026-094
CODESYS Gateway Client - Uncontrolled Memory Allocation
CVE-2026-76992

Changes: Updated remediation category - fixed SL runtimes are now available, updated summary - typo corrected, formal adaptions.

HTML: https://www.certvde.com/en/advisories/VDE-2026-094/
CSAF JSON: https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-11_vde-2026-094.json

#OT #Advisory

Security Advisory: CVE-2025-71438 - Out-of-Bounds Read in GPAC/MP4Box

Processing a crafted AC-4 stream with an invalid `frame_rate_index` triggers an out-of-bounds read in `gf_odf_ac4_cfg_dsi_v1`, causing MP4Box to crash.

Summary:
The `gf_odf_ac4_cfg_dsi_v1` function in `odf/descriptors.c` uses a stream-supplied `frame_rate_index` to index into fixed-size lookup tables (`AC4_SAMPLE_DELTA_TABLE_48`, `AC4_MEDIA_TIMESCALE_48`). The function does not validate that the index is within bounds before performing the table lookup. A crafted AC-4 file carrying an out-of-range index (e.g., 15) causes an out-of-bounds read, ultimately resulting in a NULL dereference and process crash.

CWE:
CWE-125 - Out-of-bounds Read

Affected Component:
```
odf/descriptors.c:2179
Function: gf_odf_ac4_cfg_dsi_v1()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1617-g856674b22-master; commit `856674b226d6cbe28a941ad223be38194cbf7d37`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a specially crafted AC-4 stream file containing an invalid `frame_rate_index` value. Local access is required; the victim must invoke `MP4Box -dash 100 <crafted_file>` or any equivalent DASH segmentation command that triggers the AC-4 configuration descriptor parsing path.

Impact:
The out-of-bounds read leads to an immediate process crash (SEGV READ at address 0x000000000000), resulting in Denial of Service. No evidence of arbitrary code execution was observed.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
13eb5b76560aaf7813b865a2ad433258478e2695
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3303
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/50/50_gf_odf_ac4_cfg_dsi_v1_odf_descriptors_c_2179
- Fix: https://github.com/gpac/gpac/commit/13eb5b76560aaf7813b865a2ad433258478e2695

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

🔄 CSAF advisory updated (version 1.1.0)

VDE-2026-097
CODESYS Control Runtime - Improper Synchronization in Monitoring
CVE-2026-79625

Changes: Updated remediation category - fixed SL runtimes are now available, formal adaptions.

HTML: https://www.certvde.com/en/advisories/VDE-2026-097/
CSAF JSON: https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-12_vde-2026-097.json

#OT #Advisory

PHP CGI SAPI 8.4.26 Pointer Underflow Remote Code Execution https://packetstorm.news/files/236762 #advisory

Anomaly Silently Patches Critical RCE in OpenCode AI Agent

Anomaly silently patched a critical remote code execution vulnerability in its OpenCode AI agent that allowed malicious servers to hijack developer machines via PowerShell command injection. The flaw affects Windows and WSL users and was fixed in version 1.18.33 without a formal CVE or security advisory.

**If you use OpenCode on Windows or WSL, upgrade to version 1.18.33 or later immediately, because a malicious or hijacked MCP server can take over your machine and everything on it (code, SSH keys, cloud tokens). Until you can update, remove any remote MCP servers you don't fully trust from your OpenCode configuration, and check your developers' machines yourself, since security scanners won't flag this one.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/anomaly-silently-patches-critical-rce-in-opencode-ai-agent-k-u-t-k-o/gD2P6Ple2L

PHP Issues Emergency Warning for Critical Remote Code Execution Vulnerabilities

PHP is releasing emergency patches for two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The release follows a data leak that forced the development team to move the disclosure date earlier to limit exploitation.

**If you run any website or app built on PHP (WordPress, online shops, internal tools), install the emergency security updates as soon as they're released today at 14:00 UTC. Until you've patched, restrict access to internal PHP systems and admin pages to trusted networks only, and monitor your servers closely for unusual logins, new files or strange activity.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/php-issues-emergency-warning-for-critical-remote-code-execution-vulnerabilities-y-t-1-8-c/gD2P6Ple2L

🔒 New CSAF advisory published

VDE-2026-112
METTLER TOLEDO: STARe Software DB2 vulnerable component
CVE-2026-10109

A vulnerability identified as CVE-2026-10109 affects the external component IBM Db2 12.1.2 delivered with STARe v20.00. The vulnerability is associated with improper handling of the pre-authentication DRDA handsha…

HTML: https://certvde.com/en/advisories/VDE-2026-112/
CSAF JSON: https://mettler-toledo.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-112.json

#OT #Advisory

F5 Issues Emergency Patches for Critical NGINX Code Execution Flaws

F5 released emergency patches for three critical NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479) that allow unauthenticated remote code execution and denial-of-service attacks.

**If you run NGINX in any form (open-source web server, NGINX Plus, Ingress Controller, Gateway Fabric, or the NGINX WAF/App Protect products), install F5's latest security patches ASAP. If you can't patch, turn off Server Side Includes and asynchronous file I/O, and have your team remove alias directives that use $request_filename and switch regex maps to named captures until the patch is in.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/f5-issues-emergency-patches-for-critical-nginx-code-execution-flaws-p-9-m-u-w/gD2P6Ple2L

Apache SystemDS 3.5.0-SNAPSHOT Unauthenticated Java Deserialization https://packetstorm.news/files/236326 #advisory #exploit