MeridianMeridian

BIND DNS Servers Receive Patches for 14 Vulnerabilities Including High-Severity DoS Flaws

The Internet Systems Consortium has released BIND 9 updates that address 14 vulnerabilities across multiple versions of the widely used DNS server software. Seven of the issues received a CVSS score of 7.5 and were rated high severity, while the remaining seven scored between 5.3 and 6.5. The most critical flaw allows an unauthenticated attacker to crash the named process with a single malformed SIG(0) request over DNS over HTTPS. Additional vulnerabilities enable cache poisoning through forged NXDOMAIN responses, downgraded secure delegations, and acceptance of unsigned answers, as well as resource exhaustion via uncontrolled cache growth and excessive CPU consumption. Affected releases span BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25. No workarounds exist, making immediate upgrades to versions 9.20.29, 9.21.26, or 9.20.29-S1 the only mitigation. The ISC reports no known exploitation in the wild and none of the flaws appear in CISA’s Known Exploited Vulnerabilities catalog.

BoletimSecTranslated from Portuguese

Read at source

The Internet Systems Consortium has published an update for BIND 9 that resolves 14 vulnerabilities in the world’s most widely deployed DNS server software. Seven of the flaws received a CVSS score of 7.5 and were classified as high severity, while the remaining seven scored between 5.3 and 6.5.

BIND performs the critical function of translating domain names into IP addresses. When the service stops or returns incorrect answers, the impact extends far beyond the individual server and affects every service that depends on name resolution.

The most severe issue permits an unauthenticated remote attacker to terminate the named process with a single request that carries an invalid SIG(0) signature over DNS over HTTPS. The majority of the corrected vulnerabilities do not require authentication. Several others open avenues for cache poisoning: one allows acceptance of a forged NXDOMAIN response, another downgrades secure delegation so that an unsigned answer is accepted, and a third permits out-of-zone data to be served as authoritative.

Additional problems include resource-exhaustion conditions that cause uncontrolled cache growth and excessive CPU usage, as well as integrity issues during multi-message zone transfers.

Affected versions are BIND 9.11.0 to 9.18.50, 9.20.0 to 9.20.27, and 9.21.0 to 9.21.25. Fixed releases are 9.20.29, 9.21.26, and the preview-supported 9.20.29-S1. No workarounds are available for any of the flaws. The ISC states it is not aware of any exploitation of the vulnerabilities, and none have been added to CISA’s catalog of known exploited vulnerabilities. Organizations still running the 9.18 branch are advised to plan migration to the 9.20 series.

CISADNS over HTTPSBIND 9Internet Systems ConsortiumSIG(0)
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

PHP Patched Against PHP2Shell: Save php -v Output as Potential Court Evidence
Vulnerabilities & Exploits

PHP Patched Against PHP2Shell: Save php -v Output as Potential Court Evidence

Two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, 2026, affecting the PHP core interpreter across all versions below 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The flaws, collectively called PHP2Shell, carry a CVSS 4.0 score of 9.2 and allow unauthenticated attackers to execute arbitrary code on servers running WordPress, 1C-Bitrix, Drupal, OpenCart, Laravel, and other frameworks. Official patches have been released, yet organizations must also restart PHP-FPM, web servers, and queue workers to fully eliminate the vulnerable code from memory. Russian regulators may impose fines up to 15 million rubles for personal data leaks stemming from unpatched instances, and courts will examine documentation proving when and how the vulnerabilities were addressed. Security teams are advised to preserve command outputs from php -v and php-fpm -v along with timestamps and responsible-party records. If signs of compromise are detected, logs must be retained before any remediation steps are taken, and notifications to Roskomnadzor must be filed within 24 hours of confirmed data exposure.

HabrOct 28, 2026Translated from Russian

Black October Hype: Media Inflates AI Agent Role in PHP, GitLab and Cloud Platform Incidents
Vulnerabilities & Exploits

Black October Hype: Media Inflates AI Agent Role in PHP, GitLab and Cloud Platform Incidents

A detailed analysis reveals that recent high-profile cybersecurity stories have been sensationalized by attributing autonomous AI agent swarms to standard vulnerability disclosures and human-operated attacks. Critical PHP zero-day flaws enabling remote code execution were responsibly researched with GPT-5.6 Sol under OpenAI's Patch the Planet program, not by rogue AI bots launching millions of scans. The Argentina hospital compromises involved human operators using Anthropic's Claude Code CLI tool in a Human-in-the-Loop workflow rather than uncontrolled AI rebellion. Breaches at Zeabur, Railway and OpenCode stemmed from poor secret management and forgotten consoles, allowing credential theft for API abuse. A decade-old integer overflow in GitLab's Onigmo regex engine received a CVSS 10.0 score but had no connection to AI. The piece argues that adding AI narratives boosts clicks while obscuring classic attack patterns such as masscan-driven scanning after public PoC leaks.

HabrOct 28, 2026Translated from Russian

Apple Patches 163 Vulnerabilities in iOS 27.2 Including Multiple WebKit Code Execution Flaws
Vulnerabilities & Exploits

Apple Patches 163 Vulnerabilities in iOS 27.2 Including Multiple WebKit Code Execution Flaws

Apple released iOS 27.2 and iPadOS 27.2 on October 26, addressing 163 vulnerabilities across its mobile platforms. More than 30 of these issues reside in the WebKit engine, with several enabling remote code execution simply by visiting a malicious webpage. The update also resolves two sandbox escapes, one in WebKit's process model and another in the App Store reported by Cisco Talos researchers. Four privacy-related fixes include a flaw in Apple Intelligence that could expose sensitive user data to remote attackers. On the same day, Apple issued iOS 18.7.11 for older devices such as the iPhone XS and XR, fixing a CoreGraphics out-of-bounds write tracked as CVE-2026-86950 that had already been exploited in a highly sophisticated targeted attack. The company stated that none of the 163 flaws in the main release have been observed in the wild.

BoletimSecOct 28, 2026Translated from Portuguese