HQC tweaks, OpenStack and LyX advisories

Post-quantum parameter discussion and several open-source security advisories dominated the Security and Cryptography section. HQC authors floated small changes while OpenStack and LyX published concrete fixes, and one AI-generated EFI report drew a process rebuke.

HQC authors propose parameter adjustments

Authors of the HQC post-quantum scheme posted a small update on the NIST pqc-forum proposing parameter tweaks aimed at attack margin and anonymity properties. Daniel J. Bernstein and John Mattsson questioned the stability of the changes and the timing relative to NIST's process. Readers tracking standardization should note the debate over whether late adjustments undermine confidence in the candidate.

OpenStack Octavia QoS policy lock flaw

An OpenStack Security Advisory (OSSA-2026-035) covers an unauthorized QoS policy deletion lock in Octavia, tracked as CVE-2026-74248. The issue can produce a denial-of-service condition; patches are available. Operators of Octavia load-balancing deployments need the update to restore proper policy handling.

LyX issues multi-version security fixes

The LyX project published a security advisory describing multiple vulnerabilities and shipping fixes in version 2.5.2 together with backports for older releases. Users of the LaTeX-oriented document processor should upgrade to close the reported issues.

AI-generated EFI advisory called non-issue

Solar Designer flagged improper handling on the distros list and a belated oss-security post of an AI-generated report claiming a fallback.efi/SBAT/memdisk bypass. The note characterizes the report as a non-issue. The thread underscores process expectations for vulnerability disclosure rather than a new exploitable flaw.