Emacs RCE, Ceph auth bypass, and library fixes

Security reports on 2026-08-20 centered on code execution and authentication flaws across editors, storage, and libraries, alongside a post-quantum key format proposal. Multiple projects shipped patches for buffer overflows, authorization bypasses, and related issues.

GNU Emacs arbitrary code execution on file open

An arbitrary code execution vulnerability was reported in GNU Emacs 28.1 and later when opening a crafted file. Upstream has issued fixes and Gentoo has provided a backport. Users of the editor should update to avoid execution risks from untrusted files.

Ceph releases address high-severity authentication bypass

Ceph 20.2.4 and 19.2.6 were released with four security fixes, including a high-severity CephX AES-CBC authentication bypass rated CVSS 8.9. The updates target the distributed storage system. Cluster operators need the patches to prevent unauthorized access.

libgit2 1.9.5 and 1.9.7 fix buffer overflows

libgit2 versions 1.9.5 and 1.9.7 correct multiple vulnerabilities, including heap buffer overflows in revparse and PCRE plus credential handling on HTTP redirects. The library is used for Git operations in many applications. Integrators should upgrade to reduce overflow and credential exposure risks.

uutils coreutils stdbuf world-writable temp file A report describes uutils coreutils stdbuf creating a world-writable temporary file for LD_PRELOAD, unlike GNU coreutils. The behavior introduces a local attack surface in the Rust-based coreutils reimplementation. Packagers and users should review the temporary file handling.

NIST proposes seed-only key format for HQC-KEM

NIST proposes a seed-only key format for HQC-KEM in the upcoming FIPS 207 draft, differing from ML-KEM dual formats and citing interoperability feedback. The pqc-forum thread ran to 36 messages from 13 participants. Post-quantum implementers should track the format choice for key management.

Heap buffer overflow in libmspack Huffman decoder

A heap buffer overflow was reported in libmspack make_decode_table during Huffman decode table construction, with a CVE requested and details withheld. The library is used by ClamAV and cabextract. Dependent project maintainers should watch for the full advisory.

OpenStack Aodh and Watcher authorization bypasses

OpenStack disclosed OSSA-2026-036 covering Aodh cross-project alarm enumeration and Watcher webhook authorization bypass, with CVEs pending. The issues affect metering and optimization components. OpenStack deployers should prepare to apply the fixes.

Postfix releases fix medium-impact DoS and policy bugs

Postfix issued stable release 3.11.6 and legacy releases 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, and 3.5.27 fixing medium-impact denial of service and policy bypass bugs. The updates span current and older branches of the mail transfer agent. Administrators should install the new versions.