Classic McEliece attack claim and Perl CVEs

A claimed quasipolynomial attack on Classic McEliece drew technical scrutiny on the PQC forum, while two CVEs landed for obscure Perl modules. The cryptography item outweighs the small-library advisories in practical interest.

Claimed quasipolynomial attack on Classic McEliece

A paper discussed on the NIST PQC forum claims a quasipolynomial distinguisher and decryption attack against Classic McEliece. Team analysis concludes the approach is slower than standard attacks already considered against the scheme. Readers tracking post-quantum standardization should note that the claimed advance does not improve on existing cryptanalysis for practical parameters.

CVE-2026-75866 in Punk::OAuth2::Server for Perl

CVE-2026-75866 was published for Punk::OAuth2::Server versions through 0.03 on CPAN. The module can issue access tokens outside a client’s registered scopes and grant types because no authorization path reads those constraints. Operators of the little-used Perl OAuth2 server should treat token issuance as unconstrained by client registration data.

CVE-2026-75870 session cookie forgery in Punk for Perl

CVE-2026-75870 covers Punk versions before 0.18 for Perl. An empty default HMAC key allows session cookie forgery when a session is declared without a secret. Deployments that rely on the module’s session handling without setting an explicit secret are exposed to forged cookies.