HAWK withdrawn from NIST PQC; Postfix, bubblewrap, XZ, Artemis fixes

A lattice key-recovery result forced withdrawal of the HAWK post-quantum signature scheme from NIST's process. Separately, Postfix, bubblewrap, XZ Utils, and Apache ActiveMQ Artemis shipped fixes for smuggling, sandbox escape, memory safety, and pre-authentication broker flaws.

HAWK withdrawn after dimension-halving lattice attack

Discussion on the NIST PQC forum centered on a key-recovery attack against HAWK-n that reduces the problem to SVP in dimension n/2 + 1. The result, obtained with Anthropic AI-assisted lattice techniques, halves the effective dimension and prompted official withdrawal of HAWK from the NIST post-quantum signatures round. Implementers tracking PQC standardization lose one candidate and gain a concrete example of AI-assisted cryptanalysis changing security margins.

Postfix 3.11.7 fixes SMTP smuggling and remote crash

Postfix 3.11.7 and related legacy releases address SMTP smuggling and remote denial-of-service issues. The problems were reported by Qualys. Mail-server operators should upgrade to close the remote attack paths.

Bubblewrap 0.12.0 blocks writes outside the sandbox

Bubblewrap 0.12.0 fixes symlink traversal that allowed writes outside the sandbox during setup. The flaw affects Flatpak and received CVE-2026-87766. Desktop and container users relying on bubblewrap isolation need the update to keep filesystem boundaries intact.

Artemis pre-auth OpenWire queue deletion

Apache Artemis disclosed CVE-2026-67593: pre-authentication OpenWire protocol handling that can delete queues remotely. The issue spans a wide version range and is fixed in 2.57.0. Broker administrators should apply the release to prevent unauthenticated queue disruption.

XZ Utils 5.8.4 repairs invalid memory write

XZ Utils 5.8.4 corrects an invalid memory write in several decoders that could follow allocation failure and reinitialization. The bug sits in widely deployed compression code. Distributors and embedders of the library should ship the fixed release.

Artemis missing auth on CORE session reattachment

Apache ActiveMQ Artemis published CVE-2026-57967 for missing authentication on CORE protocol session reattachment. Unauthenticated parties can hijack sessions across multiple releases. Operators must upgrade to restore authentication on reattachment.

Artemis unauthenticated CORE queue creation

CVE-2026-49362 covers missing authentication in the CORE protocol handler of Apache ActiveMQ Artemis 1.x through 2.56, allowing unauthorized queue creation. Pre-authentication clients can alter broker state. Fixed versions close the path.

Artemis pre-auth cluster credential exposure

CVE-2026-49364 reports pre-authentication exposure of cluster credentials to discovered peers in Apache Artemis and ActiveMQ Artemis. Affected ranges include 2.50+ and 1.x-2.44. Cluster operators should update to stop credential leakage during discovery.