GRUB lockdown bypass, Storm credentials, GPG retrospective

Security & Cryptography2026-09-14

Disclosures on the oss-security list covered a lockdown bypass in GNU GRUB, a ZooKeeper credential leak in Apache Storm, and a retrospective on earlier GPG failures. The reports concern boot security, distributed computing credentials, and OpenPGP design.

GRUB 2.14 lockdown bypass in Canonical-signed EFI

A single-message disclosure reports a serial-MMIO lockdown bypass in GNU GRUB 2.14 that affects the Canonical-signed gcdx64.efi binary. The issue allows bypassing lockdown protections in that signed EFI image. Operators using Canonical GRUB under Secure Boot have reason to review exposure and any available fixes.

Apache Storm ZooKeeper credential disclosure

CVE-2026-82434 covers disclosure of the Topology ZooKeeper credential to read-only users and to logs in Apache Storm Nimbus and the Apache Storm client. The leak affects the 3.0.x series. It is fixed in 3.1.0, so deployments still on 3.0.x should plan an upgrade.

Retrospective by the gpg.fail authors

The authors of gpg.fail posted a retrospective on prior GPG issues that adds a new proof of concept and critiques the OpenPGP packet format. The note revisits problems previously discussed on oss-security. OpenPGP implementers gain further analysis of packet handling weaknesses.