PQC McEliece analysis, KVM escape, BIND and Unbound CVEs

Security activity centered on claimed attacks against Classic McEliece and a cluster of vulnerability disclosures in KVM, BIND, Unbound, and Apache components. DNS resolvers and nested virtualization drew particular attention alongside post-quantum forum discussion.

Claimed holdout attacks on Classic McEliece

The pqc-forum analyzed new holdout attacks that claim key recovery on all Classic McEliece parameter sets below their stated security levels. Implementers and djb participated in the technical exchange. The discussion matters for anyone tracking NIST post-quantum candidates and code-based cryptography readiness.

KVM/arm64 guest-to-host escape

Public disclosure covered CVE-2026-89775, a guest-to-host escape in KVM/arm64 that arises from stage-1 walk truncation when nested virtualization is enabled. The flaw affects ARM64 hosts running nested guests. Operators of KVM infrastructure should evaluate nested virtualization exposure and apply fixes.

Fourteen BIND 9 vulnerabilities from ISC

ISC disclosed fourteen vulnerabilities in BIND 9 spanning use-after-free issues, assertion failures, and amplification risks. The CVEs include CVE-2026-19033, CVE-2026-19662, and a dozen others listed in the advisory. BIND administrators need the updates to limit denial-of-service and related impacts on authoritative and recursive servers.

Unbound 1.26.1 security release

Unbound 1.26.1 addresses multiple CVEs, among them a CRITICAL remote code execution via DNSKEY heap overflow. The release from the Unbound project closes several security items at once. Recursive resolver operators should prioritize the upgrade given the severity of the heap overflow.

Apache MyFaces unbounded request parsing DoS

Apache MyFaces published CVE-2026-76646, a denial of service via unbounded request parsing that affects versions 2.2.x through 4.1.x. Fixed releases are available. Deployments of the JSF implementation should move to the patched versions to avoid resource exhaustion.

gpg.fail authors retrospective

Authors of gpg.fail described a claimed zero-day remote code execution in gpgsm debug code and a libgcrypt RSASSA-PSS flaw. GnuPG maintainers discussed fixes and practical exploitability across the thread. The exchange supplies context for developers who rely on GnuPG and related cryptographic libraries.

Apache NiFi missing authorization in flow updates

CVE-2026-82561 covers missing authorization for components referenced in Apache NiFi flow update methods. The issue can permit unauthorized actions during flow management. NiFi operators should apply the corresponding authorization fixes.

Apache NiFi Registry path traversal

CVE-2026-87976 is a high-severity path traversal in Apache NiFi Registry versions 0.4.0 through 2.11.0, fixed in 2.12.0. The root cause is improper limitation of pathname in persisted extension bundles. Registry users should upgrade to block unauthorized file system access.