HAWK withdrawal, Emacs ACE, and Linux LPEs

Post-quantum signature candidate HAWK was withdrawn after a lattice attack, while incomplete Emacs fixes and four Linux local privilege escalations led the day's disclosures. OpenStack, Apache, and Perl components also reported configuration injection, authorization gaps, and command execution issues.

HAWK withdrawn after dimension-halving lattice attack

An AI-assisted lattice attack presented on the pqc-forum reduces HAWK-n key recovery to SVP in dimension n/2 + 1. Anthropic researchers demonstrated the reduction, which effectively halves the relevant lattice dimension. NIST subsequently saw official withdrawal of HAWK from the post-quantum signatures round, removing a remaining candidate from the standardization process.

Incomplete Emacs fix still permits arbitrary code execution

The fix for Emacs CVE-2024-53920 remains incomplete and continues to allow arbitrary code execution through flymake and other modes. Discussion on oss-security noted the residual path and requested a new CVE. Users of affected Emacs configurations face ongoing risk until a complete remediation lands.

Four Linux kernel local root vulnerabilities disclosed

Researchers published DirtyAH6, PPPoEject, TUNderflow, and DiagSpill, four local privilege escalation flaws in the Linux kernel (CVEs including 2026-80844). The post-embargo report supplied commit hashes, prerequisites, and pointers to fixes already present in stable trees. Administrators can match the commits against running kernels to determine exposure and apply updates.

OpenStack Octavia HAProxy injection yields RCE

OpenStack advisory OSSA-2026-039 describes unauthenticated HAProxy configuration injection through listener, pool, and L7 fields in Octavia. The flaw leads to remote code execution. Operators running Octavia load balancers should treat the pending CVE as high priority and apply the forthcoming patches.

OpenStack Blazar lease API lacks object-level authorization

OSSA-2026-040 covers multiple authorization weaknesses in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854). Any authenticated user can enumerate, modify, or delete leases belonging to other projects. Cloud deployments that expose Blazar need immediate access-control hardening or upgrades.

Apache MINA proxy-class fix missing from older branches

CVE-2026-94301 notes that the resolveProxyClass remediation for CVE-2026-47065 was never backported to the 2.0.x and 2.1.x lines (specifically 2.0.30 and 2.1.14). Installations still on those branches remain vulnerable. Maintainers should move to a fixed release or apply an equivalent patch.

Perl Email::Sender Sendmail transport command injection on Windows

CVE-2026-93012 affects Email::Sender::Transport::Sendmail versions before 2.602. On Windows, an envelope address that reaches the shell inside _sendmail_pipe permits arbitrary command execution. Windows-based mail-sending applications using the module should upgrade promptly.

Apache Airflow session cookie overrides bearer token

CVE-2026-82355 reports that in Airflow 3.3.0 and 3.3.1 a session cookie silently overrides an explicit Authorization bearer header. The behavior enables session fixation under limited preconditions and is rated low severity. Operators on those point releases can mitigate by upgrading or tightening cookie handling.