HAWK withdrawal and sandbox library fixes

A lattice attack forced withdrawal of the HAWK post-quantum signature scheme from NIST consideration. Several sandbox tools and core libraries also shipped fixes for privilege-escalation and parsing flaws.

HAWK withdrawn after dimension-halving lattice attack

An AI-assisted lattice attack reported on the pqc-forum reduces HAWK-n key recovery to the shortest-vector problem in dimension n/2 + 1. Anthropic researchers demonstrated the reduction, prompting official withdrawal of HAWK from the NIST post-quantum cryptography signatures round. Implementers tracking PQC standardization must reassess remaining candidates in light of the lowered security margin.

Flatpak 1.18.1 closes sandbox escapes

Flatpak 1.18.1 fixes multiple sandbox-escape and local-root vulnerabilities. CVEs were assigned after the original GHSA disclosure. Deployments that rely on Flatpak isolation should upgrade to block the privilege-escalation paths.

Glibc ld.so TOCTOU race enables local escalation

The GNU C Library issued an advisory for a time-of-check-to-time-of-use race in ld.so handling of $ORIGIN. The flaw permits local privilege escalation inside AT_SECURE binaries when protected_hardlinks is disabled. Systems running such binaries require the updated glibc packages.

Bubblewrap 0.12.0 stops out-of-sandbox writes

Bubblewrap 0.12.0 corrects a symlink-traversal bug during sandbox setup that allowed writes outside the intended root. CVE-2026-87766 was assigned and the issue affects Flatpak. Users of bubblewrap-based sandboxes need the new release for confinement integrity.

Libexpat 2.8.5 patches critical UTF-16 smuggling

Libexpat 2.8.5 resolves CVE-2026-93990, a malformed UTF-16 smuggling flaw rated CVSS 9.8 and similar to CVE-2022-25235. XML parsers built on libexpat are exposed to remote code-execution risk until updated.

Malware in Crypt::SelfCertificate CPAN module

Crypt::SelfCertificate versions 1.01 through 1.05 for Perl embed malware that fetches and runs Python code from an obfuscated URL. CVE-2026-95831 documents the supply-chain compromise. Perl environments must remove or replace the tainted releases.

OpenSSL pre-announces high-severity fixes

OpenSSL announced forthcoming security-fix releases scheduled for 29 September across multiple supported branches, with maximum severity rated High. Operators should plan timely upgrades once the packages appear.

xdg-dbus-proxy broadcast filter bypass

A broadcast-message filtering bypass affects xdg-dbus-proxy 0.1.6 and 0.1.7, a component used by Flatpak. The issue received a GHSA identifier and subsequent CVE assignment. Flatpak installations depend on a corrected proxy for proper D-Bus isolation.