Kernel bulk CVEs and Apache security disclosures

The Linux kernel CNA assigned 432 CVEs in roughly 30 hours, prompting debate over policy and update strategies, while several Apache projects disclosed authorization, denial-of-service, and injection flaws. Additional notices covered a Perl open-proxy issue, an Axis2 deserialization problem, and a cryptography list discussion of Bitcoin mining concentration.

Linux kernel CNA issues 432 CVEs

The Linux kernel CNA issued 432 CVEs over approximately 30 hours. Thread participants on oss-security examined the underlying policy, whether prioritization remains feasible at that volume, and practical update strategies. Kernel users must decide how to triage the list against their own configurations and risk tolerance.

Apache ActiveMQ authorization bypass

Apache ActiveMQ disclosed CVE-2026-61487, an authorization bypass that lets attackers evade ACLs via temporary composite destinations. The flaw affects the Broker, All, and core ActiveMQ components. Operators who rely on ActiveMQ access controls should treat the issue as important and apply the available remediation.

Apache ActiveMQ AMQP NIO denial of service

CVE-2026-59878 describes a moderate denial-of-service condition in the Apache ActiveMQ AMQP NIO connector caused by a negative frame size validation bypass. Fixed releases are 5.19.9 and 6.2.8. Deployments that expose the AMQP NIO path need the update to restore proper frame handling.

Apache Wicket XSS via Link URL breakout

Apache Wicket published CVE-2026-66390, in which crafted Link URL strings can escape a JavaScript sequence and enable cross-site scripting. The problem affects 9.x and 10.x releases and is corrected in 10.10.0. Applications built on those branches should upgrade to close the injection vector.

Open proxy in Plack::App::Prerender

CVE-2026-17552 covers an open-proxy flaw in Plack::App::Prerender versions before 0.3.0 for Perl. Unvalidated REQUEST_URI concatenation inside the call method permits proxying to an arbitrary host. Perl environments that load this module require the 0.3.0 update to prevent abuse.

Apache Axis2/Java deserialization

CVE-2026-66713 reports low-severity remote code execution through deserialization of untrusted data in Apache Axis2/Java Tribes clustering. The feature is disabled by default and was removed entirely as the fix. Installations that never enabled clustering remain unaffected.

Apache Wicket CSP header flaws

CVE-2026-66391 addresses leaked and missing Content Security Policy headers in Apache Wicket 9.x and 10.x. The issues are resolved in 10.10.0. Sites that depend on CSP enforcement within Wicket should apply the same upgrade used for the companion XSS fix.

Bitcoin mining concentration discussion

A cryptography list thread revisited Bitcoin security assumptions, noting that three pools currently control roughly 62 percent of hash rate and that post-quantum signature migration remains difficult. Participants weighed the implications for long-term network resilience. The exchange stayed technical and did not describe an active incident.