Security and cryptography roundup for 2026-09-24

An AI-assisted lattice attack forced the withdrawal of the HAWK post-quantum signature scheme from NIST standardization. Multiple open source projects also shipped fixes for sandbox escapes, code execution, and related flaws.

HAWK withdrawn after dimension-halving lattice attack

Anthropic researchers demonstrated an AI-assisted lattice attack on HAWK that reduces key recovery to the shortest vector problem in dimension n/2 + 1. The result halves the effective dimension and prompted official withdrawal of the scheme from the NIST post-quantum cryptography signatures round. Developers tracking PQC candidates must drop HAWK and reassess any dependent designs.

GNU Emacs code execution on arbitrary file open

GNU Emacs 28.1 and later allow arbitrary code execution when a user opens an untrusted file. CVE-2026-96269 has been assigned and backports are available. Operators should apply the patches before handling external content.

xdg-dbus-proxy 0.1.9 closes Flatpak sandbox escape

xdg-dbus-proxy 0.1.9 fixes CVE-2026-94422, a D-Bus message filter bypass that enabled sandbox escape. The proxy is a core component of Flatpak isolation. Flatpak users need the update to restore the intended boundary.

Flatpak 1.18.1 patches sandbox escape and root escalation

Flatpak 1.18.1 addresses multiple CVEs that permitted sandbox escape and local root privilege escalation. The release restores container isolation guarantees. Deployments relying on Flatpak should upgrade immediately.

Kubernetes Windows subpath symlink enables NTLM coercion

Kubernetes disclosed CVE-2026-76654, a medium-severity issue in which subpath UNC symlinks on Windows nodes allow NTLM coercion. The flaw is limited to clusters with Windows nodes. Administrators of those nodes should apply the mitigation.

Apache Tomcat WebSocket security constraint bypass

Apache Tomcat announced CVE-2026-76183, an important bypass of security constraints on WebSocket endpoints affecting many supported versions. Applications that depend on Tomcat access controls for WebSockets are exposed. Upgrades are required to reinstate the constraints.

Tor 0.4.9.12 fixes OOM UAF and cache attacks

The Tor Project released 0.4.9.12 to correct a use-after-free in out-of-memory handling and attacks that leverage hostile cache descriptors. Relay operators are expected to upgrade. The changes close denial-of-service and potential compromise paths on the network.

Tomcat request-header mix-up from prior fix regression

Apache Tomcat disclosed CVE-2026-86350, a regression in the earlier CVE-2026-41293 fix that can mix request headers and enable HTTP request smuggling. The issue affects recent 9.x, 10.x, and 11.x releases. Sites running those versions need the corrected packages.