Vim RCEs, unpatched GCP k8s flaws, McEliece attack claims

Security and cryptography traffic focused on two fresh Vim remote code execution bugs and public disclosures of still-unpatched credential and secret flaws in Google Kubernetes components after 90 days of vendor silence. A heated NIST PQC forum thread also examined a claimed quasipolynomial attack on Classic McEliece alongside Ideal Cipher model disputes for additional signature schemes.

Vim command execution via Rmd syntax highlighting

An oss-security report discloses command execution in Vim before 9.2.1178 through crafted R Markdown syntax highlighting chunks. On Unix the issue bypasses a globpath filter. Users who open untrusted Rmd files should upgrade before relying on syntax highlighting.

Unpatched credential leak in cloud-provider-gcp

A researcher publicly disclosed an unpatched credential-logging flaw in Kubernetes cloud-provider-gcp (auth-provider-gcp) and requested CVE CAN-2026-2039459. The notice followed 90 days of vendor silence. GCP-backed clusters may be writing credentials into logs until a patch appears.

Cross-namespace secret exfiltration in k8s-config-connector

The same reporting wave covers an unpatched cross-namespace secret exfiltration flaw in GoogleCloudPlatform/k8s-config-connector, with CVE request CAN-2026-2039460. Disclosure came after 90 days without a vendor fix. Operators running the connector risk secret leakage across namespaces.

Quasipolynomial attack claims on Classic McEliece

A new eprint asserting a quasipolynomial distinguisher and heuristic decryption for Classic McEliece drove a long, heated NIST PQC forum thread. The discussion also contained a disclosure dispute involving Apon. The claims directly test the security margin of a leading code-based post-quantum candidate.

Vim arbitrary code execution via Ruby omni-completion

A separate Vim advisory reports arbitrary code execution in rubycomplete.vim for versions before 9.2.1177. The root cause is unsanitized eval on buffer text. Ruby completion users need the 9.2.1177 update.

FreeType 2.15.0 fixes three CVEs

FreeType 2.15.0 was announced with fixes for three CVEs. Two of those vulnerabilities were omitted from the project's own release notes. Font stacks should adopt the release to close the gaps.

OpenPGP packet grammar proposals after gpg.fail

Authors of the gpg.fail work published a retrospective, prompting an oss-security thread with concrete proposals to tighten OpenPGP packet grammar. The aim is to reduce parsing ambiguities that enabled earlier attacks. Library maintainers now have specific hardening directions to evaluate.

Ideal Cipher assumptions in SDitH and MQOM

Official comments on the NIST PQC forum debated whether Ideal Cipher Model assumptions for AES and Rijndael-256 remain conservative inside the EUF-CMA proofs of SDitH and MQOM. The exchange affects confidence in those Round 3 additional signature candidates. Cryptographers tracking the process will want the technical details.