HAWK withdrawal and critical Rails, pip CVEs

A lattice attack forced the HAWK team to leave NIST's additional signatures process after key recovery was reduced to a much smaller SVP instance. Critical and medium CVEs also landed for Rails Active Storage, pip, OpenStack Neutron, and Nmap.

HAWK key recovery halved, team withdraws from NIST

An attack discussed on the PQC forum reduces HAWK-n key recovery to an SVP instance in dimension n/2 + 1, roughly halving the lattice dimension an adversary must solve. The HAWK team confirmed the result and withdrew the scheme from NIST's additional post-quantum signatures process. Readers tracking NIST PQC candidates lose one of the remaining lattice-based signature options.

Rails Active Storage CVE enables file read and RCE

Rails published CVE-2026-66066 against Active Storage variant processing. Unauthenticated attackers can trigger arbitrary file reads and potential remote code execution through libvips image variants. Deployments that expose Active Storage variant URLs without authentication should treat the issue as critical.

pip path traversal on malicious package indexes

CVE-2026-13346 covers an absolute path traversal in pip versions before 26.2 when downloading from a malicious index. The main practical impact is on pip download --only-binary, where crafted responses can write files outside the intended directory. Operators who point pip at untrusted indexes need the update.

OpenStack Neutron cross-project subnet mutation

OSSA-2026-032 (CVE-2026-55707) describes a flaw in Neutron's subnetpool onboarding API. An attacker with access to a shared network can mutate subnets belonging to other projects. Multi-tenant clouds that allow shared-network onboarding should apply the advisory fixes.

Nmap infinite-loop DoS via zero-length TCP options

A NotCVE advisory reports that Nmap 7.99 and earlier can enter an infinite loop in nselib/packet.lua when a scan target returns zero-length TCP options. The resulting remote denial of service already has a fix in the development tree. Scanner operators running older releases remain exposed until they upgrade.

Bitcoin mining concentration and post-quantum migration

A cryptography list thread revisited the concentration of Bitcoin hash power (roughly 62 percent across three pools) and the practical difficulty of migrating signatures under a post-quantum threat. The discussion adds no new protocol results but underscores ongoing governance and migration risks for large UTXO sets.

cBPF JIT spray hardening backports

Hardening patches against cBPF JIT spray speculative-execution attacks are now available as backports for Linux 6.1 and later stable kernels. The changes raise the bar for spray-based speculative gadgets in the classic BPF JIT. Distributors maintaining long-term kernels can pull the backports without waiting for a full rebase.

Node.js June 2026 security releases

Node.js published security updates across all active release lines for June 2026, with a minor correction to a link date on the oss-security list. Operators should align running instances with the newly tagged releases for their respective lines.