HAWK withdrawal and assorted security fixes

Post-quantum cryptography and open source security saw a lattice signature scheme exit the NIST process after a dimension-halving attack, alongside coordinated vulnerability batches in PHP, cJSON, Apache components, and industrial libraries. Operators and standards trackers face immediate patching and evaluation work across these disclosures.

HAWK withdrawn from NIST PQC signatures

Anthropic researchers described an AI-assisted attack that reduces HAWK-n key recovery to the shortest vector problem in dimension n/2 + 1, effectively halving the lattice dimension. The HAWK team withdrew the candidate from the NIST post-quantum cryptography signatures process as a result. Readers following PQC standardization should reassess remaining lattice-based options in light of the reduced security margin.

PHP coordinated security releases

PHP issued security releases on 30 July 2026 across four supported branches, fixing SQL injection, an out-of-bounds write, a crash, and libgd issues. Site operators and package maintainers need to deploy the updates to close the reported flaws.

Thirty-three vulnerabilities in cJSON

Public disclosure enumerated 33 vulnerabilities in the widely used cJSON library, many of them long-unpatched under inactive upstream maintenance. Projects embedding cJSON for JSON handling face sustained exposure until they migrate to maintained forks or replacements.

Apache Traffic Server fixes 38 vulnerabilities

Apache Traffic Server versions before 9.2.15 and 10.1.4 contain 38 vulnerabilities, some scored CVSS 10, now addressed in the new releases. Deployments of the caching proxy should upgrade promptly to eliminate the high-severity issues.

Superset chart update authorization bypass

Apache Superset disclosed CVE-2026-23981, an improper authorization flaw that lets users with chart edit rights modify dashboards without write permission through the REST API. Administrators should apply the fix to prevent unauthorized dashboard changes.

open62541 OPC UA library CVEs

A CISA-coordinated advisory reported four CVEs in the open62541 OPC UA library, with fixes already present in v1.3.19 and later. Industrial and automation systems relying on the library need to confirm they run patched builds.

GNOME security process changes

GNOME shortened its vulnerability embargo to 30 days, stopped forwarding reports to projects that ban AI contributions, and lost its security coordinator. The shifts alter how GNOME component flaws are triaged and disclosed going forward.

Superset SQL parser ReDoS

CVE-2026-23985 covers an authenticated regular expression denial of service in the Apache Superset SQL parser in versions before 6.0.0. Operators should upgrade to remove the availability risk.