Security and cryptography for 2026-10-28

NIST published final post-quantum transition guidance while certificate, TLS, and remote crash flaws drew urgent fixes across Python, Go, Godot, X.Org, and bioinformatics tools. Several high-severity issues landed in a single day of coordinated disclosures.

NIST releases final IR 8547 on post-quantum transition

NIST has published the final version of Interagency Report 8547. The document addresses transitioning to post-quantum cryptography standards and related federal directives. Operators and developers planning PQC migrations now have the completed reference.

emSign CA pulled from certifi after security incident

A security incident involving the eMudhra emSign root CA led to its removal from the certifi bundle. Python tools and interpreters released urgent updates to reduce man-in-the-middle exposure. Users whose TLS stacks depend on certifi should apply the refreshed packages.

Three TLS client-certificate bugs in GoAhead

Three TLS client certificate verification bugs were disclosed in GoAhead web server versions prior to 6.1.1. The flaws affect OpenSSL, LibreSSL, and Mbed TLS backends and carry CVSS scores as high as 9.1. Deployments still on older GoAhead releases need to upgrade.

Godot DTLS heap overflow enables remote crash

An unauthenticated remote heap buffer overflow was disclosed in the Godot 3.x and 4.x DTLS receive-callback path. The bug can crash both servers and clients. Networked Godot applications should obtain the corresponding fixes.

golang.org/x/net quadratic parsing flaws fixed

Go released golang.org/x/net v0.62.0, closing quadratic text-node and namespace handling vulnerabilities. Applications that parse untrusted markup with the package face reduced denial-of-service risk after the update. Maintainers should bump the dependency promptly.

X.Org coordinates fixes across five client libraries

X.Org issued coordinated security releases that resolve multiple CVEs in five core X client libraries. Desktop and embedded systems shipping these libraries require the updated packages. The advisory groups several distinct issues disclosed together.

Godot 4.x multiplayer spawn packet overflow

A remote denial-of-service was disclosed in Godot 4.x multiplayer through a 32-bit integer overflow on a crafted spawn packet sync_len value. Unauthenticated peers can crash clients or servers. Godot 4 multiplayer hosts should apply the available patch.

Stack overflow and other flaws fixed in samtools

Multiple vulnerabilities, including a high-severity stack overflow, were disclosed and corrected in samtools 1.24.x. Bioinformatics pipelines that accept untrusted SAM or BAM input should move to the patched releases. The issues were reported on the oss-security list.