HAWK exit and Rails RCE top security disclosures

Post-quantum cryptography and widely deployed library flaws dominated the day's security traffic. HAWK's withdrawal from NIST consideration and a critical Rails Active Storage issue led the list, followed by stagnant maintenance in cJSON and several coordination and kernel reports.

HAWK withdrawn after dimension-halving lattice attack

An AI-assisted lattice attack attributed to Anthropic reduces HAWK-n key recovery to the shortest vector problem in dimension n/2 + 1. The result prompted HAWK's official withdrawal from the NIST post-quantum cryptography signatures round. Teams tracking PQC standardization should reassess remaining lattice candidates in light of automated cryptanalysis progress.

Rails Active Storage CVE allows file read and RCE

Rails published CVE-2026-66066, covering arbitrary file read and remote code execution in Active Storage variant processing through libvips. Attack details were released early after proof-of-concept code surfaced. Operators of Rails applications that process image variants need the updated packages.

Thirty-three unpatched vulnerabilities in cJSON

A detailed writeup enumerates 33 unpatched vulnerabilities in the widely vendored cJSON library. Project maintenance has stagnated, leaving the issues open. Downstream projects that embed cJSON should inventory their copies and evaluate patches or replacements.

GNOME shortens embargo and limits report forwarding

GNOME is reducing its security embargo period to 30 days and will stop forwarding reports to projects that ban AI tooling. The policy shift produced extended debate on oss-security. Maintainers who depend on GNOME coordination should adjust expectations for disclosure timelines.

MITRE rejects LLM-generated CVE submissions

MITRE rejected dozens of LLM-generated CVE reports against SQLite after JFrog determined the cited code did not exist. Parallel rejections covered submissions targeting libraw and ESP32-audioI2S, underscoring limits of the honor-system assignment process. The episode illustrates risks of automated vulnerability claiming without verification.

OVSwrap local-root flaw in Linux kernel OVS

Post-embargo disclosure described CVE-2026-64531, a local root vulnerability in the Linux kernel Open vSwitch path. Discussion also noted delays in the corresponding Ubuntu advisory. Hosts and containers that enable OVS should confirm they have the patched kernel.

Incomplete allowlist fix in Apache Kyuubi

Apache Kyuubi announced CVE-2026-62391, a bypass of kyuubi.session.local.dir.allow.list through unprefixed Spark file-conf aliases. The flaw arises from an incomplete remediation of the earlier CVE-2025-66518. Deployments exposing Kyuubi session configuration should apply the corrected release.

SQIsign parameters face continued isogeny analysis

Daniel J. Bernstein examined a new isogeny paper's concrete effects on SQIsign parameter choices. The comment forms part of the ongoing NIST PQC evaluation discussion. Groups assessing isogeny-based signatures should incorporate the revised security estimates.