apt RCE, Node.js alerts, and RLCE break

Debian disclosed a remote code execution flaw in apt, while Node.js signaled high-severity fixes and researchers published a practical break of long-standing RLCE parameters. Several other projects, including Apache OFBiz, libtar, glibc, GodotSteam, and SQL-Abstract, also shipped or announced security updates.

Debian apt RCE via redirect and resume (CVE-2026-109518)

Debian published DSA 6607-1 for CVE-2026-109518, a remote code execution issue in apt. A man-in-the-middle attacker can abuse HTTP redirect and resume handling to replace a package that had already been verified, giving the flaw direct impact on package integrity for systems that fetch over untrusted paths.

Node.js pre-alert for high-severity November fixes

The Node.js project issued a security release pre-alert covering high-severity fixes planned for November 2026. The upcoming releases target the 22, 24, and 26 release lines, giving operators advance notice to schedule upgrades.

Practical key recovery against unbroken RLCE parameters

A post to the NIST PQC forum describes a practical key-recovery attack on RLCE parameter sets that had been presented as unbroken since round 1 of the NIST post-quantum process. The result removes a previous assumption of security for those concrete parameter choices.

Apache OFBiz patches twelve CVEs including pre-auth RCE

Apache OFBiz announced fixes for twelve CVEs. The set includes pre-authentication remote code execution and path traversal vulnerabilities, so deployments that expose OFBiz should treat the update as urgent.

Incomplete libtar fix leaves heap out-of-bounds read

A reporter showed that the earlier libtar fixes for CVE-2021-33643 and CVE-2021-33644 remain incomplete. Distro packages built from the supposedly patched code can still trigger a heap out-of-bounds read.

Glibc iconv hang on crafted BIG5-HKSCS input

The GNU C Library published an advisory for CVE-2026-122054, an iconv hang triggered by crafted BIG5-HKSCS input. The issue affects glibc versions 2.18 through 2.31.

GodotSteam peer-ID spoofing lets clients impersonate the server

An oss-security report covers GodotSteam 4.17 through 4.23.2. Any multiplayer peer can claim the server's peer ID, allowing a client to impersonate the server in affected games.

SQL-Abstract Perl module: three CVEs before 2.000001_04

Three CVEs were published against SQL-Abstract for Perl in versions before 2.000001_04. The issues include SQL injection and cross-site scripting, so applications that build queries with the module need the updated release.