Security fixes and PQC updates for 2026-11-06

Security releases for core libraries and authentication tools led the day, alongside post-quantum cryptography proposals and breaks. Several disclosures cover widely deployed components that developers and operators rely on daily.

zlib 1.4 with buffer overflow fixes

zlib 1.4 has been released to address multiple buffer overflows and memory issues present in the 1.3.x series. The update targets a compression library used across countless applications and systems. Maintainers of software that links against zlib should move to the new version to close the reported flaws.

OpenSSH password bypass on musl

OpenSSH 10.6p2 corrects a password authentication bypass on musl libc systems that lack PAM. The problem arises because crypt(3) returns '*' for overly long inputs, enabling the issue labeled sshole. Administrators running such configurations need the patched release to restore proper authentication checks.

GodotSteam server peer ID spoofing

GodotSteam versions 4.17 through 4.23.2 contain a flaw that lets any multiplayer peer claim the server peer ID. A CVE has been assigned because the spoofed ID 1 can then issue authoritative commands. Developers integrating the plugin for multiplayer games must update to prevent unauthorized control of sessions.

Go 1.27.4 and 1.26.11 security pre-announcement

The Go team pre-announced minor releases 1.27.4 and 1.26.11 that will include 12 private security fixes. The updates cover undisclosed issues in the runtime and standard library. Go users should watch for the final packages and plan upgrades once they ship.

Open WebUI Windows installer key generation

The Open WebUI Windows installer derives the master key from the install-second timestamp in every release. Measurement of the resulting predictability was shared after CVE-2025-15603 was rejected. Windows deployments therefore start with weak key material and require regeneration from a stronger source.

ingress-nginx mirror-target self-DoS

CVE-2026-116472 describes a low-severity self-DoS via mirror targets in ingress-nginx, disclosed after the original project stopped maintenance. Only the SUSE fork carries a patch. Kubernetes operators still using the unmaintained code should evaluate the fork or alternative ingress controllers.

NIST plan for FN-DSA

NIST proposed a detailed FN-DSA signing specification that relies on fixed-point arithmetic together with KAT validation under FIPS 206. The outline advances the post-quantum signature scheme toward standardization. Implementers tracking PQC work will need to examine the fixed-point approach and validation requirements.

Practical breaks of remaining RLCE parameters

Two independent teams demonstrated practical breaks of the previously unbroken RLCE parameters where w equals n minus k, using the GIJS attack and releasing code. The results undermine the remaining candidate parameter sets of this code-based scheme. Post-quantum researchers must treat those parameter choices as insecure.