the xtralinux.org desk
The open web. On watch.
Brief, source-linked news about security, linux and open source — tracked and explained as it breaks, by the XtraLinux desk.
Latest entriesCitrix Patches 12 NetScaler and Secure Access Client Flaws, Including Console Authentication Bypass and Root Privilege Escalation
Citrix fixed 12 flaws across NetScaler ADC, Gateway, Console and Secure Access Client: memory-overflow DoS bugs up to CVSS 9.5, a 9.4 Console authentication bypass, and root escalation in the Linux client. No exploits known.
Check Point Gateways Under Active Attack: PHP2Shell Plus Gaia Privilege Escalation (CVE-2026-123039) Lead to TSGA Backdoor and ESXi Wiper
Unknown attacker chains PHP2Shell and Gaia privesc CVE-2026-123039 on unpatched Check Point gateways since October 30, deploying TSGA backdoor, webshells and an ESXi wiper. Fixed via JHF takes; EOS branches get a mitigation only.
Red Hat Quay CVE-2026-123710: Forged Signing Keys Give Attackers Registry-Wide Access to Private Container Images
Red Hat rates CVE-2026-123710 in Quay critical at 9.8: an anonymous token tricks key rotation into trusting an attacker key with no expiry, so forged tokens expose and overwrite private images. A 9.9 flaw leaks robot tokens.
Apache HTTP Server 2.4.71 Fixes Critical mod_http2 RCE CVE-2026-119618
CVE-2026-119618: a race condition in mod_http2 assign_headers() corrupts the heap and gives unauthenticated RCE on Apache 2.4.55-2.4.70 servers with HTTP/2; fixed in 2.4.71, HTTP/2 off is the mitigation.
wfx: 4,837 Hijacked GitHub Accounts Seed CI Secret Stealer Across Thousands of Repos
Stolen GitHub tokens have pushed a CI secret stealer (wfx) into thousands of repositories since November 10, via workflow injections and npm postinstall hooks that exfiltrate secrets and cloud credentials and survive rotation.
Node.js November 2026 Security Release Fixes 16 Flaws, Seven Rated High
Node.js 22.23.5, 24.22.3 and 26.13.1 close 16 vulnerabilities, seven high: HTTP/2 bugs that crash servers or leak other connections memory, an HTTPS flaw exposing TLS private keys, and TLS 1.2 mTLS bypasses. Updating is the only fix.
eMudhra Revokes Eight More Intermediate CAs After Script Exposed Their Private Keys
eMudhra revoked six TLS and two code-signing intermediate CAs late last week after an April 2025 script pulled their RSA keys from the HSM during a key transfer; it had told Mozilla the RSA issuers were unaffected.
X.Org Server 21.1.26 and Xwayland 24.1.15 Patch Eight Flaws: Out-of-Bounds Writes, Integer Overflows and Length Bypasses
X.Org Server 21.1.26 and Xwayland 24.1.15 (November 10) fix eight X server issues — crafted-EDID memory overruns plus bypassable size checks in Xv, XRes, XTest and glamor (CVE-2026-109091 to -109096, -109903, -109904).
Microsoft Patch Tuesday: 1,259 Flaws, Exploited Outlook Bug CVE-2026-124194 Lands on CISA KEV
Microsoft's November Patch Tuesday fixes 1,259 vulnerabilities, including an exploited Outlook flaw (CVE-2026-124194) that can leak NTLMv2 hashes via a crafted message file; CISA added it to KEV with a November 24 deadline.
CISA Adds Exploited Cisco BroadWorks and Openwave Webtop Flaws to KEV Catalog
CISA put CVE-2026-20320 (Cisco BroadWorks XXE) and CVE-2026-111793 (Openwave Webtop Media Transcoder) in the Known Exploited Vulnerabilities catalog on November 10, 2026, with federal patch deadlines of November 24.
Xen Orchestra Auth Bypass VSA-2026-062 Actively Exploited Toward XCP-ng Root Takeover
Vates rates VSA-2026-062 — an empty-object login-token auth bypass in Xen Orchestra with no CVE id yet — critical and actively exploited; fixes in XO 6.9.2/6.10.1 and xo-server 5.211.2/5.213.1.
Git 2.56.1 Fixes Code Execution via Malicious Repository Recursive Clones
Git shipped fixes for six vulnerabilities on November 10, 2026 — led by CVE-2026-111760, an integer truncation that lets a malicious repo execute code during a recursive clone; 2.56.1 plus backports to 2.50.2–2.55.1.