Every 24 hours
Tech News
Original reporting on what changed in security, rewritten in full and dated with the day the story broke. Each edition adds at least four articles and skips a topic already covered.
Oct 14, 2026
Critical Vulnerabilities Found in YAML-LibYAML Affecting Ubuntu Users
Recent vulnerabilities have been identified in YAML-LibYAML, a library used for parsing YAML files, which poses significant risks to users of Ubuntu 16.04 LTS and 18.04 LTS. Security researcher Dominique Dumont uncovered that the library mishandles certain reflection operations, which could allow an attacker to delete files if a user or system is deceived into opening a maliciously crafted file. This vulnerability is tracked under CVE-2017-20285.
In addition to this, another critical issue was found where YAML-LibYAML fails to parse specific documents correctly, enabling attackers to potentially execute arbitrary code on the affected systems. This vulnerability is listed as CVE-2019-25777 and highlights the importance of cautious file handling in environments using these Ubuntu versions.
Moreover, a regular expression within YAML-LibYAML is vulnerable to catastrophic backtracking, which can lead to denial of service conditions. This issue, identified as CVE-2026-63676, poses further risks, particularly for automated systems that might inadvertently process maliciously crafted YAML files.
The implications of these vulnerabilities are significant, as they could lead to unauthorized access, data loss, or service interruptions for users relying on these Ubuntu versions. Administrators and users are urged to apply necessary patches and updates to mitigate these risks. As cyber threats evolve, maintaining vigilance and ensuring systems are up to date is critical to safeguarding against exploitation.
Oct 14, 2026
New psqlODBC Release Addresses Critical Security Vulnerability
The psqlODBC team has announced the release of version 18.00.0005, which addresses a significant security vulnerability identified as CVE-2026-109448, alongside fixing two additional bugs. This update is crucial for all users of the official ODBC driver for PostgreSQL, as the identified vulnerability could lead to heap memory corruption when applications attempt to bind more than 32,767 parameters in a single SQL statement. The CVSS 3.1 base score for this vulnerability is rated at 5.9, indicating a medium level of severity.
The vulnerability arises from the way psqlODBC stores the number of bound parameters in a signed 16-bit field. If an application binds more than the stipulated limit, the driver may overwrite memory, potentially causing crashes or corrupting the application's operation. This issue particularly affects applications that allow untrusted inputs to dictate the number of parameters, such as those dynamically generating SQL statements.
With the release of version 18.00.0005, the psqlODBC driver now rejects attempts to bind more than 32,767 parameters, effectively mitigating the risk of memory corruption associated with this vulnerability. Users are strongly advised to upgrade to the latest version to ensure their applications remain secure. For those unable to upgrade immediately, it is recommended to limit the number of parameters sourced from external inputs or to utilize alternative methods for passing long value lists.
The psqlODBC team has acknowledged Richard Kuesters for reporting this issue, highlighting the importance of community involvement in identifying and resolving security concerns. As cyber threats continue to evolve, maintaining updated software and adhering to best practices in application security is essential for protecting sensitive data and ensuring system integrity.