#red-hat
-
FreeIPA Vulnerability Chain Grants an Anonymous Client Administrator Rights
Red Hat has described a pair of defects that together let a client who has never logged in create its own Kerberos account in the directory and land in the administrators group. The fix ships in FreeIPA 4.13.4.
-
Critical Keycloak Vulnerability Lets Attackers Hijack Any Account via Password Reset
Red Hat and the Keycloak project have released patches for the critical flaw CVE-2026-18963 (CVSS 9.1): an unauthenticated attacker can take over any account, including an administrative one, by forcing the system to reset the password.
-
“KVM Chainsaw”: Cleaning Up the Kernel's “God Structure” in Linux 7.3
KVM maintainer Paolo Bonzini has merged into the next branch a patch series that splits the overloaded kvm_mmu structure into three parts. The work is slated for the Linux 7.3 development cycle.
-
GNOME Rethinks Its Vulnerability Handling Amid a Flood of AI-Generated Reports
The GNOME project is cutting its vulnerability disclosure window to 30 days and will stop forwarding AI-generated reports, while the person leading the effort steps down.