This is a security advisory for CVE-2026-91403, a critical JSSE vulnerability affecting Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The flaw is remotely exploitable over a network without authentication and is assigned CVSS v3.1 base score 9.1, with high impacts to confidentiality and integrity. Affected Java SE releases include 8u511 (and perf), 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1; GraalVM affected versions include 17.0.21, 21.0.13 and Enterprise 21.3.20. Exploitation can occur through APIs such as web services that feed data to the JSSE component and also applies to client-side sandboxed Java Web Start applications or applets that load untrusted code and rely on the Java sandbox.
Patches and installation guidance are provided via linked patch-availability documents and are issued only for product versions in Premier or Extended Support; users running unsupported releases are advised to upgrade to supported versions to receive fixes. The advisory provides a risk matrix using Oracle’s CVSS methodology, notes that secure protocol variants are implicitly affected when a protocol is listed, and indicates no external researchers were credited. The advisory was first released on 2026-10-21 and includes references to Oracle’s patch and vulnerability disclosure policies and related risk-matrix documentation.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Node.js released security updates for CVE-2026-111497, a high-severity flaw in its Brotli decoder that can cause memory leaks or arbitrary code execution. Vercel has deployed WAF rules and is updating managed runtimes; users outside Vercel should upgrade to the latest patched versions immediately. (vercel.com)
Mitmproxy has added a --emudhra option to enhance its functionality. The update involves changes across multiple files, including the changelog and core scripts. (github.com)
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Today's best Hacker News stories, summarized and screenshotted, one email a day.