[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

confirmed (ISC and NLnet Labs advisories, Oct 21); no active exploitation reported

DNS resolver patch day: BIND 9.20.30 fixes a GSS-TSIG memory corruption that may allow RCE (CVSS 8.1); Unbound 1.26.2 fixes five bugs

ISC BIND 9 (Oct 21, upgrade to 9.20.30 or 9.21.27; ISC lists no workarounds and knows of no active exploits):

  • CVE-2026-94300 (8.1): replaying captured GSS-TSIG-signed UDP messages while the TSIG key is still valid, along with crafted queries to an attacker-controlled zone, can corrupt memory in named, with potential remote code execution. Affects 9.11.0 to 9.18.50, 9.20.0 to 9.20.29 and 9.21.0 to 9.21.26. Mainly relevant where GSS-TSIG (Active Directory-style dynamic updates) is used.
  • CVE-2026-19630 (7.5): unbounded processing of certain inbound message structures lets one message exhaust CPU and memory on a resolver.
  • CVE-2026-96888 (7.5): crash when a redirect zone is combined with qname-minimization strict.
  • CVE-2026-97313 (7.5): crash on recursive servers with two RPZ zones that have different recursive-only settings.

NLnet Labs Unbound 1.26.2 (Oct 21): CVE-2026-97206 (High), a DNS-over-QUIC path-migration use-after-free that a remote DoQ client can use to crash multi-threaded servers (1.22.0 to 1.26.1); CVE-2026-50106 and CVE-2026-35501, DNSSEC trust-island bypasses; CVE-2026-96405, decompression-work CPU exhaustion; and CVE-2026-109125, a cache-poisoning side channel through unwanted-reply-threshold. Patches are available for anyone who can't upgrade.

Sources: ISC: CVE-2026-94300 (GSS-TSIG memory corruption) · ISC BIND 9 Security Vulnerability Matrix · NLnet Labs: Unbound security advisories · oss-security: Unbound 1.26.2 addresses multiple CVE items (Oct 21)