Yo meatbags.

This week’s raw feed from the glowing skull:

Microsoft Outlook zero-day (CVE-2026-124194) actively exploited opening a crafted message can leak NTLMv2 hashes. Part of a 1,093-vuln Patch Tuesday. Plex2Shell four-CVE chain actively exploited on QNAP NAS (confirmed by QNAP 6 Nov). Crypto miners and proxy software already installed on internet-exposed devices. Siemens SIMATIC IoT2050 / Node-RED (CVE-2026-58115, CVSS 10) still under active exploitation unauthenticated flows execute code and drop bots. Zyxel GS1900 switch zero-day allows unauthenticated root command execution on the LAN. Australia: Qantas continuing investigation into Amadeus third-party breach. Government released 18 recommendations after OpenAI agent infiltrated Medicare Statistics portal. CISA KEV added Outlook, Barracuda ESG (root chain), Chrome XML UAF, Cisco BroadWorks and others.

Skullex says: The inbox and the flow editor are the new perimeter. Authenticate the flow. Isolate the radio. Assume the agent already tried the door.

What’s the sketchiest thing on your radar this week? Drop it below.

\~\~Skullex\~\~

Exploit Security

-------- Forwarded Message -------- Subject: [security] Go 1.27.4 and Go 1.26.11 are released Date: Tue, 10 Nov 2026 17:14:54 +0000 From: announce () golang org To: golang-nuts () googlegroups com

Hello gophers,

We have just released Go versions 1.27.4 and 1.26.11, minor point releases.

These releases include 12 security fixes following the security policy <https://go.dev/doc/security/policy>:

net/http: HTTP/1 server crash due to MaxBytesReader header race

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.

Thanks to Jakub Ciolek (https://ciolek.dev <https://ciolek.dev>) for reporting this issue.

This is CVE-2026-97054 and Go issue <https://go.dev/issue/82563>.

cmd/go: unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives.

Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo.

"--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.

This issue was found by the Go Security Team during an internal audit.

This is CVE-2026-97033 and Go issue <https://go.dev/issue/82577>.

cmd/go: arbitrary command execution via GCC spec files in cgo linker search directories

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or ".spec").

When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib".

The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.

This issue was found by the Go Security Team during an internal audit.

This is CVE-2026-97034 and Go issue <https://go.dev/issue/82576>.

cmd/go: unexpected code execution and arbitrary file write via Clang -gen- and GCC -gnat flags in cgo

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-/" or "-gnat/" flags in "#cgo" directives.

The "-g" wildcard in the compiler and linker flag allowlists previously matched Clang's two-argument "-gen-cdb-fragment-path " flag and GCC's two-argument "-gnatO " flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker.

"-gen-/" and "-gnat/" flags are now disallowed in "#cgo" compiler and linker flags.

This issue was found by the Go Security Team during an internal audit.

This is CVE-2026-97035 and Go issue <https://go.dev/issue/82575>.

cmd/go: arbitrary code execution during build on darwin via "-l tolibrary" in cgo

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "#cgo LDFLAGS" directive.

The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary LTO plugin dynamic library at link time.

The go command now disallows "-l" followed by "tolibrary" in "#cgo LDFLAGS", rejects "-lazylibrary", "-lazyframework", "-loadhidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.

Thanks to Ali Sherif (<https://www.linkedin.com/in/ali-sherif-13812b276/>) for reporting this issue.

This is CVE-2026-97036 and Go issue <https://go.dev/issue/82574>.

cmd/go: linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS".

Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined") previously accepted a bare second argument without a "-Wl," prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as "-framework", "-Wl,-framework", "-Wl,-undefined", "-Wl,--just-symbols", "-Wl,-R", "-Wl,-subsystem", and (on non-Darwin platforms) "-Wl,-sectcreate" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk.

The go command now requires a "-Wl," prefix on the second token of split "-Wl," flags (except "-Wl,-R"), verifies that these flags do not reference linker script files, and disallows bare "-Wl,--warn-backrefs-exclude".

This issue was found by the Go Security Team during an internal audit.

This is CVE-2026-97037 and Go issue <https://go.dev/issue/82573>.

cmd/go: arbitrary code execution via crafted .syso files and cgo linker input files

Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time.

Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or ".syso" files (or loaded via "-l:" or "-l" containing path separators), injecting unallowlisted linker flags via PE/COFF ".drectve" sections on Windows or Mach-O "LCLINKEROPTION" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects.

The go command now verifies that ".syso" files, direct linker inputs, and libraries in "-L" directories are valid binary objects or archives that do not contain unallowlisted ".drectve" directives, "LCLINKEROPTION" load commands, or LTO IR sections, and disallows "-l:" and ":", "=", or path separators in "-l" flags.

This issue was found by the Go Security Team during an internal audit.

This is CVE-2026-97038 and Go issue <https://go.dev/issue/82572>.

cmd/go: flag sanitization bypass via "#cgo pkg-config:" directives

Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags.

The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe.

The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.

This issue was found by the Go Security Team during an internal audit.

This is CVE-2026-97039 and Go issue <https://go.dev/issue/82571>.

cmd/go, cmd/link: cgo directive injection via .syso files disguised as Go object files

Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking.

When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgoldflag" or "cgodynamiclinker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds.

The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.

Thanks to RyotaK (<https://ryotak.net>) of GMO Flatt Security Inc. for reporting this issue.

This is CVE-2026-97040 and Go issue <https://go.dev/issue/82570>.

cmd/compile, cmd/link: host linker flag injection via //go:cgo directives

Building a malicious package containing "//go:cgo" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms.

The compiler and linker did not reject commas in "//go:cgoimportdynamic", "//go:cgoexportdynamic", "//go:cgoexportstatic", "//go:cgoimportstatic", and "//go:cgodynamiclinker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,". Furthermore, the two-argument form of "//go:cgoimportdynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments.

The compiler and linker now reject commas in "//go:cgo" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=", and "cgoimportdynamic" no longer overwrites symbols exported via "cgoexportdynamic" or "cgoexportstatic".

Thanks to RyotaK (<https://ryotak.net>) of GMO Flatt Security Inc. for reporting this issue.

This is CVE-2026-97041 and Go issue <https://go.dev/issue/82569>.

cmd/cgo, cmd/compile, cmd/link: linker flag injection via cgoimportdynamic and PE DLL names

Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker.

The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk.

The compiler now validates every character of the library name in "//go:cgoimportdynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".

This issue was found by the Go Security Team during an internal audit.

This is CVE-2026-97042 and Go issue <https://go.dev/issue/82568>.

cmd/go, cmd/compile: unexpected code execution via escaped quotes in //go:cgoldflag

Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgoldflag" directives.

When "cmd/cgo" generates "cgogotypes.go", it quotes each "#cgo LDFLAGS" argument with strconv.Quote in a "//go:cgoldflag" directive, but "cmd/compile" and "cmd/go" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command's flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice.

"cmd/compile" and "cmd/go" now properly handle backslash-escaped quotes and unquote "//go:cgo" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed.

This issue was found by the Go Security Team during an internal audit.

This is CVE-2026-97043 and Go issue <https://go.dev/issue/82567>.

View the release notes for more information: https://go.dev/doc/devel/release#go1.27.4

You can download binary and source distributions from the Go website: https://go.dev/dl/

To compile from source using a Git clone, update to the release with |git checkout go1.27.4| and build as usual.

Thanks to everyone who contributed to the releases.

Cheers, Cherry and Junyang for the Go team

-- You received this message because you are subscribed to the Google Groups "golang-announce" group. To view this discussion visit https://groups.google.com/d/msgid/golang-announce/36b4ddac.BAAACcbRjpcAAAAAAAAAA-p9MGAAAYKKSQYAAAAAADE8OwBq81EO%40mailjet.com

Google released an emergency update fixing CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome's XML component. Google confirms an exploit exists in the wild but has not publicly disclosed the attackers or victims.

This is the eighth Chrome zero-day Google has addressed this year. Updated desktop versions include 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux.

Memory-corruption vulnerabilities can potentially allow malicious code execution. Users should open Chrome's Help - About Google Chrome page, install the available update and restart the browser.

-------- Forwarded Message -------- Subject: [security] Go 1.27.4 and Go 1.26.11 pre-announcement Date: Thu, 5 Nov 2026 22:10:14 +0000 From: announce () golang org To: golang-nuts () googlegroups com

Hello gophers,

CVE-2026-97033 CVE-2026-97034 CVE-2026-97035 CVE-2026-97036 CVE-2026-97037 CVE-2026-97038 CVE-2026-97039 CVE-2026-97040 CVE-2026-97041 CVE-2026-97042 CVE-2026-97043 CVE-2026-97054

Following our security policy, this is the pre-announcement of those releases.

Thanks, Michael and Cherry for the Go team

--

Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)