Security incidents tagged BIND. Newest first.
ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.
ISC BIND 9 (named) DNS serverSince Oct 21, 2026
BIND 9 DNS: replaying GSS-TSIG signed UDP messages can corrupt memory in named. Worst case: remote code execution. CVSS 8.1, no workaround. No known exploits yet. Upgrade to 9.20.30 / 9.21.27. On 9.18? Check with ISC. t.co/s2ChkYWdYG
Bruh... DNS infa is fucked. Update your bind boys t.co/Gbll8AK5g2 t.co/BParNla6y9
（緊急）BIND 9.xの脆弱性（DNSサービスの停止・リモートコード実行）について（CVE-2026-94300） - バージョンアップを強く推奨 - t.co/1GT8uIFYT0
is it time to turn the internet off yet t.co/RLrPu79z8g
