{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T17:40:31.642Z",
  "tag": {
    "id": "dns",
    "label": "DNS",
    "isStack": false,
    "url": "https://pwn.watch/t/dns",
    "feed": "https://pwn.watch/t/dns/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "isc-bind-cve-2026-94300",
      "title": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300",
      "json": "https://pwn.watch/i/isc-bind-cve-2026-94300.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "partial",
      "product": "ISC BIND 9 (named) DNS server",
      "tags": [
        "linux",
        "bind",
        "dns",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-94300"
      ],
      "affectedVersions": [
        "BIND 9.11.0 through 9.18.50",
        "BIND 9.20.0 through 9.20.29",
        "BIND 9.21.0 through 9.21.26",
        "BIND Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1"
      ],
      "fixedVersions": [
        "BIND 9.20.30",
        "BIND 9.21.27",
        "BIND Supported Preview Edition 9.20.30-S1",
        "Debian trixie: bind9 1:9.20.30-1~deb13u1 (DSA-6576-1); unstable 1:9.20.30-1"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T15:59:23+02:00",
      "summary": "ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.",
      "xPost": null
    },
    {
      "slug": "palo-alto-networks-pan-os-cve-2024-3393",
      "title": "Palo Alto Networks PAN-OS Malicious DNS Packet",
      "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2024-3393",
      "json": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2024-3393.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Palo Alto Networks PAN-OS",
      "tags": [
        "palo-alto",
        "pan-os",
        "cisa-kev",
        "dns"
      ],
      "cveIds": [
        "CVE-2024-3393"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-12-27",
      "closedAt": "2024-12-30",
      "updatedAt": "2024-12-30",
      "summary": "Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. Added to the CISA KEV catalog on 2024-12-30.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Abhay अभय",
      "handle": "abyzz",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2077228355368484867/d6V_ACTZ_bigger.jpg",
      "text": "BIND 9 DNS: replaying GSS-TSIG signed UDP messages can corrupt memory in named. Worst case: remote code execution. CVSS 8.1, no workaround. No known exploits yet.\n\nUpgrade to 9.20.30 / 9.21.27. On 9.18? Check with ISC.\nhttps://t.co/s2ChkYWdYG",
      "date": "2026-10-22T11:04:54.000Z",
      "url": "https://x.com/abyzz/status/2113225077248741652",
      "media": [],
      "incident": "isc-bind-cve-2026-94300"
    },
    {
      "authorName": "Hensen Juang",
      "handle": "basedjensen",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2101681466476544000/S_hcWgNC_bigger.jpg",
      "text": "Bruh... DNS infa is fucked. Update your bind boys https://t.co/Gbll8AK5g2 https://t.co/BParNla6y9",
      "date": "2026-10-22T08:39:08.000Z",
      "url": "https://x.com/basedjensen/status/2113188391722627207",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVONoxnaYAAc7W-.jpg"
        }
      ],
      "incident": "isc-bind-cve-2026-94300"
    },
    {
      "authorName": "日本レジストリサービス（JPRS）",
      "handle": "JPRS_official",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1335820126499663872/xX3MDdt__bigger.jpg",
      "text": "（緊急）BIND 9.xの脆弱性（DNSサービスの停止・リモートコード実行）について（CVE-2026-94300） - バージョンアップを強く推奨 -\nhttps://t.co/1GT8uIFYT0",
      "date": "2026-10-22T06:41:12.000Z",
      "url": "https://x.com/JPRS_official/status/2113158713569882272",
      "media": [],
      "incident": "isc-bind-cve-2026-94300"
    },
    {
      "authorName": "ɐʞsǝs",
      "handle": "akses_0x00",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2067286904039702533/Q4ky91Ed_bigger.jpg",
      "text": "is it time to turn the internet off yet \nhttps://t.co/RLrPu79z8g",
      "date": "2026-10-22T04:18:08.000Z",
      "url": "https://x.com/akses_0x00/status/2113122707789553888",
      "media": [],
      "incident": "isc-bind-cve-2026-94300"
    }
  ],
  "changes": [
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Debian publishes DSA-6576-1 with a fixed bind9 for trixie; bookworm (9.18) is still listed as vulnerable.",
      "body": null,
      "sourceUrl": "https://security-tracker.debian.org/tracker/CVE-2026-94300",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Japan's registry JPRS issues an urgent alert telling BIND operators to upgrade.",
      "body": null,
      "sourceUrl": "https://x.com/JPRS_official/status/2113158713569882272",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "ISC publicly discloses CVE-2026-94300 and ships BIND 9.20.30 and 9.21.27. ISC found it in internal testing; Dave Aitel of OpenAI reported it independently.",
      "body": null,
      "sourceUrl": "https://kb.isc.org/docs/cve-2026-94300",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-14",
      "title": "ISC sends early notification of the flaw to its customers.",
      "body": null,
      "sourceUrl": "https://kb.isc.org/docs/cve-2026-94300",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "palo-alto-networks-pan-os-cve-2024-3393",
      "incidentTitle": "Palo Alto Networks PAN-OS Malicious DNS Packet",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-30",
      "title": "CISA added CVE-2024-3393 to the KEV catalog (federal deadline 2025-01-20)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2024-3393"
    },
    {
      "incident": "palo-alto-networks-pan-os-cve-2024-3393",
      "incidentTitle": "Palo Alto Networks PAN-OS Malicious DNS Packet",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-27",
      "title": "CVE-2024-3393 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3393",
      "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2024-3393"
    }
  ]
}