https://pwn.watch/t/dns Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 13:59:23 GMT https://pwn.watch/i/isc-bind-cve-2026-94300 https://pwn.watch/i/isc-bind-cve-2026-94300 Thu, 22 Oct 2026 13:59:23 GMT high <p>ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> partial · <strong>Fixed in:</strong> BIND 9.20.30, BIND 9.21.27, BIND Supported Preview Edition 9.20.30-S1, Debian trixie: bind9 1:9.20.30-1~deb13u1 (DSA-6576-1); unstable 1:9.20.30-1</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Debian publishes DSA-6576-1 with a fixed bind9 for trixie; bookworm (9.18) is still listed as vulnerable. (<a href="https://security-tracker.debian.org/tracker/CVE-2026-94300">source</a>)</li><li>2026-10-22: Japan's registry JPRS issues an urgent alert telling BIND operators to upgrade. (<a href="https://x.com/JPRS_official/status/2113158713569882272">source</a>)</li><li>2026-10-21: ISC publicly discloses CVE-2026-94300 and ships BIND 9.20.30 and 9.21.27. ISC found it in internal testing; Dave Aitel of OpenAI reported it independently. (<a href="https://kb.isc.org/docs/cve-2026-94300">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2026-94300</p> https://pwn.watch/i/palo-alto-networks-pan-os-cve-2024-3393 https://pwn.watch/i/palo-alto-networks-pan-os-cve-2024-3393 Mon, 30 Dec 2024 00:00:00 GMT high <p>Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. Added to the CISA KEV catalog on 2024-12-30.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-12-30: CISA added CVE-2024-3393 to the KEV catalog (federal deadline 2025-01-20) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-12-27: CVE-2024-3393 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-3393">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-3393</p>