Security Engineer: 2026-09-25

1. Critical Vulnerability in F5 BIG-IP APM

   CERT-EU, 2026-09-22. Read, 3 min.

   F5 disclosed CVE-2026-94127 on September 22, a heap-based buffer overflow in BIG-IP APM rated CVSS 9.8 that allows an unauthenticated attacker to achieve remote code execution, and confirmed active exploitation in the wild. CERT-EU lists versions 17.1.0 to 17.1.3, 17.5.0 to 17.5.1, and 21.1.0 as affected when configured with an access policy and an OAuth profile on a virtual server, and recommends preserving forensic evidence, applying the hotfix, and checking for signs of compromise.

   Why it matters for this role: Where the hotfix cannot go in today, F5's iRule for the affected virtual server is the stopgap, obtained by contacting F5 Support.

2. Accelerating delivery of CVE fixes with a new Kernel release strategy

   Canonical, 2026-09-23. Read, 4 min.

   Canonical is moving Ubuntu kernel Stable Release Updates from a 4-week regular and 2-week security cycle to a unified 2-week cycle whose overlapping releases are published weekly, citing a surge in CVE volume driven by AI-assisted bug discovery and by the upstream kernel community becoming its own CVE Numbering Authority. While a patch is prepared, Canonical aims to provide safe workarounds where applicable, with the goal of a defensible state within 24 to 48 hours of public disclosure.

   Why it matters for this role: Decide whether your Ubuntu fleet should test kernels from -proposed or wait for certified releases, because the kernel cadence your patch windows assume is moving to weekly.

3. Master Key Included: Detecting SolarWinds ARM CVE-2026-28326

   Bishop Fox, 2026-09-25. Read, 13 min.

   SolarWinds fixed CVE-2026-28326, an unauthenticated remote code execution flaw in Access Rights Manager that its release notes attribute to a hardcoded static key, in ARM 2026.2.1 on September 17, and Bishop Fox has now published an analysis and a detection tool. Bishop Fox traced the flaw to a fallback authentication path on ARM's gRPC listener on TCP port 55555 and advises patching to build 2026.2.1.7 or later, since builds 2026.2.0.42 and earlier are affected.

   Why it matters for this role: Read the firewall rule that governs TCP 55555 on each ARM server rather than assuming it is internal, and narrow it to ARM's collectors and clients on anything you cannot upgrade yet.

4. Forging 1024-bit RSA signatures in nearly SNFS time

   IACR Cryptology ePrint Archive, 2026-09-22. Read, 2 min.

   In a preprint, researchers from UC San Diego and INRIA implemented a 2007 algorithm that forges RSA signatures without factoring the key, given temporary access to a raw RSA signing or decryption oracle, and ran it against 1024-bit RSA using a hardware security module as the oracle in 1380 CPU core-years over five calendar months. They conclude that RSA's concrete security with a signing oracle should be 15 to 30 bits lower than factoring-based estimates for the 1024-bit to 4096-bit parameters common in practice.

   Why it matters for this role: Inventory the HSMs and signing services you run for raw RSA signing or decryption interfaces, the oracle access this forgery depended on.

Security Engineer