Loading story…
VeraCrypt 1.26.29 has been released for Linux, FreeBSD, Windows, and macOS, introducing broad platform and packaging changes alongside security fixes. The update adds native DEB and RPM packages, support for the Argon2id key derivation function, XML and TLV keyfile formats, FUSE3 integration, and Linux ntfs3 support for NTFS volumes. It also improves performance through optimized KDF handling and faster quick-format operations, while Windows builds gain compatibility updates for Windows 11 25H2, EFI changes tied to Microsoft UEFI CA 2023, and new options including /protectScreen and /enableIME.
The release also fixes two vulnerabilities: CVE-2026-53762, affecting the published VeraCrypt C/C++ SDK when built with WOLFCRYPT=1, and CVE-2026-54073, a Windows-specific memory or temporary-file handling issue described as enabling local privilege escalation. Separately, the report highlights an unpatched BitLocker zero-day known as GreatXML, which can reportedly expose encrypted data by forcing BitLocker into Recovery mode after a Windows Defender Offline Scan.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The report states that the VeraCrypt C/C++ SDK was published alongside the broader VeraCrypt 1.26.29 release information. No specific publication date is explicitly provided in the source content.
VeraCrypt 1.26.29 was released for Linux, FreeBSD, Windows, and macOS, adding features such as native DEB and RPM packaging, Argon2id support, XML and TLV keyfiles, FUSE3 integration, and Windows 11 25H2 compatibility. The release also fixed CVE-2026-53762 affecting builds compiled with WOLFCRYPT=1 and CVE-2026-54073, a Windows local privilege escalation issue involving insecure temporary file handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceveracrypt.fr
Open sourcegithub.com
Open sourceopennet.me
Open sourceopennet.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tuxera released **NTFS-3G 2026.9.18** to remediate eight vulnerabilities in the FUSE-based NTFS filesystem driver. The flaws include heap buffer overflows, heap data corruption, out-of-bounds reads and writes, and a denial-of-service condition in code handling NTFS attributes, mapping-pair decompression, extended attributes, restart areas, security identifiers, ACL ownership, and inode extent attachment. The highest reported severity is CVSS 6.8 (Moderate), affecting a heap buffer overflow in `ntfs_same_sid()`. Tuxera also issued patch bundles for the 2022.10.3 and 2026.7.7 branches, while Fedora shipped advisory **FEDORA-2026-a2beb6a664** for affected Fedora 46 packages, including `ntfs-3g`, `ntfs-3g-system-compression`, `partclone`, `testdisk`, and `wimlib`. The update additionally corrects ACL-inheritance behavior and defects in `ntfscat` and `ntfsresize`; CVE identifiers had been requested but were not assigned at disclosure, and no known exploits were reported.
Sep 27, 2026
ClamAV released security patch versions **1.5.4** and **1.4.6** to fix seven vulnerabilities in the antivirus engine, along with additional stability issues affecting archive, partition, PDF, Mach-O, and PE parsing. The updates also incorporate an upstream UnRAR fix for `CVE-2025-8088`, resolve thread-safety problems in the `clamd` `STATS` command that could leak memory or crash the daemon, restore safe quarantine behavior on FreeBSD, and in **1.5.4** fix an OpenSSL library-context leak in legacy hashing helpers. Both releases also update the Rust `crossbeam-epoch` dependency to remediate `RUSTSEC-2026-0204`. Advisories highlighted **`CVE-2026-20337`** and **`CVE-2026-20338`** as high-severity ZIP archive parser denial-of-service flaws caused by improper input validation during scanning, with public proof-of-concept code reportedly available. An unauthenticated remote attacker could submit crafted archives to disrupt scanning operations and affect service availability. Affected versions include ClamAV **1.5.x before 1.5.4** and **1.4.x before 1.4.6**, while Cisco said related fixes also apply to **Secure Endpoint Connector** for Windows, Linux, and macOS and to **Private Cloud 4.2.x before 4.2.8**, with updated connector builds being released through August.
Aug 13, 2026
Microsoft released its **February 2026 Patch Tuesday** security updates, addressing **54–58 vulnerabilities** across Windows and other Microsoft products, including **six zero-days** that were **publicly disclosed and/or actively exploited** prior to patch availability. Reported zero-days include `CVE-2026-21514` (Office Word security feature bypass), `CVE-2026-21513` (MSHTML security feature bypass), `CVE-2026-21510` (Windows Shell security feature bypass), `CVE-2026-21533` (Windows Remote Desktop Services elevation of privilege), `CVE-2026-21525` (Windows Remote Access Connection Manager DoS), and `CVE-2026-21519` (Desktop Window Manager elevation of privilege). The broader release spans common bug classes such as **RCE**, **EoP**, **information disclosure**, **spoofing**, **DoS**, and **security feature bypass**, with multiple **Critical** issues also called out, including Azure Compute Gallery flaws impacting *ACI Confidential Containers* (`CVE-2026-23655`, `CVE-2026-21522`). As part of the February Windows updates, Microsoft also began a **phased rollout of updated Secure Boot certificates** to replace the original **2011 certificates** ahead of their expiration in **late June 2026**, using “targeting data” and “successful update signals” to control deployment. Windows 11 cumulative updates (including **KB5077181** and **KB5075941**) were released as mandatory Patch Tuesday packages for supported Windows 11 versions, bundling the security fixes alongside additional reliability and feature changes. Separately, Adobe issued February security bulletins covering **44 CVEs** across multiple Creative Cloud products; those Adobe issues were not listed as publicly known or under active attack at release.
Jun 29, 2026