Loading story…
Red Hat released RHSA-2026:56936 for the mysql:8.4 module in Red Hat Enterprise Linux 8, delivering MySQL 8.4.11 and rating the update Important. The advisory addresses numerous vulnerabilities across MySQL components including Replication, Optimizer, Clone Plugin, Group Replication, X Plugin, InnoDB, JSON, DDL, Performance Schema, and Pluggable Auth, with affected builds spanning multiple RHEL 8 architectures and Extended Life Cycle 8.10 variants.
A corresponding AlmaLinux 8 advisory, tracked by a Nessus plugin as ALSA-2026:56936, mirrors the MySQL fixes across a broad set of repositories and packages. The referenced flaws include weakness classes such as uncaught exceptions (CWE-248), which can cause crashes or unintended behavior, and incorrect privilege assignment (CWE-266), which can enable unauthorized access or privilege escalation; Tenable said no known exploits were available at publication and pointed to CVEs including CVE-2026-60315 and CVE-2026-60163 for scoring details.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
A Tenable Nessus plugin published on 2026-08-20 documents AlmaLinux 8 advisory ALSA-2026:56936, referencing the same MySQL CVE set and noting the advisory patch publication date of 2026-08-19 with no known exploits available.
Red Hat issued Important advisory RHSA-2026:56936 for RHEL 8 on 2026-08-19, rebasing the mysql:8.4 module to MySQL 8.4.11 and fixing numerous vulnerabilities across components such as Replication, Optimizer, Clone Plugin, Group Replication, X Plugin, InnoDB, JSON, DDL, Performance Schema, and Pluggable Auth.
The Nessus plugin states that the vulnerabilities addressed by the AlmaLinux advisory, including numerous MySQL CVEs later referenced by Red Hat, were published on 2026-07-21.
MITRE published the CWE-248 entry defining Uncaught Exception as a base-level weakness in which thrown exceptions are not caught, potentially causing crashes, denial of service, or exposure of sensitive data.
MITRE published the CWE-266 entry describing Incorrect Privilege Assignment as a base-level weakness that can enable unintended access, privilege gain, or identity assumption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2026:66000**, an Important-rated update for Red Hat Enterprise Linux 8, fixing seven Linux kernel vulnerabilities in cryptographic request handling, Netfilter conntrack and SYN proxy processing, rhashtable iteration, SMB DFS referrals, NVMe-over-RDMA inline-data handling, and bridge fast-leave behavior. The fixed release, `4.18.0-553.160.1.el8_10`, is available for x86_64, s390x, ppc64le, and aarch64 systems, including applicable Extended Life Cycle and CodeReady Linux Builder repositories. Notable fixes include a stack out-of-bounds write in SIP/SDP NAT processing (**CVE-2026-53002**), a potential use-after-free caused by a stale TCP-header pointer in Netfilter SYN proxy handling (**CVE-2026-64007**), a use-after-free in rhashtable iterator restarts (**CVE-2026-64563**), and insufficient validation of SMB DFS referral `PathConsumed` values (**CVE-2026-68343**). AlmaLinux 8 has issued a corresponding update for the same seven CVEs; no known exploitation was reported in the referenced notices. Administrators should update affected kernel packages and reboot systems to load the patched kernel.
Sep 17, 2026
Red Hat released MySQL security updates for Red Hat Enterprise Linux and Red Hat Software Collections, upgrading `mysql55-mysql` to 5.5.45 and `rh-mysql56-mysql` to 5.6.26. The advisories incorporate fixes from Oracle’s January, April, and July 2015 Critical Patch Updates, remediating 15 CVEs in the MySQL 5.5 Software Collections stream and 18 CVEs in the MySQL 5.6 stream; Red Hat rated the 5.5 updates Moderate and the 5.6 update Important. The flaws include unauthenticated network denial of service in replication (`CVE-2015-0382`), authenticated unauthorized read access through the security-privileges component (`CVE-2015-2620`), and authenticated denial-of-service conditions in DML, Optimizer, DDL, and InnoDB foreign-key processing, including `CVE-2015-2648`, `CVE-2015-2643`, `CVE-2015-0505`, and `CVE-2015-0432`. Affected systems should apply the relevant packages; the `mysqld` service restarts automatically after installation.
Aug 29, 2026
Red Hat released Important updates for MySQL and MariaDB packages in Red Hat Software Collections, addressing the configuration-file injection flaw **CVE-2016-6662**, MyISAM repair race conditions **CVE-2016-6663/CVE-2016-5616**, and insecure `mysqld_safe` error-log handling tracked as **CVE-2016-6664/CVE-2016-5617**. Depending on configuration, attackers with database privileges, `FILE` access, or local shell access could write option files, manipulate files writable by the `mysql` account, or exploit symlink and log-path handling to obtain elevated execution; root-level impact depended on `mysqld_safe` and file-permission configuration. The updates also remediate remotely reachable denial-of-service flaws **CVE-2016-3492** and **CVE-2016-5612**, which allow low-privileged network attackers to hang or repeatedly crash affected MySQL servers, alongside additional Oracle CPU vulnerabilities. Affected Software Collections deployments should install the applicable updated packages—`mysql55-mysql` 5.5.52, `mariadb55-mariadb` 5.5.53, `rh-mysql56-mysql` 5.6.34, or `rh-mariadb100-mariadb` 10.0.28 or later; installation automatically restarts `mysqld`. Red Hat noted that default RHEL configurations reduce exposure to several escalation paths through root-owned configuration files, `mysqld_safe` execution as `mysql`, and disabled symbolic links.
Aug 29, 2026