Loading story…
GNU released Parted 3.8, a stable disk-partitioning utility update promoted from the 3.7.14 alpha with an updated Gnulib component. The release adds ExFAT filesystem support and fixes errors triggered by FAT metadata, 32-bit integer-overflow conditions in resize-related code, GNU/Hurd block-size handling, and partition-number allocation in the parted command-line utility.
Organizations using GNU Parted should assess and deploy version 3.8 where applicable, particularly on systems that resize partitions or process FAT-formatted media. GNU published source-tarball SHA-256 and SHA3-256 hashes, a detached GPG signature, and the expected signing-key fingerprint; installers should validate downloads against the official GNU keyring before deployment. The release is tagged v3.8 and is based on commit 5f600791b40a48c51aeb6db0432e67a29e8e7951.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
GNU Parted 3.8 was released as a stable version, promoted from the identical 3.7.14 alpha except for an updated Gnulib component. The release adds ExFAT support and fixes FAT-metadata errors, integer-overflow conditions, GNU/Hurd block-size handling, and partition-number allocation.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tuxera released **NTFS-3G 2026.7.7** to fix nine vulnerabilities in the userspace NTFS driver and related `ntfsprogs` utilities, after coordinated disclosure by **Nozomi Networks**. The issues were assigned `CVE-2026-42616`, `CVE-2026-42617`, `CVE-2026-42618`, `CVE-2026-46569`, `CVE-2026-46570`, `CVE-2026-46571`, `CVE-2026-46572`, `CVE-2026-56135`, and `CVE-2026-56136`, and include heap memory corruption, heap buffer overflows, single-byte heap overflow, and out-of-bounds read/access conditions. Tuxera also published patch bundles for versions **2026.2.25** and **2022.10.3**. The flaws can be triggered by malformed or maliciously crafted NTFS filesystem structures, compressed file data, or specially prepared NTFS images, potentially causing crashes, denial of service, memory corruption, or in some cases **code execution or privilege escalation to root** when vulnerable components process attacker-controlled NTFS data. Affected code paths include functions such as `ntfs_ib_copy_tail()`, `ntfs_ir_to_ib()`, `ntfs_decompress()`, `ntfs_index_walk_down()`, `ntfs_ib_cut_tail()`, `build_inherited_id()`, and the `ntfscat` utility, prompting maintainers to urge users to update to the patched release.
Jul 16, 2026
GNU released **Coreutils 9.12**, delivering 288 commits from 16 contributors and fixes for multiple memory-safety and reliability defects in foundational GNU command-line utilities. The release addresses a CWE-126 possible buffer over-read in `factor`; freed-memory reads in `ls --color`; heap-buffer overflows in `unexpand`; and read-buffer or lookup-table over-reads affecting `uniq` and `wc`. It also resolves long-standing recursive traversal failures in `chcon`, `chgrp`, `chmod`, `chown`, `du`, and `ls` when files are removed concurrently. The update fixes infinite-loop and hang conditions in `ptx`, `tee`, `shred`, and `truncate`, while improving filesystem handling and performance in `cut`, `uniq`, and `sort`, including better handling of piped input. New features include `env --env0-from=FILE` for environment persistence, safer quoting and terminal-output behavior, and labeled `uname` output. Organizations packaging or operating GNU/Linux systems should prioritize testing and deploying Coreutils 9.12 where affected utilities process untrusted, malformed, or concurrently changing files and input.
Sep 17, 2026
runZero disclosed seven vulnerabilities in the widely reused **FatFs** filesystem library, a FAT/exFAT implementation embedded in firmware for devices such as cameras, drones, industrial controllers, crypto wallets, and RTOS-based products. The flaws affect FAT, exFAT, and GPT parsing and can be triggered by crafted USB drives, SD cards, partition tables, or mounted firmware/update images, leading to memory corruption, denial of service, information disclosure, silent data corruption, and possible code execution. The most serious issues include **`CVE-2026-6682`**, an integer overflow in `mount_volume()` that can corrupt file-size metadata and enable downstream exploitation, and **`CVE-2026-6687`**, a stack overflow in `f_getlabel()` tied to exFAT label handling. The disclosure warned that the blast radius is large because FatFs is vendored into ecosystems including **ESP-IDF, STM32Cube, Zephyr, MicroPython, ArduPilot, RT-Thread, Mbed, TizenRT, and SWUpdate**, with exploitation often requiring physical access but also potentially reaching devices through OTA workflows that automatically mount malicious images. runZero said all released versions are affected, only **`CVE-2026-6684`** is fixed upstream in **FatFs R0.16**, and no coordinated maintainer response was received despite outreach through **JPCERT/CC**. Researchers published proof-of-concept disk images, a test harness, and a QEMU-based exploit example, while warning that downstream vendors will need to identify and patch their own bundled copies and that remediation may take years for many products.
Jul 12, 2026