#libpng 1.6.56 fixes two high-severity vulnerabilities: CVE-2026-33416 and CVE-2026-33636.

Out of these CVE-2026-33416: Use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE is particularly serious as arbitrary code execution has been demonstrated. Applications that call png_free_data() to release memory between png_read_info() and png_read_update_info() are affected.

https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j

The second vulnerability CVE-2026-33636: Out-of-bounds read/write in the palette expansion on ARM Neon is of more limited concern as only crashes has been demonstrated. More serious impacts have not been ruled out, however.

https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2

#infosec #cybersecurity #CVE_2026_33416 #CVE_2026_33636

I highly recommend everyone (software developers and others alike) to check #privacyguides for their knowledge base. They have a lot of very good advice on securing your personal systems and processes. These two documents are a good starting point: https://www.privacyguides.org/en/basics/common-threats/ and https://www.privacyguides.org/en/basics/threat-modeling/

https://mastodon.social/@bagder/116294927524710539

The Finnish Supreme Court has convicted MP Päivi Räsänen for incitement to hatred over her public statements about sexual and gender minorities.

https://yle.fi/a/74-20217430 (in english)

#Microsoft sent an email to everyone saying they're listening to people now and they will definitely not pushing AI to everything anymore.

Also Microsoft enabled #github to collect all your "inputs, outputs and associated context to train and improve AI models". This new tickbox is enabled by default, even if you explicitly disabled Copilot before.

Actions speak louder than words.

You can disable the option at https://github.com/settings/copilot/features

#enshittification

"Meta and Google found liable in landmark social media addiction trial"

https://www.bbc.com/news/articles/c747x7gz249o

Two 20-year-old vulnerabilities fixed in XML::Parser 2.48:

- CVE-2006-10002: XML::Parser versions through 2.47 for Perl could
overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes https://www.openwall.com/lists/oss-security/2026/03/19/1

- CVE-2006-10003: XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack https://www.openwall.com/lists/oss-security/2026/03/19/2

The patch fixing these has been available since 2006 but it's nice to see the fix in actual release, too.

#CVE_2006_10002 #CVE_2006_10003