PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Phát hiện lỗ hổng bảo mật trong hệ thống nhận dạng điện tử của EU

blog.viettelcybersecurity.com | blog | #authentication | #vulnerability | #eu | #identity-management | #eidas | #sec-consult | #e-government
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

SEC Consult found flaws in the EU's eIDAS-Node cross-border authentication software that allow impersonating any EU citizen; member states must upgrade to version 2.3.1 and check for real-world abuse.
Published
Collected

Related coverage

blog · blog.trailofbits.com
SAML: A fractal of bad design
Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.
blog · bishopfox.com
Zilliz / Attu | 2.6.5
Bishop Fox disclosed two flaws in Zilliz Attu 2.6.5, the Milvus management UI. An unauthenticated SSRF combined with a regex validation bypass chains into Kubernetes namespace takeover, exposing entire clusters to attackers.
blog · xbow.com
XBOW Now Available With EU Data Residency
XBOW now offers EU data residency: assessment data, findings, credentials and AI models run from AWS Frankfurt (eu-central-1), helping European teams meet GDPR obligations.
blog · about.gitlab.com
PHP2Shell: GitLab helps find and remediate critical PHP flaws
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution. Learn which PHP versions fix them and how to check your projects.
blog · about.gitlab.com
Prepare for the Cyber Resilience Act's 24-hour reporting deadline
From 11 September 2026, EU manufacturers must file 24-hour early warnings for actively exploited vulnerabilities, plus 72-hour and final reports; GitLab covers the ENISA/CSIRT process and detection.
blog · hackerone.com
EU CRA Reporting Goes Live This Friday. Are You Ready?
The EU Cyber Resilience Act's mandatory reporting starts September 11: manufacturers must warn ENISA of exploited vulnerabilities within 24 hours, notify within 72, and then file follow-up reports.
Back