These are mainline -rc fixes: Cc: stable, no CVE yet by design. CVEs land later, on backport.
We read the merge graph so you see them now, not after the feed catches up.
🦅 PatchHawk
#LinuxKernel#infosec
Linux mainline quietly shipped a fix for a remote kernel heap overflow in the iSCSI target. It fires during login, before the CHAP password is ever checked.
No CVE. The commit just says "validate CHAP_R length before base64 decode."
Only watch CVE feeds? You missed it. 🧵
The lesson: a record ~200 CVEs still isn't the whole picture. The binary diffs carry hardening the advisories never spell out.
We read them so you don't have to.
🦅 PatchHawk
#PatchTuesday#infosec
The slickest catch: one feature flag rerouted Kerberos PAC decoding to a new path across THREE binaries - LSASS, Credential Guard (LsaIso), the Kerberos client lib.
Kerberos & LSASS did get CVEs this month. The advisories just don't show this cross-binary shape.
Microsoft's June 2026 Patch Tuesday set a record: ~200 CVEs, the biggest list ever.
We diffed ~130 of the patched binaries. Even at 200 CVEs, the advisories don't describe everything that changed.
Here's what the diffs show that the CVE text doesn't 🧵
7-Zip 26.01's changelog lists exactly ONE security fix.
We diffed the source, 26.00 -> 26.01. It silently shipped 14 MORE.
"Some bugs were fixed" was doing a lot of heavy lifting. 🧵
Takeaway: treat 26.01 as a security release, not a point fix. Upgrade from 26.00 even if you think the NTFS CVE doesn't touch you, because 14 more code paths got safer and the changelog won't say so.
🦅 PatchHawk
#7zip#infosec
🦅 Silent Patch Watch
Vendors often ship real security fixes as "minor bug fixes" — no CVE, no advisory.
Every Thursday we diff a release and show the one that actually mattered, so you can update before attackers notice.
Follow + 🔖 for the first issue this week.
Does anyone remember the 'CVE-2026-21509' in January 2026?
To learn more about the patching mechanism for CVE-2026-21509, please follow the link below.
https://t.co/6QNwLbtggt
Thank you.
Verified! @heehee_0219_ and @kimjor22 of Team K exploited two vulnerabilities - an out-of-bounds read and a stack-based buffer overflow - against the Alpine iLX-F511, earning $10,000 USD and 2 Master of Pwn points. #Pwn2Own#P2OAuto
Another Collision! @gbdngb12, @pwnstar96, @jeongZero, @sangs00Jeong, @nonetype_pwn of 78ResearchLab targeted the Phoenix Contact CHARX SEC‑3150, chaining four bugs (two unique and two collisions) to earn $15,000 USD and 3 Master of Pwn points.
As if competing in #Pwn2Own isn’t pressure enough, imagine being on stage in front of your professor as well! The team from 78ResearchLab is doing just that as the successfully target the Phoenix Contact CHARX. Well done! #P2OAuto
💥 What. A. Finish. Sangsoo Jeong from @78_lab wrapped Day 1 with explosive insights in Down to 256 flipping ransomware errors into defender advantage like a pro. Energy = MAXED OUT. #ParallelPulse 2025