MeridianMeridian

7-Zip Version 26.06 Addresses Multiple Bugs and Vulnerabilities

The developer of 7-Zip has issued version 26.06, the latest in a series of four recent releases that each claim to resolve bugs and vulnerabilities. No technical details about the patched issues have been disclosed, leaving users and researchers without clarity on the nature of the flaws. Past vulnerabilities in 7-Zip have been actively exploited in real-world attacks, including a remote code execution flaw that was fixed at the end of June but only publicly disclosed on 15 July after exploit code appeared online. The Italian government issued a warning about the available exploit code in late July. Unlike many modern applications, 7-Zip lacks an automatic update mechanism, requiring users to manually download and install the new version. Similar issues with outdated WinRAR installations have been highlighted by Trend Micro as a contributing factor to prolonged exposure in archiving software.

Security.NLTranslated from NL

Read at source

The developer of 7-Zip has released version 26.06, continuing a pattern of frequent updates that address multiple bugs and vulnerabilities in the popular archiving software.

Over the past several weeks, four new versions of 7-Zip have been published, with each release note simply stating that bugs and vulnerabilities have been fixed. No specific information about the nature or severity of these security issues has been provided to the public.

Users are strongly advised to update to 7-Zip 26.06 as soon as possible. The application does not include an automatic update function, meaning administrators and end users must manually download and install the latest build from the official source.

Historical vulnerabilities in 7-Zip have been exploited in targeted attacks. In late July, the Italian government warned that exploit code for a remote code execution flaw had appeared online. That particular vulnerability was patched at the end of June, although its existence was not publicly disclosed until 15 July.

Similar challenges exist with other archiving tools. According to antivirus vendor Trend Micro, many organizations continue to run outdated versions of WinRAR, largely because the software also lacks an automatic updater, leaving systems exposed for extended periods.

7-ZipWinRARTrend Micro
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Recognizing and Reducing Security Debt in IT Security
Vulns & Exploits

Recognizing and Reducing Security Debt in IT Security

Security Debt refers to the accumulation of deferred or incomplete security measures that organizations take to meet short-term project demands. These compromises, such as postponed patches, continued operation of legacy systems, and partially implemented protections, create growing risks that attackers can exploit later. The article explains how this invisible liability builds unnoticed when security shortfalls are not tracked or prioritized. CISOs and IT teams are advised to treat Security Debt as a manageable obligation rather than an inevitable cost of doing business. Without systematic identification and reduction, organizations ultimately pay through higher remediation expenses or actual security incidents. The concept draws a direct parallel to Technical Debt but applies specifically to security posture and long-term risk exposure.

Security-InsiderNov 9, 2026Translated from German

Critical Telegram Android Flaw Allowed Full Device Takeover via Voice Call
Vulns & Exploits

Critical Telegram Android Flaw Allowed Full Device Takeover via Voice Call

Researchers at NebuSec disclosed a critical vulnerability in the Telegram Android app that, when chained with two additional bugs, enabled remote attackers to escape the application sandbox, obtain root privileges, and gain complete control over the victim's device. The attack required only that the target accept an incoming voice call from the attacker. The flaw affected versions 8.6.2 through 12.10.3 and was fixed in 12.10.4 released at the end of September 2026. NebuSec discovered the issue using their Code Security product powered by OpenAI's GPT-5.4 model. The vulnerability resided in the handling of MediaState messages exchanged during voice calls and allowed out-of-bounds memory access on ARM64 devices. Separately, Zero Day Initiative published details of an unpatched rlottie library flaw (CVE-2026-111105) also affecting Telegram clients across platforms.

ekurakNov 9, 2026Translated from Polish

Brotli Buffer Overflow Flaw Exposes Node.js to Remote Code Execution and DoS Attacks
Vulns & Exploits

Brotli Buffer Overflow Flaw Exposes Node.js to Remote Code Execution and DoS Attacks

A critical buffer overflow vulnerability in Google's Brotli compression library allows remote attackers to corrupt memory, leak data, trigger denial-of-service conditions, or potentially execute arbitrary code. The flaw affects Brotli versions 1.0.3 through 1.2.0 and impacts applications that decompress attacker-supplied Brotli data, including multiple Node.js release lines. The root cause lies in the decoder incorrectly treating an invalid block transition as a temporary need for more input instead of a fatal format error, causing writes beyond an eight-byte internal buffer. Security updates have been released for the library itself as well as for Node.js versions 22, 24, and 26. Organizations are advised to inventory all affected software, containers, and packages and apply the available patches without delay.

Security-InsiderNov 9, 2026Translated from German