BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

AI Summary

ISC released BIND 9.20.29 and 9.21.26 on September 16 to fix 14 security flaws, including an unauthenticated crash vulnerability affecting any BIND server configured with DNS-over-HTTPS — a single malformed SIG record is sufficient to kill the named process. Additionally, CVE-2026-81642 is a critical heap overflow in the DNSSEC validator in Unbound before version 1.26.1 that enables RCE via a malicious DNS zone.

Read full article → https://thehackernews.com/2026/09/bind-9-update-fi…

Relevance score: 77.0/100

# More from September 18

1
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks The Hacker News
2
Cisco alerts customers to second actively exploited zero-day in as many days CyberScoop
3
Brevo supply-chain attack injected ClickFix scripts on customer sites BleepingComputer
4
Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels SecurityWeek
5
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root The Hacker News
6
China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America The Hacker News
7
Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records The Hacker News
8
Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M Ransom SecurityWeek
10
Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords The Hacker News