📋 ADVISORIES
Apache HTTP Server 2.4.69 released, fixing 20 flaws including mod_vhost_alias vulnerability
The Apache Software Foundation released HTTP Server 2.4.69 on October 1, 2026, fixing around 20 security flaws.- Applies to all users running Apache HTTP Server; several issues affect versions 2.4.0 through 2.4.68, with some limited to 2.4.60–2.4.68.
- Flaws addressed include potential code execution, server crashes, data leaks, and authentication bypass under specific conditions.
- CVE-2026-63292 involves a mod_vhost_alias issue; other bugs cover CGI redirects, WebDAV, and a forward-proxy flaw where an untrusted FTP server can redirect the proxy's data connection to another host.
- The release also focuses on hardening: a rewritten mod_auth_digest dropping legacy RFC 2069, an HTTP/2 GOAWAY fix aligning with RFC 9113, and a disabled-by-default status handler.
Sources 📄 Source: httpd.apache.org · 📎 Coverage: securityonline.info · 👁 via Cyber Security News, cryptika.com (discovered)📄 Source for Samsung CVE-2026-21140: ManagedProvisioning access control flaw lets local attackers install apps — nvd.nist.gov
🕵️ RESEARCH & DEEP DIVES
- California tech company owner arrested for smuggling $300M in GPU servers to China
US authorities arrested Greg Lui, owner of Earthmade Computer Inc., for allegedly smuggling over $300 million in export-controlled GPU servers to China.- Greg Lui, 38, owner of Earthmade Computer Inc. in City of Industry, California, was arrested October 1, 2026 on a three-count federal indictment: conspiracy to violate the Export Control Reform Act and EAR, outbound smuggling, and money laundering conspiracy.
- From 2023 to 2024, Lui allegedly bought high-end servers containing US-made GPUs (including Nvidia H100) used for AI/'Super Intelligence' applications and sent them to Chinese buyers without required Commerce Department licenses.
- The scheme used false documentation to US manufacturers misrepresenting permissible end users, then shipped servers via freight forwarders to Malaysia and Singapore before re-exporting them to China.
- Earthmade received over $176 million from two Malaysia-based shipping companies between January and October 2024; one January 2024 order covered 27 servers for roughly $7.6 million shipped from Los Angeles to Kuala Lumpur.
- Lui faces up to 20 years per count if convicted; prosecutors also allege dummy servers were staged to mislead inspectors.
Sources 📄 Source: justice.gov · 📎 Coverage: courthousenews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
CVE-2026-14378 — dplugins DevKit Pro — CVSS 9.8 — DevKit Pro through 2.3.0 - Unauthenticated Authentication Bypass to Administrator ...
CVE-2026-104480 — Discord libdave — CVSS 9.4 — Improper MLS Welcome roster validation in Discord libdave allows unauthorized...