Commercial Programs Analyst Intern

Red Hat OpenShift flaw lets attackers bypass PGP checks and push malicious releases. Red Hat has disclosed an Important security vulnerability in the OpenShift oc-mirror tool that could allow attackers to bypass PGP signature verification and introduce malicious release images into disconnected OpenShift environments. Tracked as CVE-2026-75939, the issue carries a CVSS v3.1 score of 7.4 and was made public on September 21, 2026. The flaw affects the openshift/oc-mirror component, which organizations use to copy OpenShift release images, operator catalogs, and related content into private registries. This process is particularly important for air-gapped or disconnected deployments, where systems cannot download software directly from Red Hat registries or the public internet. According to Red Hat, oc-mirror incorrectly validates PGP-signed release image signatures. The tool checks for signature errors before it has finished processing the entire signed message body. This creates a verification bypass condition in which a specially crafted PGP message may appear trusted even though its signature is forged. Red Hat OpenShift flaw. An attacker would need the ability to intercept or alter traffic between the affected oc-mirror instance and the signature endpoint. They could then provide a forged PGP message that contains a valid Red Hat release key ID. Because of the flawed validation sequence, the tool could accept the malicious message as legitimate and mirror a hostile release payload into a disconnected registry. This is a serious supply-chain risk because mirrored content is commonly treated as approved internal software. Once a malicious release image reaches the private registry, OpenShift administrators or automated installation pipelines could select it for deployment. That could expose clusters to unauthorized code execution, application tampering, credential theft, or data access. Red Hat rated the issue as Important and assigned it a network attack vector. The vulnerability does not require attacker privileges or user interaction. However, exploitation has high attack complexity because the attacker must successfully manipulate signature-related network traffic. Red Hat's CVSS vector lists high confidentiality and integrity impact, while availability impact is rated as none. The affected component is openshift4/oc-mirror-plugin-rhel9 in Red Hat OpenShift Container Platform 4. The RHEL 8 version of the plugin is listed as not affected because the component is not present. Red Hat noted that older package versions in affected minor product streams should generally be considered vulnerable unless explicitly marked otherwise. At the time of disclosure, Red Hat said no practical mitigation met its standard deployment and stability criteria. Organizations using oc-mirror should therefore treat release-mirroring workflows as high risk until security errata or updated packages are issued. Administrators should restrict network access to signature endpoints, enforce TLS inspection safeguards carefully, monitor for unusual changes in mirrored registry content, and validate release digests through independent trusted channels before promoting content into production. Teams should also review disconnected registry access controls, audit recent mirrored releases, and watch Red Hat's security advisories for remediation updates. Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC The post Red Hat OpenShift flaw lets attackers bypass PGP checks and push malicious releases appeared first on cyber security News. Related cyber security News posts. Red Hat published security advisory CVE-2025-10725, detailing an Important severity flaw in the OpenShift AI Service that could enable low-privileged attackers to elevate their permissions to full cluster administrator and compromise the entire platform. With a CVSS v3 base score of 9.9, this vulnerability poses a critical risk for organizations... In "Cybersecurity News - Original News Source is cybersecuritynews.com" A critical use-after-free vulnerability has been discovered in the Linux kernel's netfilter subsystem. This vulnerability could potentially allow local, unprivileged users with CAP_NET_ADMIN capability to escalate their privileges. The flaw, identified in the upstream commit 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane"), can cause a... In "Cybersecurity News - Original News Source is cybersecuritynews.com" Kubernetes security has its own shape admission control gating what deploys, network policy governing pod-to-pod traffic, runtime detection watching live workloads, and posture checking cluster configuration across modern multi-cloud security architectures. Sysdig and Aqua lead as specialists, Red Hat ACS owns OpenShift, and this category has the strongest open-source options... In "Cybersecurity News - Original News Source is cybersecuritynews.com"

CERN pivoting away 2200 computers from Red Hat to Debian. September 22, 2026 CERN is transitioning 2200 accelerator control computers from RHEL to Debian by the end of 2026. At MiniDebConf Winterthur, Conseil Européen pour la Recherche Nucléaire/ European Organization for Nuclear Research (CERN) engineers Federico Vaga and Nikos Tsipinakis detailed the organisation's plan for migrating over 2200 particle accelerator control computers and embedded systems from Red Hat Enterprise Linux (RHEL) to Debian 13 ('Trixie') by the end of this year. The primary trigger was Red Hat's progressive tightening of compiler microarchitecture baselines. CERN's accelerator infrastructure manages more than 2200 specialised front-end computers and 17,000 embedded devices. When Red Hat builds RHEL, it picks a minimum central processing unit (CPU) generation the software will run on. RHEL 9's upstream microarchitecture mandates already obsolete CERN's oldest boards, the kind running chips like Intel's legacy Core 2 Duo and Ivy Bridge, which comprise about 47 percent of their fleet. Staying on RHEL would force CERN to replace functional legacy hardware and redesign custom circuit boards at an estimated cost of CHF 5.4 million (US$6.58 million). CERN selected Debian because it supports older 64-bit hardware, offers a massive software library, and works well with industrial tools. Also, built-in real-time updates in the Linux kernel allow Debian to run time-sensitive systems without needing specialized software. The accelerator control group is targeting Debian 13 ('Trixie') with the completion of the migration slated for the fourth quarter of 2026. Both CERN engineers emphasised that the migration is strictly scoped to accelerator control hardware; in other words, CERN's petabyte-sized compute farms and Tier-0 grid infrastructure will continue on AlmaLinux and RHEL.

Online education business Coursera hires ex-Red Hat GC as CLO. Tom Savage replaces GC Alan Cardenas, who is leaving the company at the end of the year 22 September 2026 Tom Savage Online learning platform Coursera has hired Tom Savage as chief legal officer to replace current legal head Alan Cardenas, who is stepping down later this year. Savage was previously general counsel at software business Red Hat. Greg Hart, CEO of Coursera, said: "[Savage] brings a phenomenal track record and deep experience working with community-focused technology companies, and he'll be a great addition to our leadership team as we continue to scale and serve our learners, customers and partners worldwide." Savage spent more than eight years as GC at Red Hat, latterly as part of IBM. Prior to joining Red Hat, he was GC at semiconductor business Marvell Technology - his first in-house role. Advertisement He was previously a partner at Wilson Sonsini Goodrich & Rosati in Palo Alto, his second stint at the firm following two years as counsel at legacy firm Shearman & Sterling. He started his legal career at Sidley Austin in Chicago. Savage said: "My entire career has been focused on helping technology companies create more opportunities for everyone, and I'm honoured to join Coursera at such a pivotal moment for the company and industry. I look forward to working with the entire leadership team in finding new ways to serve our growing community of learners and customers worldwide, and supporting Coursera's mission in the years ahead." Cardenas, meanwhile, is stepping down after five years with the company, just over three of them as GC. Cardenas will remain as GC until the end of the year to support Savage in his new role. Cardenas said: "Being part of Coursera's journey - through our early months as a public company to the successful close of the Udemy combination - has been one of the most rewarding chapters in my career, particularly the legal team we built along the way to support Coursera's expanding role in the world. LAW OVER BORDERS COMPARATIVE GUIDES The New World of Foreign Direct Investment Law Guide Historic attitudes favouring globalisation are fundamentally changing... | 3yrs. "I'm confident that I'm leaving the team in excellent hands with Tom. I look forward to supporting a smooth transition and spending more time with family before turning to the next chapter of my career." Prior to joining Coursera, Cardenas was head of corporate legal at Siemens Energy, having spent more than a decade at Siemens in a number of legal roles. He previously worked in private practice at Drinker Biddle & Reath and Debevoise & Plimpton. In other education-related in-house moves, back in August AI workforce training platform Skillsoft named former Pegasystems GC Matthew Cushing as CLO, replacing interim legal chief Scott Semel.