For providers

The attack uses malicious Google search results related to Amazon and leverages the "finger" utility to launch a CAPTCHA that installs malware, including the Lumma stealer.

The BIND 9 Software Vulnerability Matrix details known security vulnerabilities in supported versions of BIND. Vulnerabilities are identified by their CVE ID: Common Vulnerabilities and Exposures. This page was previously called the "BIND 9 Security Vulnerability Matrix". Using this matrix Each row with a CVE ID gives the version(s) that fix that problem. Determining vulnerability To determine if/how a given version is vulnerable: Find the column heading for the corresponding branch (9.X versi ...

The vulnerability matrix for each obsolete branch of BIND is kept available for historical reference. For currently supported releases, see the BIND 9 Software Vulnerability Matrix instead. SECURITY WARNING Obsolete versions of BIND are all known to be vulnerable. ISC strongly recommends upgrading to a current version as soon as practical. The obsolete matrices will not be updated to reflect new vulnerabilities. You must assume you are vulnerable if you are running an obsolete version. For ...

SECURITY WARNING BIND 9.18 is obsolete. Obsolete versions of BIND are all known to be vulnerable. ISC strongly recommends upgrading to a current version as soon as practical. The obsolete matrices will not be updated to reflect new vulnerabilities. You must assume you are vulnerable if you are running an obsolete version. The BIND 9 Software Vulnerability Matrix details known security vulnerabilities in version 9.18 of BIND during that branch's support life. Vulnerabilities are identified ...

Introduction This is a complete list of all BIND security advisories, both current and historical. Advisories apply only to particular versions of BIND, and this list makes no attempt to differentiate. For information on which versions are vulnerable, see the BIND 9 Software Vulnerability Matrix instead. Advisories are listed by date, most recent first. The publication date is the date of formal public disclosure. In this table, publication dates prior to 2022 may not be entirely accurate; ...

CVE: CVE-2026-97313 Title: Specific RPZ configurations and query patterns may result in an unexpected exit Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.16.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive q ...

CVE: CVE-2026-96888 Title: Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.16.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.16.8-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: A BIND resolver that is configured with both a "redirect" zone and "qname-minimization stric ...

CVE: CVE-2026-94300 Title: Concurrent GSS-TSIG messages corrupt memory Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.11.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP messa ...