Skip to content
Today
Sections

Topic

DNS Security

Field covering vulnerabilities, exploits, and defenses in the Domain Name System, spanning DNS server software, DNSSEC, and resolver attacks.

Current stories

securityOne report1 publisher

FBI drops Accenture as contractor over unpatched PeopleSoft that ShinyHunters breached

FBI dropped Accenture last week for failing to patch the Oracle PeopleSoft platform ShinyHunters breached, Reuters reported. Google separately says attackers hijacked the .as, .gh and .sl registries.

Publishers:news.risky.biz

Reality

Evidence40
Adoption
Not scored
Hype gap
Not scored
Incentives
Not scored
Confidence45
investConfirmed6 publishers

Andreessen Horowitz puts $38 million behind doxx.net's server-free networks for AI agents

Andreessen Horowitz led a $38 million Series A for doxx.net, a Miami startup building private networks for AI agents. The cash funds an open beta resting on one disclosed metric, the company's own count of more than 38 million potential threats blocked.

Publishers:cryptobriefing.com fintech.global helpnetsecurity.com runtimewire.com securityweek.com thesaasnews.com

Perspective Coverage

6 publishers
Builder
Builder 35%
Operator
Operator 30%
Investor
Investor 35%

Reality

Evidence45
Adoption12
Hype gap+40
Incentives75
Confidence60
buildOne report1 publisher

Unbound 1.26.1 fixes a DNSSEC heap overflow its vendor says could allow remote code execution

NLnet Labs' Unbound 1.26.1 fixes CVE-2026-81642, a DNSSEC heap overflow its vendor says could allow remote code execution. A related CoreDNS flaw in its newer transport listeners gives resolver operators a second check, this one in their configuration.

Publishers:dev.to

Reality

Evidence50
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence55
buildOne report1 publisher

Windows DNS Server's 9.8 bug takes one unauthenticated packet to port 53

Microsoft patched CVE-2026-69730, a CVSS 9.8 remote code execution flaw in the Windows DNS Server role reachable with one unauthenticated packet to port 53. In most Active Directory shops that role runs on the domain controller, so the box answering on port 53 also holds the identity database.

Publishers:dev.to

Reality

Evidence45
Adoption
Not scored
Hype gap+20
Incentives
Not scored
Confidence40
buildOne report1 publisher

Fourteen BIND flaws under one CERT-In HIGH rating belong in one planned patch window

CERT-In bundled 14 ISC BIND CVEs, including cache-poisoning and zone-data modification flaws, under one HIGH rating on 21 September 2026. The batch suits one planned upgrade window, provided recursion and zone transfers are locked down until it runs.

Publishers:dev.to

Reality

Evidence50
Adoption80
Hype gap+5
Incentives
Not scored
Confidence45
securityOne report1 publisher

A crafted DNSKEY overflows the heap in every Unbound release before 1.26.1

NLnet Labs shipped Unbound 1.26.1 on Wednesday with nine CVEs fixed, among them a DNSSEC validator overflow an attacker reaches with one query into a zone he controls. Debian's stable branches are still waiting.

Publishers:thehackernews.com

Reality

Evidence74
Adoption32
Hype gap+12
Incentives42
Confidence66
productOne report1 publisher

The cheapest attack surface is a domain someone else already made trustworthy

Astrolavos Lab counted 27,758 blacklisted and 238,279 malware-resolved domains that expired and were then maliciously re-registered, including an expired APT name.

Publishers:astrolavos.gatech.edu

Reality

Evidence52
Adoption31
Hype gap+12
Incentives58
Confidence44