Meltdown and Spectre have raised awareness of the danger of hardware and firmware vulnerabilities. Here's a roundup of the ones that present the most significant threats.
A high-risk RCE bug impacting PHP-based websites running a vulnerable version of the web-app creation tool Zend Framework and some Laminas Project releases has been discovered and disputed by Zend. Regardless of the dispute, Zend has issued a patch addressing this vulnerability which "provides type checking of the $streamName property before performing a cleanup operation (which results in an unlink() operation, which, previously, could have resulted in an implied call to an an object’s __toString() method) in the Laminas\Http\Response\Stream destructor".
The new PLATYPUS attack can be used to access and leak encryption keys and other sensitive information from the Linux kernel's memory or Intel SGX enclaves. In response to PLATYPUS, Linux kernel developers have released a security update that revokes unprivileged access to energy consumption data.
