diff --git a/.gitignore b/.gitignore
index c395426..d1ebd88 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,4 +19,4 @@ SOURCES/rexml-3.4.1.gem
 SOURCES/ruby2_keywords-0.0.5.gem
 SOURCES/sinatra-2.2.4.gem
 SOURCES/tilt-2.3.0.gem
-SOURCES/tornado-6.1.0.pcs.2.tar.gz
+SOURCES/tornado-v6.1.0.pcs.3.tar.gz
diff --git a/.pcs.metadata b/.pcs.metadata
index a0929d6..9fee833 100644
--- a/.pcs.metadata
+++ b/.pcs.metadata
@@ -19,4 +19,4 @@ ae09ea83748b55875edc3708fffba90db180cb8e SOURCES/rack-test-2.1.0.gem
 d017b9e4d1978e0b3ccc3e2a31493809e4693cd3 SOURCES/ruby2_keywords-0.0.5.gem
 fa6a6c98f885e93f54c23dd0454cae906e82c31b SOURCES/sinatra-2.2.4.gem
 4a38a9a55887b2882182a2c5771e592efe514e5e SOURCES/tilt-2.3.0.gem
-3e0fc1e17c45a8e25bdd6ade8dbbc522f64f2ae1 SOURCES/tornado-6.1.0.pcs.2.tar.gz
+1f4e55c234da0b22aac09cca5a971c4ec2cb500a SOURCES/tornado-v6.1.0.pcs.3.tar.gz
diff --git a/SPECS/pcs.spec b/SPECS/pcs.spec
index 73a5b96..30a9e9e 100644
--- a/SPECS/pcs.spec
+++ b/SPECS/pcs.spec
@@ -1,6 +1,6 @@
 Name: pcs
 Version: 0.10.18
-Release: 2%{?dist}.7.alma.1
+Release: 2%{?dist}.8.alma.1
 # https://docs.fedoraproject.org/en-US/packaging-guidelines/LicensingGuidelines/
 # https://fedoraproject.org/wiki/Licensing:Main?rd=Licensing#Good_Licenses
 # GPL-2.0-only: pcs
@@ -55,7 +55,7 @@ ExclusiveArch: i686 x86_64 s390x ppc64le aarch64
 
 # DO NOT UPDATE
 # Tornado 6.2 requires Python 3.7+
-%global tornado_version    6.1.0.pcs.2
+%global tornado_version    6.1.0.pcs.3
 
 %global pcs_bundled_dir pcs_bundled
 %global pcsd_public_dir pcsd/public
@@ -87,7 +87,7 @@ Source0: %{url}/archive/%{?v_prefix}%{version_or_commit}/%{pcs_source_name}.tar.
 Source1: HAM-logo.png
 
 Source41: https://github.com/ondrejmular/pyagentx/archive/v%{pyagentx_version}/pyagentx-%{pyagentx_version}.tar.gz
-Source42: https://github.com/CtrlZmaster/tornado/archive/v%{tornado_version}/tornado-%{tornado_version}.tar.gz
+Source42: tornado-v%{tornado_version}.tar.gz
 Source43: https://github.com/ericvsmith/dataclasses/archive/%{dataclasses_version}/dataclasses-%{dataclasses_version}.tar.gz
 Source44: https://github.com/konradhalas/dacite/archive/v%{dacite_version}/dacite-%{dacite_version}.tar.gz
 Source45: https://pypi.python.org/packages/source/p/python-dateutil/python-dateutil-%{dateutil_version}.tar.gz
@@ -565,9 +565,13 @@ remove_all_tests
 %license pyagentx_LICENSE.txt
 
 %changelog
-* Fri Nov 07 2025 Eduard Abdullin <eabdullin@almalinux.org> - 0.10.18-2.7.alma.1
+* Fri Jan 23 2026 Eduard Abdullin <eabdullin@almalinux.org> - 0.10.18-2.8.alma.1
 - Debrand logo
 
+* Mon Jan 19 2026 Michal Pospíšil <mpospisi@redhat.com> - 0.10.18-2%{?dist}.8
+- Fixed CVE-2025-67725, CVE-2025-67726 by patching bundled Tornado
+  Resolves: RHEL-136415, RHEL-136420
+
 * Wed Oct 22 2025 Michal Pospíšil <mpospisi@redhat.com> - 0.10.18-2%{?dist}.7
 - Fixed CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919 by updating bundled rubygem rack
   Resolves: RHEL-120432, RHEL-120939, RHEL-121033, RHEL-123639, RHEL-124936