Security Leftovers and Windows TCO
-
OpenSSF (Linux Foundation) ☛ The OpenSSF Armored Goose “Honk”: Advancing Open Source Security
The Open Source Security Foundation (OpenSSF) logo presents a compelling visual narrative featuring “Honk”, an armored goose holding a shield. This unique and creative mascot perfectly embodies the foundation's mission in open source security. Why the goose?
-
LWN ☛ Security updates for Monday
Security updates have been issued by AlmaLinux (podman), Debian (guix, libarchive, and nss), Fedora (expat, iaito, opendmarc, python-werkzeug, radare2, squid, and xorg-x11-server), Mageia (htmldoc, libheif, nspr, nss, firefox & rust, python-urllib3, python-werkzeug, quictls, ruby-webrick, and thunderbird), Oracle (firefox and NetworkManager-libreswan), SUSE (apache2, chromedriver, chromium, coredns, expat, govulncheck-vulndb, httpcomponents-client, java-17-openjdk, java-21-openjdk, libheif, python-wxPython, python311, python312, qbittorrent, ruby3.3-rubygem-actionmailer, ruby3.3-rubygem-actiontext, ruby3.3-rubygem-puma, ruby3.3-rubygem-rails, and virtualbox), and Ubuntu (openjdk-17, openjdk-21, openjdk-8, openjdk-lts, and qemu).
-
Dark Reading ☛ Flexible Structure of Zip Archives Exploited to Hide Malware Undetected
Attackers abuse concatenation, a method that involves appending multiple zip archives into a single file, to deliver a variant of the SmokeLoader Trojan hidden in malicious attachments delivered via phishing
-
Bleeping Computer ☛ D-Link won’t fix critical flaw affecting 60,000 older NAS devices
More than 60,000 D-Link network-attached storage devices that have reached end-of-life are vulnerable to a command injection vulnerability with a publicly available exploit.
The flaw, tracked as CVE-2024-10914, has a critical 9.2 severity score and is present in the ‘cgi_user_add’ command where the name parameter is insufficiently sanitized.
An unauthenticated attacker could exploit it to inject arbitrary shell commands by sending specially crafted HTTP GET requests to the devices.
-
Audiocasts/Shows
-
The Cyber Show ☛ #031 | S4 | In The Chair | Digital Sovereignty and International Cyber-Relations
We continue the current season with an 'In the Chair' discussion episode, this time with Christian Have, CTO of Logpoint and former head of cyber affairs for Danish national police and intelligence. Some timely reflections on the state of international cyber-relations and very relevant to topical discussions for this month on the state of international affairs, technology, politics and sovereignty.
-
-
Windows TCO
-
NL Times ☛ DNB warns of rising cyber threats amid geopolitical tensions
The Dutch Central Bank (DNB) has issued a warning about rising cyber risks due to escalating geopolitical tensions. The announcement, part of DNB’s new supervisory strategy, highlights the risks that cyber threats, economic sanctions, and global trade shifts pose to banks, insurers, and pension funds.
-
[Repeat] The Register UK ☛ Windows Server 2025 snafu was like a supply chain attack
Let's start with Microsoft, which at the very least appears to have committed a self-induced supply chain attack on its own customers. The Windows Server 2025 complete OS upgrade was labeled as a security patch, the affected company claimed. People make mistakes, which is why you have automation that doesn't. Or you have people whose job it is to spot mistakes before pushing live. Or you have automation that spots mistakes before pushing live. Or, if you're a trillion-dollar company whose code runs quite a lot of the world, you have all three options.
-