news
Security Leftovers
-
LWN ☛ Security updates for Tuesday
Security updates have been issued by AlmaLinux (gstreamer1-plugins-bad-free, libsoup, and python-tornado), Debian (libavif and pgbouncer), Red Hat (gstreamer1-plugins-bad-free, mingw-freetype and spice-client-win, and webkit2gtk3), SUSE (firefox, govulncheck-vulndb, and python310-setuptools), and Ubuntu (flask, intel-microcode, openjdk-17-crac, tika, and Tomcat).
-
Pen Test Partners ☛ Our capabilities. A story about what we can achieve
Over the years we have been fortunate to have been called upon to help with some challenging investigations.
-
Silicon Angle ☛ Report: Most of CISA’s senior leaders are leaving the agency
Most of the senior leaders at the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, have left or will do by the end of the month. Cybersecurity Dive reported the development today, citing an internal agency memo sent last week.
-
Atlantic Council ☛ Michta featured in RealClearDefense on concrete actions to strengthen NATO’s resolve amid shifting geopolitics
On May 21, 2025, Andew Michta, senior fellow in the GeoStrategy Initiative, was highlighted in RealClearDefense on a report on how NATO can deter Russian aggression without an overreliance on US military power, which he co-authored with Scott Lee, Peter Jones, and Lisa Bembenick of MITRE.
-
SANS ☛ Securing Your SSH authorized-keys File, (Tue, May 27th)
This is nothing "amazingly new", but more of a reminder to secure your "authorized_keys" file for SSH. One of the first things I see even simple bots do to obtain persistent access to a UNIX system is to add a key to the authorized-keys file of whatever account they are compromising.
-
Windows TCO / Windows Bot Nets
-
Security Week ☛ Law Firms Warned of Silent Ransom Group Attacks
The FBI warns US law firms that the Silent Ransom Group (SRG) has been constantly targeting the legal industry.
-
Security Week ☛ Ongoing Campaign Uses 60 NPM Packages to Steal Data [Ed: This is about Microsoft transmitting malware to people, i.e. the usual]
Security firm Socket warns flags a campaign targeting NPM users with tens of malicious packages that can hijack system information.
-
Security Week ☛ DragonForce Ransomware Hackers Exploiting SimpleHelp Vulnerabilities
Sophos warns that a DragonForce ransomware operator chained three vulnerabilities in SimpleHelp to target a managed service provider.
-
Security Week ☛ Iranian Man Pleads Guilty to Role in Baltimore Ransomware Attack
Sina Gholinejad pleaded guilty to computer-fraud and wire-fraud-conspiracy charges linked to the Robbinhood ransomware hit on Baltimore.
-