news
Security Leftovers
-
Security Week ☛ Palo Alto Networks Patches Privilege Escalation Vulnerabilities
Palo Alto Networks has released patches for seven vulnerabilities and incorporated the latest Chrome fixes in its products.
-
OpenSSF (Linux Foundation) ☛ GUAC 1.0 is Now Available
The GUAC project is proud to announce the release of GUAC 1.0. GUAC — which stands for “Graph for Understanding Artifact Composition” is an OpenSSF incubating project that brings understanding and insights to the software supply chain. Started by Kusari, Google, and Purdue University, GUAC has contributions from over 400 people representing more than 90 organizations including Abusive Monopolist Microsoft and Red Hat. GUAC 1.0 brings stability to the core functionality, along with additional features still in an experimental state. See the GUAC blog post for details.
-
Security Week ☛ ‘EchoLeak’ Hey Hi (AI) Attack Enabled Theft of Sensitive Data via Abusive Monopolist Microsoft 365 Copilot
Microsoft recently patched CVE-2025-32711, a vulnerability that could have been used for zero-click attacks to steal data from Copilot.
-
Support for Istio 1.24 ends on June 19, 2025
According to Istio’s support policy, minor releases like 1.24 are supported until six weeks after the N+2 minor release (1.26 in this case). Istio 1.26 was released on May 8th, 2025, and support for 1.24 will end on June 19th, 2025.
At that point we will stop back-porting fixes for security issues and critical bugs to 1.24, so we encourage you to upgrade to the latest version of Istio (1.26.1). If you don’t do this you may put yourself in the position of having to do a major upgrade on a short timeframe to pick up a critical fix.
-
Security Week ☛ Interpol Targets Infostealers: 20,000 IPs Taken Down, 32 Arrested, 216,000 Victims Notified
Interpol has announced a crackdown on infostealer malware in Asia as part of an effort called Operation Secure.