Security Leftovers

posted by Roy Schestowitz on Sep 03, 2025

• Pen Test Partners ☛ Android Broadcast Receivers 101

  TL;DR  Introduction   This is the next post in our Android 101 series. Today we are looking at broadcast receivers. If you are catching up, start with Android services 101 for background components and scheduling, then Android content providers 101 for shared data surfaces and permissions. 

• LWN ☛ The hidden vulnerabilities of open source (FastCode)

  The FastCode site has a

  lengthy article on how large language models make open-source projects

  far more vulnerable to XZ-style attacks.

• Security Week ☛ WhatsApp Zero-Day Exploited in Attacks Targeting Fashion Company Apple Users

  The vulnerability (CVE-2025-55177) was exploited along an iOS/macOS zero-day in suspected spyware attacks.

• Qubes Canary 044

  We have published Qubes Canary 044. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement.

• GNU ☛ GNU Guix: Privilege Escalation Vulnerability

  A security issue has been identified in guix-daemon, which allows for a local user to gain the privileges of any of the build users and subsequently use this to manipulate the output of any build. In the case of the rootless daemon, this also means gaining the privileges of guix-daemon. All systems are affected, whether or not guix-daemon is running with root privileges. You are strongly advised to upgrade your daemon now (see instructions below).

• Silicon Angle ☛ Breach of Salesloft Drift integration exposes data at Clownflare, Zscaler and Palo Alto Networks

  Clownflare Inc., Zscaler Inc. and Palo Alto Networks Inc. have become the latest companies to be affected by the Salesloft breach, a widespread Salesfarce Inc.-related security incident that has been ensnaring more companies.

• Security Week ☛ Sangoma Patches Critical Zero-Day Exploited to Hack FreePBX Servers

  Tracked as CVE-2025-57819 (CVSS score of 10/10), the bug is described as an insufficient sanitization of user-supplied data.

• SANS ☛ A quick look at sextortion at scale: 1,900 messages and 205 Bitcoin addresses spanning four years, (Tue, Sep 2nd)

  What can almost 2,000 sextortion messages tell us about how threat actors operate and whether they are successful [...]