news
Security Leftovers
-
LWN ☛ Security updates for Friday
Security updates have been issued by Debian (keystone and lxd), Fedora (docker-buildkit, firefox, gh, gitleaks, lasso, runc, and seamonkey), Mageia (perl-Authen-SASL, perl-Cpanel-JSON-XS, perl-Crypt-OpenSSL-RSA, perl-JSON-XS, python-flask-cors, python-py, python-setuptools, and ruby), Oracle (java-1.8.0-openjdk), SUSE (binutils, cargo-packaging, rust-bindgen, chromium, go-sendxmpp, helm, lasso, libxml2, openssh, openssh8.4, python-Django, python-Scrapy-doc, python311-Brotli, squid, tomcat10, and weblate), and Ubuntu (linux-nvidia-6.8, linux-oracle, linux-oracle-6.8 and linux-xilinx-zynqmp).
-
Trail of Bits ☛ How we avoided side-channels in our new post-quantum Go cryptography libraries
The Trail of Bits cryptography team is releasing our open-source pure Go implementations of ML-DSA (FIPS-204) and SLH-DSA (FIPS-205), two NIST-standardized post-quantum signature algorithms. These implementations have been engineered and reviewed by several of our cryptographers, so if you or your organization is looking to transition to post-quantum support for digital signatures, try them out!
This post will detail some of the work we did to ensure the implementations are constant time. These tricks specifically apply to the ML-DSA (FIPS-204) algorithm, protecting from attacks like KyberSlash, but they also apply to any cryptographic algorithm that requires branching or division.
-
Security Week ☛ Imunify360 Vulnerability Could Expose Millions of Sites to Hacking
A vulnerability in ImunifyAV can be exploited for arbitrary code execution by uploading a malicious file to shared servers.
-
Security Week ☛ Checkout.com Discloses Data Breach After Extortion Attempt
The information was stolen from a legacy cloud file storage system, not from its payment processing platform.
-
Security Week ☛ Washington Post Says Nearly 10,000 Employees Impacted by Oracle Hack
The media company admitted that cybercriminals attempted to extort a payment after stealing personal information.
-
Security Week ☛ Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability
Security firms say the flaw has been actively exploited for weeks, even as Fortinet quietly shipped fixes and CISA added the bug to its KEV catalog.
-
Security Week ☛ Akira Ransomware Group Made $244 Million in Ransom Proceeds
Akira was seen exploiting SonicWall vulnerabilities and encrypting Nutanix Acropolis Hypervisor (AHV) VM disk files this year.
-
Security Week ☛ In Other News: Deepwatch Layoffs, macOS Vulnerability, Amazon Hey Hi (AI) Bug Bounty
Other noteworthy stories that might have slipped under the radar: EchoGram attack undermines Hey Hi (AI) guardrails, Asahi brewer still crippled after ransomware attack, Sora 2 system prompt uncovered.