news
Security Leftovers
-
LWN ☛ Security updates for Monday
Security updates have been issued by AlmaLinux (firefox, grafana, kernel, libsoup3, mysql8.4, and wireshark), Debian (ruby-git, ruby-sidekiq, thunderbird, and vlc), Fedora (apptainer, chromium, firefox, golangci-lint, libpng, and xkbcomp), Mageia (golang), SUSE (binutils, chromium, firefox, gegl, go1.25, govulncheck-vulndb, hauler, kernel, keylime, libpng12, pgadmin4, postgresql16, python, python-Django, python-django, python3, python311, rhino, thunderbird, unbound, and xkbcomp), and Ubuntu (usbmuxd).
-
It's FOSS ☛ Check Your Snap Packages for Vulnerabilities With This Vibe-Coded Tool [Ed: Slop promotes by It's FOSS seems like a new low. Yes, use a tool made by someone who cannot code or cannot be bothered to code.]
Snapscope makes it easy to scan any Snap package for security issues.
-
Trail of Bits ☛ Use GWP-ASan to detect exploits in production environments
Memory safety bugs like use-after-free and buffer overflows remain among the most exploited vulnerability classes in production software. While AddressSanitizer (ASan) excels at catching these bugs during development, its performance overhead (2 to 4 times) and security concerns make it unsuitable for production. What if you could detect many of the same critical bugs in live systems with virtually no performance impact?
-
Security Week ☛ 700Credit Data Breach Impacts 5.8 Million Individuals
Hackers stole names, addresses, dates of birth, and Social Security numbers from the credit report and identity verification services provider.
-
Security Week ☛ Third DraftKings Hacker Pleads Guilty
Nathan Austad admitted in court to launching a credential stuffing attack against a fantasy sports and betting website.
-
Security Week ☛ Apple Patches Two Zero-Days Tied to Mysterious Exploited Chrome Flaw
Apple has released macOS and iOS updates to patch two WebKit zero-days exploited in an “extremely sophisticated” attack.
-
Security Week ☛ Google Sees 5 Chinese Groups Exploiting React2Shell for Malware Delivery
Google has also mentioned seeing React2Shell attacks conducted by Iranian threat actors.
-
Security Week ☛ Atlassian Patches Critical Apache Tika Flaw
Atlassian has released software updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira.