Security Leftovers

posted by Roy Schestowitz on Jan 10, 2026

• Collecting Badges, Building Bridges: Representing OpenSSF and 'Linux' Foundation Across Europe

  There is a particular feeling that comes with wearing a conference badge that carries more weight than your name. It is the quiet awareness that you are not just attending an event; you are representing a global community, its values, and its future direction.

• AI noise and the effect it’s having on vulnerability disclosure programs

  Managing vulnerability reports is difficult for an organisation.  In an ideal world, something like this happens:  Everyone is happy.  In practice, things are rarely this smooth. 

• Exploit for VMware Zero-Day Flaws Likely Built a Year Before Public Disclosure

  Fresh attacks targeted three VMware ESXi vulnerabilities that were disclosed in March 2025 as zero-days.

• Palo Alto Crosswalk Signals Had Default Passwords

  Palo Alto’s crosswalk signals were hacked last year. Turns out the city never changed the default passwords.

• 377,000 Impacted by Data Breach at Texas Gas Station Firm

  Gulshan Management Services has informed authorities about a recent data breach resulting from a ransomware attack.

• FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes

  The North Korean state-sponsored espionage group Kimsuky has targeted government organizations, think tanks, and academic institutions.

• CISA Closes 10 Emergency Directives as Vulnerability Catalog Takes Over

  The Emergency Directives were retired because they achieved objectives or targeted vulnerabilities included in the KEV catalog.

• Trend Micro Patches Critical Code Execution Flaw in Apex Central

  Tenable has released PoC code and technical details after the vendor announced the availability of patches for three vulnerabilities.

• Malicious Process Environment Block Manipulation, (Fri, Jan 9th)

  Reverse engineers must have a good understanding of the environment where malware are executed (read: the operating system).

• InputPlumber: Lack of D-Bus Authorization and Input Verification allows UI Input Injection and Denial-of-Service (CVE-2025-66005, CVE-2025-14338)

  InputPlumber is a utility for combining GNU/Linux input devices into virtual input devices. It is mostly used in the context of Linux gaming and is part of SteamOS.

  An openSUSE community member packaged InputPlumber which required a review by the SUSE security team, as it contains a D-Bus system service. The first version of InputPlumber we reviewed was completely lacking client authentication, causing us to reject it. A follow-up version contained Polkit authentication, which turned out to be lacking in multiple regards. At this point we approached upstream with a detailed report and established coordinated disclosure. Starting with version v0.69.0 of InputPlumber most (but not all) of the issues in this report have been addressed. SteamOS also published new images for version 3.7.20 containing the fixes.

• Security updates for Friday

  Security updates have been issued by Debian (pdfminer and vlc), Red Hat (kernel, kernel-rt, and microcode_ctl), Slackware (libtasn1), SUSE (apptainer, curl, ImageMagick, libpcap, libvirt, libwget4, php8, podman, python311-cbor2, qemu, and rsync), and Ubuntu (gnupg, gnupg2, gpsd, libsodium, and python-tornado).