news
Security Leftovers
-
Security Week ☛ isVerified Emerges From Stealth With Voice Deepfake Detection Apps
isVerified provides Android and iOS mobile applications designed to protect enterprise communications.
-
LWN ☛ A 0-click exploit chain for the Pixel 9 (Project Zero)
The Project Zero blog has a
three-part series describing a working, zero-click exploit for
Pixel 9 devices.
-
Tom's Hardware ☛ Beijing blocks Chinese entities from using U.S. and Israeli cybersecurity software — VMWare and Fortinet among the affected vendors
China tells entities to ditch U.S. and Israeli cybersecurity software
-
Security Week ☛ Traveler Information Stolen in Eurail Data Breach
Hackers stole the personal and reservation information of people with a Eurail pass and those who made a seat reservation with the company.
-
Security Week ☛ Central Maine Healthcare Data Breach Impacts 145,000 Individuals
Hackers stole patients’ personal, treatment, and health insurance information from the organization’s IT systems.
-
Security Week ☛ Depthfirst Raises $40 Million for Vulnerability Management
The startup will use the investment to accelerate R&D, expand go-to-market efforts, and hire new talent.
-
Security Week ☛ New ‘StackWarp’ Attack Threatens Confidential VMs on AMD Processors [Ed: "Confidential VMs" was always a scam, more like a giant back door]
Researchers have disclosed technical details on a new AMD processor attack that allows remote code execution inside confidential VMs.
-
Bruce Schneier ☛ New Vulnerability in n8n
This isn’t good:
We discovered a critical vulnerability (CVE-2026-21858, CVSS 10.0) in n8n that enables attackers to take over locally deployed instances, impacting an estimated 100,000 servers globally. No official workarounds are available for this vulnerability. Users should upgrade to version 1.121.0 or later to remediate the vulnerability.
-
Security Week ☛ ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Aveva, Phoenix Contact
Only a dozen new advisories have been published this Patch Tuesday by industrial giants.
-
WordPress ☛ WordPress Playground Brings Speed, Stability, and Momentum
WordPress Playground had a busy year in 2025, with updates that make it more capable for day-to-day development, plugin previews, and learning environments. The project’s latest year-in-review highlights progress across performance, compatibility, database support, and tooling, expanding what can be done in a WordPress environment that runs in the browser and through the command line.
-
OpenSSF (Linux Foundation) ☛ OpenSSF’s 2026 Themes: A Community Roadmap for Securing the Future of Open Source
Each year, the Open Source Security Foundation (OpenSSF) focuses its content and engagement on the security topics that matter most to the open source community. In 2026, we are organizing content around quarterly themes that reflect community priorities, global policy developments, and real-world security needs.
-
LWN ☛ Security updates for Thursday
Security updates have been issued by Debian (chromium, gnupg2, and mongo-c-driver), Fedora (firefox, gpsd, linux-firmware, and seamonkey), Mageia (net-snmp), Oracle (kernel, podman, postgresql16, postgresql:13, postgresql:15, postgresql:16, and uek-kernel), Red Hat (libpq, net-snmp, and transfig), Slackware (libpng and mozilla), SUSE (avahi, bluez, capstone, curl, dpdk, firefox, firefox-esr, fluidsynth, glib2, kernel, kernel-devel, libmicrohttpd, libpcap, libpng16, libsoup, libsoup-3_0-0, libtasn1, libvirt, mcphost, openvswitch, ovmf, podman, poppler, python-tornado6, python311, qemu, rsync, and valkey), and Ubuntu (erlang, klibc, libpng1.6, and ruby-rack).
-
I Programmer ☛ Linux Demonstrates That Bugs Can Hide For 20 years!
A very nice analysis of Linux commits reveals some interesting things about bugs - and how long they take to fix isn't the most interesting.
Jenny Guanni Qu, a researcher at Pebblebed, has written some code to find out how long it takes to find a Linux bug with some very interesting conclusions. If you want the details and many observations then read her blog post with the title "Kernel bugs hide for 2 years on average. Some hide for 20". This is data mining at its best. I just want to say a few things that occurred to me as interesting.