news
Security Leftovers
-
Daniel Stenberg ☛ Open Source security in spite of AI
The title of my ending keynote at FOSDEM February 1, 2026. As the last talk of the conference, at 17:00 on the Sunday lots of people had already left, and presumably a lot of the remaining people were quite tired and ready to call it a day.
-
Wladimir Palant ☛ Supporting Wayland’s XDG activation protocol with Gtk/Glib
One of the biggest sore points with Wayland is its focus stealing protection. The idea is good: an application should not be able to bring itself into focus at an unexpected time, only when the currently active application allows it. Support is still lacking however, which might also be due to Gtk/Glib implementing the required XDG activation protocol but not really documenting it. It took me a bit of time to figure this out without any public information, this article will hopefully make things easier for other people.
-
LWN ☛ Security updates for Tuesday
Security updates have been issued by AlmaLinux (fence-agents, gcc-toolset-15-binutils, golang-github-openprinting-ipp-usb, iperf3, kernel, kernel-rt, openssl, osbuild-composer, php:8.2, python3, util-linux, and wireshark), Debian (clamav and xrdp), Fedora (gimp and openttd), Mageia (docker-containerd), Oracle (gimp:2.8, golang-github-openprinting-ipp-usb, grafana-pcp, image-builder, iperf3, kernel, openssl, osbuild-composer, php, php:8.2, php:8.3, python3.9, util-linux, and wireshark), SUSE (cockpit-subscriptions, elemental-register, elemental-toolkit, glibc, gpg2, logback, openssl-1_1, python-urllib3, ucode-amd, and unbound), and Ubuntu (inetutils, libpng1.6, mysql-8.0, mysql-8.4, openjdk-17, openjdk-17-crac, openjdk-21, openjdk-21-crac, openjdk-25, openjdk-25-crac, openjdk-8, openjdk-lts, and thunderbird).
-
Security Week ☛ Critical React Native Vulnerability Exploited in the Wild
Albeit mainly considered a theoretical risk, the flaw has been exploited to disable protections and deliver malware.
-
OpenSSF (Linux Foundation) ☛ What’s in the SOSS? Podcast #50 – S3E2 Demystifying the CFP Process with KubeCon North America Keynote Speakers
-
Security Week ☛ Vulnerability Allows Hackers to Hijack OpenClaw Hey Hi (AI) Assistant
OpenClaw (aka Moltbot and Clawdbot) is vulnerable to one-click remote code execution attacks.
-
Security Week ☛ Hackers Leak 5.1 Million Panera Bread Records
ShinyHunters has claimed the theft of 14 million records from the US bakery-cafe chain’s systems.
-
LinuxInsider ☛ Weaponized Python and Linux Malware Target Executives and Cloud Systems
Two newly uncovered malware campaigns are exploiting open-source software across Windows and Linux environments to target enterprise executives and cloud systems, signaling a sharp escalation in both social engineering and kernel-level attack sophistication.