news
Security Leftovers
-
GNOME ☛ Michael Catanzaro: Single-Click Code Execution Exploit for Evince, Atril, and Xreader
CVE-2026-46529 is an argument injection vulnerability in Evince, Atril, and Xreader caused by missing shell quoting when composing a command line. The reporter, João Medeiros, has published a GitHub repo for the CVE and a blog post with the story of how he discovered the flaw and developed the exploit.
-
Security Week ☛ Laravel-Lang Packages Poisoned for Malware Delivery
Published within a 15-minute window, the malicious tags introduced backdoors to exfiltrate CI secrets.
-
LWN ☛ Security updates for Monday
Security updates have been issued by Debian (atril, evince, gnutls28, haproxy, haveged, jq, kernel, krb5, libgcrypt20, nodejs, and thunderbird), Fedora (aw-server-rust, awatcher, bind, bind-dyndb-ldap, chromium, composer, docker-buildkit, docker-buildx, dotnet10.0, dotnet8.0, dotnet9.0, evince, firefox, httpd, kernel, nodejs-aw-webui, nss, perl-Apache-Session-Browseable, pie, python-pulp-glue, python-requests, and python3.15), Slackware (kernel), SUSE (apptainer, chromium, cockpit, dnsmasq, google-guest-agent, hauler, iproute2, jfrog-cli, kernel, libecpg6, libsolv, libzypp, zypper, mcphost, oci-cli, perl-YAML-Syck, python-lxml, python-urllib3, python311-impacket, rqlite, rsync, util-linux, and xz), and Ubuntu (evince, linux-azure, linux-azure-5.4, linux-azure-fips, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp-5.15, linux-lowlatency-hwe-5.15, linux-oracle-6.17, node-path-to-regexp, and rclone).
-
SANS ☛ Possible ACR Stealer From Page Impersonating Claude, (Tue, May 26th)
-
Confidentiality
-
Security Week ☛ DocketWise Data Breach Impacts 143,000
Hackers accessed names, addresses, Social Security numbers, financial information, and medical data from third-party partner repositories.
-
Security Week ☛ 266,000 Affected by Data Breach at Radiology Associates of Richmond
Threat actors stole files containing names and protected health information from the healthcare organization’s systems.
-
Security Week ☛ Oncology Institute Discloses Data Breach
The affected third-party vendor has not been named, but one possible candidate is TriZetto.
-
LRT ☛ Lithuania investigates massive data breach, suspects foreign intelligence operation
More than 600,000 records have been stolen from Lithuania's Centre of Registers, the state agency responsible for managing property and personal data. Prosecutors have opened an investigation, saying the unauthorised access may have originated from a foreign state.
-
-
Windows TCO / Windows Bot Nets
-
SANS ☛ Microsoft Access VBA, (Mon, May 25th)
-
Entrapment (Microsoft GitHub)
-
SANS ☛ TeamPCP Supply Chain Campaign: Activity Through 2026-05-24, (Mon, May 25th)
TeamPCP now operates across three package ecosystems in parallel, it reached Microsoft's proprietary prison GitHub [...]
-
Security Week ☛ Over 5,500 Microsoft's proprietary prison GitHub Repositories Infected in ‘Megalodon’ Supply Chain Attack
Fake automated commits injected Microsoft's proprietary prison GitHub Actions workflows containing payloads to steal credentials, CI secrets, keys, and tokens.
-
-