Security Leftovers

posted by Roy Schestowitz on May 27, 2026

• qSnapper: Various Security Issues in Privileged D-Bus Service (CVE-2026-41045 through CVE-2026-41048)

  qSnapper is a GUI frontend for the snapper utility for managing Btrfs filesystem snapshots. In April we received a review request for qSnapper, because it contains a privileged D-Bus service and Polkit policies.

• Security Week ☛ Open Source DockSec Uses Hey Hi (AI) to Cut Through Vulnerability Noise in Docker Images

  DockSec, an OWASP incubator project, correlates findings from multiple container security scanners and uses Hey Hi (AI) to generate plain-English remediation guidance and exact Dockerfile fixes.

• LWN ☛ Security updates for Tuesday

  Security updates have been issued by Debian (postorius and spip), Fedora (bind, bind-dyndb-ldap, linux-firmware, tor, and unbound), Mageia (ffmpeg, nginx, perl-Imager, and tigervnc, x11-server, x11-server-xwayland), Oracle (firefox and kernel), Red Hat (buildah, git-lfs, go-toolset:rhel8, golang, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, gvisor-tap-vsock, java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, opentelemetry-collector, osbuild-composer, podman, rhc, rhc-worker-playbook, skopeo, and yggdrasil), SUSE (amazon-ecs-init, assimp, azure-storage-azcopy, busybox, firefox, gnutls, graphicsmagick, helm, kernel, leancrypto, libpng16, libppsdocument4_0-6, libsndfile, mcphost, nano, nginx, perl-http-tiny, perl-XML-LibXML, python-urllib3, python-urllib3_1, python311-ocrmypdf, python312, rclone, rsync, xen, and xz), and Ubuntu (dotnet8, dotnet9, dotnet10, linux-intel-iot-realtime, linux-lowlatency, linux-nvidia-6.8, linux-nvidia-tegra, linux-nvidia-tegra-igx, nltk, simpleeval, and vim).

• Olaf Alders ☛ Enabling Private Vulnerability Reporting

  With the rise of LLM usage, the number of vulnerabilities being found in Open Source Software libraries is climbing – perhaps more than you might think. Finding vulnerabilities is getting easier, but reporting them to maintainers can be a bottleneck. One way to help streamline the process is by enabling “Private vulnerability reporting” on your Microsoft's proprietary prison GitHub repositories.

• Security Week ☛ Iranian APT Targets Aviation, Software Companies With Updated Tools

  Nimbus Manticore has continued its operations during and after the US military campaign against Iran.

• Security Week ☛ Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register Entries

  Lithuanian authorities are on high alert after a massive data leak involving more than 600,000 entries from national data registers.

• Security Week ☛ 185,000 Likely Impacted by 7-Eleven Data Breach

  The allegedly stolen information leaked by ShinyHunters contains email addresses, names, addresses, and dates of birth.

• Scoop News Group ☛ White House charts new course for federal agencies and cybersecurity logging

  Convicted Felon administration memo published last week replaces one from its predecessor, with at least one analyst fearful of potential harmful results.

• Security Week ☛ Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment

  Hardcoded machineKey values in a configuration file enabled ViewState deserialization attacks leading to remote code execution.

• Hacker News ☛ ⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos

• StreetInsider ☛ CIQ and Binarly Partner to Deliver Binary and Firmware-Level Security for Enterprise Linux

  CIQ, the founding commercial sponsor of Rocky Linux and provider of enterprise infrastructure solutions, today announced a strategic partnership with Binarly, the company behind the Transparency Platform for software supply chain security, to extend binary-level analysis and firmware vulnerability detection into Enterprise Linux environments.

• CIQ adds Security partnership for Rocky Linux with Binarly

  CIQ has announced a strategic partnership with Binarly to deliver binary and firmware security for Enterprise Linux. Within the partnership, Binarly has committed to extending its binary-level analysis and firmware vulnerability detection into the Rock Linux platform.

• Windows TCO / Windows Bot Nets

  • Pen Test Partners ☛ Shelly Wall Display exposed RPC over Bluetooth

    TL;DR  Background  I recently wrote a blog post on the Shelly Gen 4 open access point issue.