news
Security Leftovers
-
LWN ☛ Security updates for Monday
Security updates have been issued by AlmaLinux (.NET 9.0), Debian (apache2, chromium, jpeg-xl, librabbitmq, and openssl), Fedora (apptainer, bind9-next, chezmoi, chromium, collectd, composer, dnsdist, gh, python-django5, python-python-multipart, varnish, varnish-modules, vmod-querystring, vmod-uuid, weasyprint, and xorg-x11-server-Xwayland), Mageia (cups, expat, libpng, libssh, memcached, nghttp2, openimageio, packages, proftpd, and radare2), Oracle (.NET 10.0, .NET 8.0, .NET 9.0, and firefox), Red Hat (postfix and valkey), and SUSE (afl, alloy, ansible-core, apache-pdfbox, chromedriver, chromium, cpp-httplib-devel, dpkg, elemental-operator, elemental-toolkit, enc, erlang, ffmpeg-7, firewalld, git-bug, golang-github-prometheus-prometheus, grafana, GraphicsMagick, graphite2, kernel, kernel-devel, lcms2, ldns, libsoup, libyang, libzypp, logback, mariadb, NetworkManager, openssh, openvswitch, perl-GD, perl-XML-LibXML, polkit, postgresql-jdbc, postgresql18, python, python-django, python-M2Crypto-doc, python-Pygments, python-pygments, python-requests, python313-Django6, qemu, rpcbind, samba, strongswan, tmux, uriparser, and xdg-dbus-proxy).
-
Barry Kauler ☛ Gajim jabber-client must run non-root
Forum member libertas reported a problem with running Gajim:
https://forum.puppylinux.com/viewtopic.php?p=172326#p172326
Some apps must be run non-root. I have modified script /usr/local/petget/installpreview.sh, inserted this at line 800: [...]
-
Security Week ☛ ShinyHunters Claims Council of Europe Hack
The extortion group threatens to leak 297 GB of data allegedly stolen from the Council of Europe, including employee personal information.
-
Tom's Hardware ☛ 2021 Honda Civic infotainment system can be jailbroken via USB — flaw uses public Android test keys to install unauthorized apps, enables for 'EvilValet' attacks
A software architect determined that they could practically install anything they want on the infotainment system of their 2021 Honda Civic through the front USB port. While the head unit required a signed AOSP file to update itself, the AOSP test key is publicly known, meaning anyone with the knowledge could potentially build their own update file and load it with malware.
-
APNIC ☛ Don’t throw the (cryptographic) baby out with the bathwater
Even if Shor's Algorithm is now implementable inside ten years, symmetric keying should still be trustworthy if we fix RSA with PQC methods. Don't throw the baby out with the bathwater!
-
Security Week ☛ French Government Messaging Platform Breached by Mysterious ‘Misere’ Hacker
French officials say roughly 73,000 government accounts were affected, while the threat actor claims to have stolen messages and user data from the sovereign Tchap platform.
-
Security Week ☛ Ozempic Maker Novo Nordisk Says Hackers Breached IT Systems
The pharmaceutical giant says the attackers gained access to personal data stored on the compromised systems.
-
Security Week ☛ Chinese Hackers Target Medical, Military, and Hey Hi (AI) Research in North America
Google’s Threat Intelligence Group has been tracking the cyberespionage group as UNC6508 since early 2025.
-
SANS ☛ Evil MSI Background: BASE64 Statistical Analysis, (Mon, Jun 15th)
I like it when a fellow handler posts a diary entry about images with malicious content.