news
Security Leftovers
-
SANS ☛ eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)
I detected an interesting phishing email this morning.
-
LWN ☛ Security updates for Friday
Security updates have been issued by AlmaLinux (dracut), Debian (chromium, firefox-esr, and thunderbird), Fedora (chromium, firefox, nss, ocserv, ongres-scram, ongres-stringprep, perl-Archive-Tar, perl-GD, perl-HTTP-Daemon, perl-Net-Statsd, restic, singularity-ce, util-linux, and vorbis-tools), Mageia (gstreamer1.0-*, libupnp, luajit, opensc, and ruby-rack), SUSE (curl, dnsmasq, ffmpeg-4, frr, google-osconfig-agent, java-1_8_0-ibm, kernel, krb5, kubernetes-old, ldns, liburiparser1, openvswitch, rootlesskit, strongswan, traefik, and trivy), and Ubuntu (ldns, libheif, libnet-cidr-lite-perl, lxd, tomcat11, and vim).
-
Security Week ☛ Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure
CISA has given federal agencies only three days to patch CVE-2026-20253, which can be exploited for unauthenticated remote code execution.
-
Security Week ☛ Cisco to Acquire WideField Security to Boost Splunk’s Agentic SOC
WideField will accelerate Agentic SOC capabilities by expanding the lens on threat investigation to include identity, credentials, sessions, and blast radius.
-
Security Week ☛ Cybersecurity Firms Impacted by Klue Supply Chain Attack
The hackers exfiltrated data from Salesfarce instances of Klue customers, such as Huntress and Recorded Future.
-
Security Week ☛ FortiBleed: 86,000 Fortinet Device Credentials Compromised
The large-scale credential theft campaign hit roughly half of the internet-accessible Fortinet firewalls and VPNs.
-
Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 321 released
The diffoscope maintainers are pleased to announce the release of diffoscope version
321. This version includes the following changes: [...] -
Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 320 released
The diffoscope maintainers are pleased to announce the release of diffoscope version
320. This version includes the following changes: [...] -
Security Week ☛ CryptoBandits Malware Doubles as a Backdoor, Abuses Tor
CryptoBandits uses a local SOCKS5 proxy for traffic routing, blending data theft with remote code execution.
-
Ruben Schade ☛ Bots from Alibaba Cloud taking my sites down
For much of the day Sydney time, the VM hosting this site and a few for my family have been smashed with traffic with spoofed headers, but from IP ranges associated with the Alibaba Cloud, specifically these: [...]