Security Leftovers

posted by Roy Schestowitz on Jun 23, 2026

• Security Week ☛ What the Latest ShinyHunters Breaches Reveal About Modern Cyberattacks

  Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive damage.

• LWN ☛ Security updates for Monday

  Security updates have been issued by AlmaLinux (389-ds:1.4, kernel, and kernel-rt), Debian (gst-libav1.0, gst-plugins-good1.0, imagemagick, kernel, libconfig-inifiles-perl, libgd-perl, libhttp-daemon-perl, mediawiki, pillow, and squid), Fedora (389-ds-base, alertmanager, ansible-core, buildah, chromium, erlang-cowboy, erlang-cowlib, erlang-gun, freerdp, kubernetes1.33, kubernetes1.34, kubernetes1.35, mingw-SDL2_image, ongres-scram, ongres-stringprep, openssl, perl-Config-IniFiles, perl-Crypt-PBKDF2, podman, postgresql-jdbc, python3.13, strongswan, webkitgtk, xdg-desktop-portal, and yt-dlp), Red Hat (osbuild-composer), SUSE (alloy, amazon-ssm-agent, ansible-core, apache-sshd, jpgpj, azure-storage-azcopy, chromedriver, containerized-data-importer, firefox, glibc, graphite2, inspektor-gadget, kubevirt, lemon, openvswitch, python-starlette, python311, python311-joserfc, python313, and tinyproxy), and Ubuntu (netatalk).

• SANS ☛ Webshells Remain Popular, (Mon, Jun 22nd)

  Webshells have been popular for a long time. We already covered this topic across multiple diaries. I spent some time to track them and slighly paid less attention to them but today I found another one. It seems to be a new player (pushed on Microsoft's proprietary prison Microsoft's proprietary prison GitHub two months ago).

• SANS ☛ CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration., (Tue, Jun 23rd)

• Security Week ☛ New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones

  The vulnerability exploited by the Usbliter8 exploit cannot be patched and a PoC exploit has been released by researchers.

• Security Week ☛ Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data

  Squidbleed, discovered with the aid of Claude Mythos Preview, has been described as a Heartbleed-style vulnerability. 

• Security Week ☛ Fortinet Responds to FortiBleed Campaign

  A database of over 86,000 confirmed working credentials was created during the credential-harvesting campaign.

• Security Week ☛ Texas Parks & Wildlife Data Breach Affects 3 Million Individuals

  Hackers stole personal information after breaching the systems of a third-party license vendor serving TPWD.

• Microsoft TCO / Windows Bot Nets

  • Security Week ☛ North Korean Hackers Blamed for Mastra NPM Supply Chain Attack

    A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.