Security Incidents, Patches, New Bugs

posted by Roy Schestowitz on Jun 30, 2026

• Security Week ☛ Insurance Regulators Group NAIC Hit in Oracle PeopleSoft Hack

  The ShinyHunters extortion group claims to have stolen 3.1 TB of data from the organization.

• Daniel Baumann: Debian: GNU/Linux Vulnerability Mitigation (PACKET_EDIT_MEME.c)

  The Linux local root exploit of today’s news is PACKET_EDIT_MEME.c [CVE-2026-46331] which is also known as pedit COW.

• Canonical ☛ Hunting a 16-year-old SQLite bug with TLA+: is dqlite affected?

  This article was written by Marco Manino and Alberto Carretero, dqlite team at Canonical. 1. Anatomy of a SQLite bug Recently SQLite published a new version with a fix to a long-standing bug in the way that the Write Ahead Log (WAL) is checkpointed that leads to the corruption of the database.

• Security Week ☛ ‘DirtyClone’ Linux Kernel Vulnerability Leads to Root Access

  A variant of DirtyFrag, the flaw allows unprivileged local users to manipulate the Linux page cache and gain root privileges.

  JFrog has published technical details and a proof of concept (PoC) targeting a recent high-severity Linux kernel vulnerability that could allow any local user to gain root privileges.

• CVE-2026-53325: Critical Linux Kernel AMD64 AGP Driver Vulnerability Leads to Virtualization Denial of Service (DoS) – Rescana

  CVE-2026-53325 is a critical vulnerability affecting the Linux kernel’s AMD64 AGP driver (drivers/char/agp/amd64-agp.c). The flaw arises from improper error propagation in the agp_amd64_probe() function, which can result in a NULL pointer dereference and a General Protection Fault (GPF) when the kernel is executed in virtualized environments such as QEMU or KVM without a physical AMD northbridge. This leads to a denial of service condition, potentially impacting the availability of virtualized Linux infrastructure. The vulnerability has been addressed in recent kernel releases, but a broad range of kernel versions remain affected. There is currently no evidence of exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

• LWN ☛ Security updates for Monday

  Security updates have been issued by AlmaLinux (containernetworking-plugins, golang, kernel, libpng, libpng15, nginx, opencryptoki, perl-IO-Compress, thunderbird, and tigervnc), Debian (chromium, gdcm, incus, libhtml-parser-perl, lxd, openvpn, tor, and xorg-server), Fedora (chromium, docker-buildkit, docker-buildx, dotnet10.0, dotnet8.0, dotnet9.0, krita, ldns, libssh2, liferea, lighttpd, mariadb10.11, mariadb11.8, moby-engine, nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, openbao, pacemaker, pgadmin4, podman-tui, prometheus-podman-exporter, python-jupyter-server, python-mistune, python-postorius, python-pydantic-settings, python3-docs, python3.14, thunderbird, tigervnc, tinyproxy, and util-linux), Mageia (krb5), Oracle (.NET 10.0, .NET 8.0, .NET 9.0, bind, dracut, fence-agents, firefox, frr, frr10, glib2, glibc, gnutls, golang, kernel, libpng, libpng15, libreoffice, libxml2, libxslt, mod_http2, mysql:8.4, nginx:1.26, openssl, php:8.3, podman, postgresql-jdbc, python3.14, redis, rsync, thunderbird, tomcat, valkey, and vim), Red Hat (osbuild-composer), and SUSE (agama-web-ui, asn1c, assimp, assimp-devel, aws-iam-authenticator, calibre, clamav, corepack24, dovecot22, exiv2, frr, giflib, glances-common, google-osconfig-agent, GraphicsMagick, gvim, haproxy, hydra, ImageMagick, jupyter-nbclassic, kernel, libsoup, libsoup2, libssh2-1, nano, NetworkManager-applet-openvpn, nodejs22, openbabel, opensc, openssl-3, pacemaker, python, python-base, python-doc, python311-pdm, python311-py7zr, python311-pypdf, python36, tar, trivy, util-linux, xen, and xtrabackup).

• Hacker News ☛ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More

• Make Use Of ☛ Linux isn't immune to malware — the AUR just proved it [Ed: Wrong framing]

  One of the more common myths floating around is that Linux is somehow more secure than Windows or macOS, which is simply not true. The truth is, Linux has had a ton of vulnerabilities and exploits; it’s just that these get patched out quickly compared to other systems.

  Still, there is a nonzero chance that you might end up grabbing malware from the internet, and this is the exact conundrum facing many Arch Linux users, with a sizable number of AUR packages infected.