Security Leftovers

posted by Roy Schestowitz on Jul 22, 2026

• LWN ☛ Security updates for Tuesday

  Security updates have been issued by AlmaLinux (capstone, fence-agents, gimp, glib2, hplip, httpd, jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base, libtiff, maven:3.8, pacemaker, python3.14, and webkit2gtk3), Debian (samba), Fedora (c-ares, dnsx, freerdp, gpsd, libreswan, libseccomp, libtiff, mingw-python-idna, mingw-python-pip, openssh, python-pillow, wget1, and wireshark), Mageia (golang, graphicsmagick, haveged, libssh2, nginx, nilfs-utils, perl-CGI-Session, perl-Imager, perl-JavaScript-Minifier-XS, php, php8.4, php8.5, python-nltk, sqlite3, and xmlstarlet), Oracle (.NET 10.0, .NET 9.0, container-tools:ol8, firefox, giflib, glibc, go-fdo-client, go-fdo-server, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, hplip, httpd, image-builder, kernel, libtiff, mod_http2, pacemaker, perl-DBI:1.641, perl-HTTP-Daemon, php:8.2, python-markdown, ruby4.0, systemd, and thunderbird), Red Hat (buildah, container-tools:rhel8, dracut, golang-github-openprinting-ipp-usb, libtiff, osbuild-composer, python-urllib3, python3.12-urllib3, python3.14-urllib3, and runc), SUSE (389-ds, chromedriver, gstreamer-plugins-bad, libreoffice, libsuricata8_0_6, podman, python311, and sssd), and Ubuntu (apache2, freerdp3, freetype, libde265, libxfont, linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8, linux, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-realtime, linux-xilinx-zynqmp, linux, linux-gcp, linux-gke, linux-realtime, linux-gcp-6.17, linux-realtime-6.17, linux-gcp-fips, linux-hwe-7.0, linux-nvidia-tegra-5.15, linux-oem-7.0, nginx, php8.1, php8.3, php8.5, rlottie, sqlite3, and wget).

• SANS ☛ Captive Portal Detection, (Tue, Jul 21st)

  Not everything our honeypots detect is an attack. Sometimes it is just "odd traffic", and this is one example: Our "First Seen" list currently includes "http://detectportal.firefox.co
  m/success.txt" as one of the new URLs detected by our honeypots. The hostname "detectportal" kind of gives away what is happening here.

• Linux Magazine ☛ Substantial Update to IPFire Now Available

  The lastest version of IPFire features a fundamental change to how the system handles DNS.

• Security Week ☛ New HollowGraph Malware Abuses Abusive Monopolist Microsoft 365 Calendar for C&C Communication

  Part of a larger toolkit, HollowGraph uses a compromised 365 account’s calendar as a two-way dead-drop.

• OpenSSF (Linux Foundation) ☛ Representing OpenSSF at AfricaCyberFest

  Open source software is playing an important role in Africa's digital growth. Across the continent, more organizations, developers, and communities are adopting open source to build technology and solve local challenges.

• Qt ☛ Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt

  ut-of-bounds read (buffer over-read) vulnerability in the QTextCodec::codecForName() function of the Qt 5 Core Compatibility Hey Hi (AI) (the Qt5Compat module) has been discovered and has been assigned the CVE id CVE-2026-9499

• Silicon Angle ☛ Ivanti adds predictive remediation to get ahead of the patch backlog

  Information technology security software company Ivanti Inc. today introduced predictive remediation, a new capability across its Autonomous Endpoint Management line that forecasts compliance gaps and flags them before service-level deadlines pass.

• Security Week ☛ Exploitation of ServiceNow Vulnerability Seen Days After Disclosure

  The ServiceNow Hey Hi (AI) platform vulnerability tracked as CVE-2026-6875 can be exploited for remote code execution.

• Security Week ☛ Clover Health Investments Discloses Data Breach

  Using social engineering, hackers compromised employee accounts with access to personal and health information.

• Security Week ☛ Meta Paid $78,000 Bounty for Vulnerability Exposing Customer Support Data

  A security researcher discovered a broken access control vulnerability in Meta’s support infrastructure.

• Security Week ☛ Estée Lauder Discloses Impact From Oracle EBS Zero-Day Hack

  Hackers exfiltrated personal, financial, and health information from the company’s Oracle EBS instance in August 2025.

• Scoop News Group ☛ What the World Cup can teach us about cybersecurity resilience

  Future major events can’t rely on yesterday's playbook. Lessons from the World Cup show why true cyber resilience starts months before kickoff and extends far beyond stadium perimeters.