Security Leftovers

posted by Roy Schestowitz on Jul 28, 2026

• LWN ☛ Security updates for Monday

  Security updates have been issued by Debian (chromium, hplip, and linux-6.1), Fedora (firefox, GitPython, google-osconfig-agent, lego, libgit2, libreswan, libwebsockets, moby-engine, p11-kit, pam, python-idna, rust-libgit2-sys, skopeo, systemd, trafficserver, webkitgtk, and xrdp), Mageia (giflib, graphite2, libnfs, vorbis-tools, wget, and yelp), Red Hat (firefox, thunderbird, and webkit2gtk3), and SUSE (amazon-ecs-init, chromedriver, ffmpeg-7, ffmpeg-8, firefox, google-osconfig-agent, gpg2, java-17-openjdk, java-25-openjdk, kernel, libsrt1_5, nginx, perl-HTTP-Date, perl-XML-Bare, proftpd, python-pyasn1, python-soupsieve, python313-astropy, python313-urwid, systemd, thunderbird, and trivy).

• APNIC ☛ Secure by default: How ‘HSTS-Enforced’ could finally close the web’s oldest backdoor

  Guest Post: The current web still relies on a legacy assumption that website should be accessible over unencrypted HTTP unless it explicitly signals otherwise. HSTS-Enforced builds on top of HSTS by inverting its security model.

• Linux Magazine ☛ Yet Another Linux Kernel Vulnerability Discovered

  Affecting millions of systems, a kernel flaw discovered by Qualys could allow users to gain root privileges.

• Security Week ☛ Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack

  The Anubis cybercrime group has taken credit for the attack and is threatening to leak data.

• Security Week ☛ Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials

  A threat actor has been using the compromised appliances to target the Abusive Monopolist Microsoft 365 accounts of traveling corporate employees.

• Security Week ☛ PTC Windchill Vulnerability Exploited in Ransomware Campaign

  The critical unsafe deserialization flaw allows attackers to execute arbitrary code remotely, without authentication.

• Security Week ☛ For Some, So-Called ‘Skynet Day’ Came too Close to Sci-Fi After a Rogue Agent Hacked Into a Startup

  Decades after it appeared in “The Terminator,” Skynet looks more like a forecast of the cyber incident in which a rogue Hey Hi (AI) system hacked into another Hey Hi (AI) company on its own.

• Windows TCO / Windows Bot Nets

  • Security Week ☛ MedusaHVNC Malware Uses Hidden backdoored Windows Desktops to Evade Detection

    The malware-as-a-service operation launches legitimate browsers on an invisible desktop, giving attackers persistent and covert remote access to compromised backdoored Windows systems.

  • The Register UK ☛ Microsoft Defender for Endpoint leaves some Linux boxes defenseless after update

    Not content with broken Windows updates, Microsoft has disclosed two problems with Defender for Endpoint on Linux – one that could disable the security service after a reboot, and another that prevents updates on FIPS-enabled Red Hat Enterprise Linux 8 and 9.

    The more serious problem affected versions 101.26042.0000 through 101.26042.0009 across all supported Linux operating systems. After an upgrade or reinstall followed by a reboot, "the Defender service might be disabled on some devices," according to Microsoft.