Security Leftovers

posted by Roy Schestowitz on Jul 29, 2026

• LWN ☛ Security updates for Tuesday

  Security updates have been issued by AlmaLinux (grafana and libreswan), Debian (openjdk-11 and openjdk-17), Fedora (opkssh, perl-Mojolicious, and rpm), Mageia (libyang, memcached, nginx, packages, and sqlite3), Oracle (.NET 8.0, acl, buildah, compat-openssl11, compat-poppler022, dogtag-pki, git-lfs, glibc, go-fdo-client, golang, httpd:2.4, jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base, kernel, libpq, LibRaw, maven:3.8, mysql8.4, nodejs:22, nodejs:24, openssl, podman, poppler, python3.14, samba, sssd, tomcat, tomcat9, vim, and yggdrasil), Red Hat (gstreamer1-plugins-bad-free), SUSE (afterburn, alsa, apache-ivy, avahi, aws-nitro-enclaves-cli, chromium, cifs-utils, cockpit, cockpit-machines, cockpit-packages, cockpit- podman, cockpit-repos, cockpit-subscriptions, containerd, curl, docker-compose, freetype2, gawk, glib2, google-cloud-sap-agent, gpg2, gstreamer-plugins-bad, gzip, helm, ignition, ImageMagick, jackson-annotations, jackson-bom, jackson-core, jackson- databind, jackson-dataformats-binary, jackson-modules-base, jackson-annotations, jackson-core, jackson-databind, java-11-openjdk, jline3, joe, jq, kernel, libgcrypt, libknet-devel, libsoup, libxml2, mariadb-connector-c, mcphost, net-tools, nghttp2, opennlp, openssl-1_0_0, PackageKit, pam, patch, pcr-oracle, perl, perl-DBI, perl-HTTP-Date, python-aiohttp, python-cryptography, python-Pillow, python-pyasn1, python-soupsieve, python-tornado, python-tornado6, python-urllib3, python3, radvd, rust-keylime, s390-tools, shibboleth-sp, sssd, systemd, tiff, vim, and wpa_supplicant), and Ubuntu (FreeIPMI, glibc, linux-aws, linux-aws, linux-raspi, linux-aws-6.8, linux-aws-fips, linux-azure, linux-azure-6.8, linux-azure, linux-oracle, linux-azure-5.15, linux-azure-fde-5.15, linux-oracle-5.15, linux-azure-6.17, linux-azure-fde, linux-azure-fde-6.17, linux-azure-fde-6.8, linux-azure-fips, linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-nvidia-tegra, linux-xilinx, linux-oracle-6.17, roc-toolkit, and samba).

• OpenSSF (Linux Foundation) ☛ What’s in the SOSS? Podcast #66 – S3E18 Turning Hey Hi (AI) into the Ultimate Open Source Maintainer Power Tool with Michael Winser

  In Episode #66 of What’s in the SOSS?, CRob welcomes back Michael Winser to celebrate Alpha-Omega surpassing $20 million in security grants. They discuss the economics of package registries and how Alpha-Omega is partnering with frontier Hey Hi (AI) providers to give maintainers defensive power tools.

• OpenSSF (Linux Foundation) ☛ What Is a Dependency Firewall?

  A dependency firewall is a security checkpoint that evaluates open source packages before they are installed. It can protect developer workstations, build environments, CI/CD pipelines, and Hey Hi (AI) coding agents by blocking packages that appear malicious, suspicious, or inconsistent with organizational policy.

• IT Wire ☛ RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)

  Qualys Threat Research Unit (TRU) identified CVE-2026-64600, a race condition in the Linux kernel’s XFS filesystem copy-on-write path. An attacker with an ordinary local account can exploit this race condition to overwrite protected files on disk and gain host root privileges on affected systems, including deployments running SELinux in Enforcing mode.

• Hacker News ☛ Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

  A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process.

  If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force.

  Tengu supports 25 distributed denial-of-service (DDoS) methods. It can also run a SOCKS5 proxy, execute shell commands, and collect system and network data. The malware can update itself and retrieve additional Executable and Linkable Format (ELF) or Android package (APK) payloads.

• InfoSecurity Magazine ☛ AI-Assisted Bug Hunt Uncovers Linux Kernel 0-Day in net/sched [Ed: Fuzzing by another name (hype)?]

  In new research published July 27, Lee Jia Jie of Singapore offensive security firm STAR Labs said he found the use-after-free during an internship, his first Linux kernel work.

• Hacker News ☛ Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit

  "AI still has many blind spots and lapses in reasoning ability," Lee said, adding that human judgement remained necessary throughout the work.

• Security Week ☛ Unpatched Fastjson Vulnerability Exploited in Attacks

  The critical remote code execution bug can be exploited without authentication, under the library’s stock default configurations.

• Security Week ☛ Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day

  Impacting on-premises deployments, the OS command injection allows attackers to access privileged internal functionality.

• Security Week ☛ Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe

  Apple announced that dozens of vulnerabilities have been patched in each of its operating systems.

• SANS ☛ AutoIT Payload Injector , (Tue, Jul 28th)

• Trail of Bits ☛ How we use /goal to find bugs in Patch the Planet

  Codex’s /goal feature amplifies bug hunting, but getting good results requires the right prompt, the right scope, and the right number of outcomes per run. For Patch the Planet, our joint initiative with Proprietary Chaffbot Company to find and fix bugs in open-source software, we pointed Codex at some of the most widely used, heavily audited codebases in the world, like Rust, curl, and zlib. One tool came up again and again in our internal bug-report channels: /goal, which hands Codex an open-ended objective and lets it work independently toward a success condition. Here are a few highlights: [...]