Security Leftovers and Microsoft TCO

posted by Roy Schestowitz on Jul 30, 2026

• LWN ☛ Security updates for Wednesday

  Security updates have been issued by AlmaLinux (dovecot, go-fdo-client, go-fdo-server, kernel, kernel-rt, and sssd), Debian (calibre, hplip, libraw, and samba), Fedora (btrbk, chromium, gpsd, kronosnet, and restic), Mageia (gstreamer1.0-libav and libslirp), Slackware (libarchive, samba, and seamonkey), SUSE (agama-web-ui, chromium, gimp, glib2, GraphicsMagick, ignition, ImageMagick, java-21-openjdk, libssh, libssh-config, nginx, nmap, nsd, python-urllib3, python313-CherryPy, rsyslog, samba, sssd, valkey, webkit2gtk3, and yq), and Ubuntu (freerdp3, linux, linux-aws, linux-aws-5.4, linux-aws-fips, linux-azure, linux-azure-5.4, linux-azure-fips, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-iot, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux-azure-fips, linux-ibm, linux-ibm-5.4, linux-kvm, and linux-raspi, linux-raspi-5.4).

• Bruce Schneier ☛ Long-Lived Vulnerability in Abusive Monopolist Microsoft Secure Boot

  Microsoft’s Secure Boot has had a serious vulnerability for most of its existence.

  An industry-wide standard Abusive Monopolist Microsoft invented to protect Windows, and later Linux, devices from firmware infections has been trivial to bypass for 13 of its 14 years of existence. The discovery was made by researchers at security firm ESET after identifying 11 firmware images, at least one from 2013, that were known to be defective but remained signed by the software company anyway.

• OpenSSF (Linux Foundation) ☛ OpenSSF Community Day Europe 2026: Schedule Highlights & What to Expect

  OpenSSF Community Day Europe 2026 (October 6 in Prague), focuses on open source software security, regulatory compliance like the EU CRA, and Hey Hi (AI) supply chain risks. The one-day event features technical sessions on tools like VEX, Gemara, and Sigstore, offering direct collaboration with maintainers and security experts.

• SANS ☛ Apple Patches Everything (July 2026), (Wed, Jul 29th)

  I am a bit late with this summary, but this week Fashion Company Apple released updates to all its operating systems and Safari. The Safari update, as usual, targets macOS prior to macOS 26. macOS updates covered the two older versions (14 and 15), while other operating system patches only covered the current 26 versions.

• Security Week ☛ Critical VM Escape Vulnerability Patched in VMware ESXi

  A total of five vulnerabilities have been patched in VMware ESXi, vCenter, Workstation, and Fusion.

• Security Week ☛ Dozens of Minnesota Water Utilities Targeted in Coordinated OT Attacks

  State and federal agencies respond after intrusions disrupt automated controls at municipal water and wastewater utilities.

• Security Week ☛ JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack

  The Proprietary Chaffbot Company models targeted services beyond Hugging Face as they attempted to solve the tasks they were given.

• Security Week ☛ OpenAI’s Rogue Hey Hi (AI) Ventured Beyond Hugging Face

  Hugging Face has published an anatomy of the attack and Proprietary Chaffbot Company has shared additional information from its investigation.

• Security Week ☛ ShinyHunters Claims Ernst & Young Hack

  Ernst & Young previously confirmed that personal and financial information was stolen from a third-party management platform.

• Help Net Security ☛ Tengu botnet reboots Linux devices to survive removal [Ed: Why is this installed in the first place or how?]

  A new Mirai-derived IoT botnet can force an infected Linux device to reboot once its main process is killed, giving its persistence mechanisms another opportunity to relaunch it, Nozomi Networks Labs has found.

  The malware, dubbed Tengu, was discovered by a machine-learning system the company uses to identify malware families that do not match known signatures.

  Researchers first observed the dropper reaching their honeypots through Telnet credential brute-force attacks.

• HowTo Geek ☛ I invited hackers to attack my home server, and the results were a wake-up call

  Self-hosting is both an entertaining hobby if you like computers, and a reasonable way to save a few dollars if you swap out your subscription services for something you host yourself. It does come with a bit of risk, however, if you put your self-hosted services online so they're accessible from the internet. I was curious about what kind of attacks my server was getting, so I set up a honeypot to see what happened.

• Microsoft TCO

  • Scoop News Group ☛ A little-known npm package was North Korea’s warm-up act for the axios hack

    Amazon's threat intelligence team traced domain records from the open-source software hack to a smaller, earlier compromise by the same North Korean group.

  • Amazon Inc ☛ Secure your npm and pip package updates in Amazon Linux

    If you use and install packages from npm or PyPI, the first hours after a package is published are the riskiest because scanners can’t analyze packages before publication. Recent supply chain events affecting NodeJS and Python packages have been detected and removed within hours. However, while those packages were available to the general public, it’s possible that they were installed by users, creating the potential for a security incident. As you will see from the data that follows, if users had waited 1 day before accessing those packages, none of the recent supply chain security events would have had an impact.

  • Microsoft Defender for Endpoint on Linux Bug Disables Threat Protection

    Microsoft is investigating two issues affecting Microsoft Defender for Endpoint on Linux, including a newly confirmed bug that could leave some systems without active threat protection after a reboot. The issue may expose affected Linux devices to potential security risks.