Security Leftovers

posted by Roy Schestowitz on Aug 05, 2026

• LWN ☛ Security updates for Tuesday

  Security updates have been issued by AlmaLinux (frr, ldns, mingw-glib2, and perl-Archive-Tar), Debian (ruby2.7), Fedora (borgbackup, nebula, python-nh3, rust-ammonia, and seamonkey), Mageia (librabbitmq, libvncserver, packages, perl, perl-GD, perl-Unicode-LineBreak, squid, and unbound), Oracle (compat-libtiff3, frr, gstreamer1-plugins-good, javapackages-tools:201801, libreswan, nodejs:22, nodejs:24, p11-kit, perl-Archive-Tar, perl-DBI, php, pki-deps:10.6, and python-tornado), and SUSE (aws-iam-authenticator, bind, containerd, gawk, google-cloud-sap-agent, ignition, ImageMagick, java-11-openjdk, libpng16, libssh, mcphost, nginx, openssh, openssl-1_1, perl-DBI, perl-HTTP-Date, perl-Net-DNS, python-urwid, python3-dulwich, python312, python313, python3, python313-pydantic, python313-sentry-sdk, rrdtool, s390-tools, samba, spice-vdagent, vim, and xen).

• Adafruit ☛ CheapSecurity: A self-hosted CCTV system for Linux computers

  If you’ve got a spare single-board computer and a USB webcam sitting in a drawer, CheapSecurity from Giuseppe Marco Randazzo turns them into a full home surveillance setup with no cloud subscription attached. The whole premise is data sovereignty: footage stays local, on storage you control, with retention policies you set. It runs on Raspberry Pi, Orange Pi, Odroid, or anything Linux-based, and it’s deliberately lightweight enough for entry-level hardware.

• Security Week ☛ Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering

  A crafted prompt to a low-privilege Surveillance Giant Google ADK agent could be used to pass a malicious hand-off comment to a privileged agent.

• Linux Magazine ☛ AI Helped Develop a Linux Exploit

  A use-after-free race exploit was discovered and exploited on CentOS Stream 9.

• SANS ☛ Botnet Hunting for Vulnerabilities in Diagnostic Tools, (Tue, Aug 4th)

  This morning, I noticed specific sources "hunting" for vulnerabilities in URLs that I haven't noticed before.

• Security Week ☛ Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks

  Over 24,000 internet-accessible server-management interfaces disclose authentication hashes before login.

• Scoop News Group ☛ Massive supply-chain attack compromises 440 packages under four hours

  Researchers from multiple security firms observed a variant of Mini Shai-Hulud, self-replicating malware linked to TeamPCP, in all the affected packages.

• Security Week ☛ TP-Link Omada ZTP Vulnerabilities Chain Into Full Network Takeover

  Forescout researchers have found 15 new vulnerabilities in the TP-Link Omada networking ecosystem.

• SUSE Linux Kernel Multiple Vulnerabilities

  Multiple vulnerabilities were identified in SUSE Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege and remote code execution on the targeted system.

• Linux Foundation Misusing the Term Linux

  • Linux Foundation and NVIDIA Champion Open AI Security [Ed: Promoting a scam by miscarrying the brand "Linux"]

    The Linux Foundation has joined NVIDIA and leading technology companies to launch the Open Secure AI Alliance, advancing open tools, transparent governance, and stronger security for AI systems worldwide.

  • NVIDIA Corporation ☛ AI Leaders Propose SAFE Guidelines for Cybersecurity Transparency [Ed: Scam company, Jérôme Marin ☛ Enron style accounting boosted using the name "Linux"]

    Members of the Open Secure AI Alliance — now more than 120 organizations strong — are developing new guidelines to strengthen agentic AI cybersecurity as the annual Black Hat conference begins in Las Vegas today.

  • PR Newswire ☛ Linux Foundation Launches the Tokenomics Foundation to Define the Economics and ROI of AI Value [Ed: Most ridiculous misuse of the term Linux, promoting economic scams and lies]

• Entrapment (Microsoft GitHub)

  • LWN ☛ An LLM agent attempts to compromise a project on Microsoft's proprietary prison GitHub

    The Hey Hi (AI) Security Institute has released a

    detailed report on an security incident of its own making. The

    Institute set some LLM agents loose on the Internet with a security

    challenge; soon they were creating malware-laden pull requests and

    sock-puppet accounts to promote them.

  • LWN ☛ Another npm worm

    StepSecurity is reporting the emergence of a new worm affecting npm packages. The design of the worm is nothing new, but the rapidity with which it is exploiting captured npm packager credentials is noteworthy.