news
Security Windows TCO Leftovers
-
LWN ☛ Nix and Lix local root-privilege-escalation vulnerabilities
The Lix and Nix projects have jointly disclosed a set of vulnerabilities that can be used to escalate privileges to root on systems running the Lix or Nix daemons. "
All systems that build untrusted derivations are affected.
" Releases with fixes from each project are available today. CVE IDs have not yet been requested. See the announcement for more details on the vulnerabilities. -
Tom's Hardware ☛ Hacker claims ‘123456’ password let them breach the Danish national registry, accessing 8.8 million records
The Danish Central Register of Persons (CPF) was breached through the account of an IT and data services business. The hacker claimed that one of the breached accounts was only protected by a '123456' password.
-
XSAs released on 2026-10-13
The Xen Project has released one or more Xen security advisories (XSAs).
-
Security Week ☛ XWorm RAT Evolves Into Surveillance Platform
Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions.
-
Daniel Stenberg ☛ A UAF turned RCE
In the curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.
-
France24 ☛ Supermarket fridge hacking attacks due to lack of basic cybersecurity measures, expert says [Ed: Not due to dumb decisions?]
French investigators on Tuesday were hunting the hackers who seized control of cooling units at hundreds of supermarkets in a cyberattack that underlined the vulnerabilities of connected systems, with no group publicly claiming responsibility. FRANCE 24's Sharon Gaffney speaks with Marta Rybczynska, cybersecurity expert at Ygreky. She says that basic measures like regularly updating software or passwords are essential to prevent hacking attacks.
-
LWN ☛ Security updates for Tuesday
Security updates have been issued by AlmaLinux (cjose, curl, emacs, environment-modules, flatpak, flatpak-builder, gd, glibc, kernel, libxml2, pcre2, and rsyslog), Debian (chromium, keystone, libgit2, librsvg, nagios4, and ntfs-3g), Fedora (baresip, bcm283x-firmware, curl, flare-im, GitPython, iperf3, kernel, libebml, libmatroska, libre, mkvtoolnix, python-mkdocs-rss-plugin, radicale, uboot-tools, and xiphos), Mageia (antlr4-project, cjose, cups, firefox, nss, golang, libextractor, nginx, ntfs-3g, openvpn, perl-DBI, perl-Imager, polkit, rsync, strongswan, thunderbird, tor, ugrep, vlc, and wireshark), Oracle (bind, bind9.16, cjose, compat-openssl10, compat-openssl11, curl, dovecot, emacs, flatpak, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base, kernel, mod_auth_openidc, nodejs:22, tftp, and thunderbird), SUSE (bind, gcc13, gcc48, ghostscript, go1.26, go1.27, helm, libpng16, librsvg, libsoup, libX11, libXi, python, python-anyio, python-Django, python-PyJWT, python-tornado6, python-urllib3, python310, python313-bugzilla, python313-cmarkgfm, python313-colander, python313-configobj, python313-confluent-kafka, python313-django-registration, python313-ecdsa, python313-httptools, python313-imagecodecs, python313-impacket, terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid, thunderbird, unbound, virtiofsd, and xorg-x11-server), and Ubuntu (ffmpeg, google-guest-agent, google-osconfig-agent, and libx11).
-
Security Week ☛ SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
The bugs could allow attackers to invoke internal operations and execute code, completely compromising the system.
-
Security Week ☛ Adobe Patches 176 Vulnerabilities Across 11 Products
The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge.
-
AccessNow ☛ Beware of spyware: Access Now urges pension funds to scrutinize investments for spyware exposure
On September 28, 2026, Access Now wrote to four pension funds regarding their investment in AE Industrial Partners (AEI). AEI purchased spyware technology vendor Paragon Solutions in 2024 and merged the company with its holding company REDLattice.
-
Security Week ☛ Google Partially Reverses Chrome Bug Bounty Cuts
Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities.
-
Hong Kong Free Press ☛ China-linked hackers hit Fiji: US embassy
Hackers with links to China compromised a regional organisation in Fiji, the Pacific nation’s US embassy said Tuesday, warning that governments and telecommunication networks in the region were also being targeted.
-
The Straits Times ☛ China-linked hackers breached Fiji organisation, US Embassy says
The hackers reportedly maintained access to the organisation’s network over several days.
-
Security Week ☛ Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.
-
Scoop News Group ☛ Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day
The security vendor said it initially discovered a portion of the defect during internal security checks in June, but the company said it didn’t meet the threshold for an out-of-band release.
-
Security Week ☛ Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems
The company says it took some of its systems offline to contain a security issue within its network.
-
Windows TCO / Windows Bot Nets
-
Krebs On Security ☛ Microsoft Patches More Than 1,400 Security Flaws
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its backdoored Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.
-
SANS ☛ October 2026 Abusive Monopolist Microsoft Patch Tuesday, (Tue, Oct 13th)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabilities requiring no customer actions.
-