Security Leftovers
-
LWN ☛ Security updates for Friday
Security updates have been issued by Debian (firefox-esr), Fedora (xorg-x11-server-Xwayland), Oracle (buildah, e2fsprogs, grafana, kernel, and mod_http2), Red Hat (buildah, container-tools:rhel8, firefox, grafana, grafana:7.3.6, podman, and thunderbird), SUSE (alloy, cargo-audit-advisory-db-20241030, chromedriver, corepack22, netty, openvpn, python310-Werkzeug, thunderbird, uwsgi, and xsd), and Ubuntu (linux, linux-azure-6.8, linux-gcp-6.8, linux-hwe-6.8 and linux, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4).
-
Google ☛ From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code
In our previous post, Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models, we introduced our framework for large-language-model-assisted vulnerability research and demonstrated its potential by improving the state-of-the-art performance on Meta's CyberSecEval2 benchmarks. Since then, Naptime has evolved into Big Sleep, a collaboration between Surveillance Giant Google Project Zero and Surveillance Giant Google DeepMind.
-
Medevel ☛ The Ghimob Malware Nightmare for Android Users: Will It Return? How to Safeguard Against Similar Threats
New Virus Targets Android Banking Apps: Ghimob Malware Overview
-
Press Gazette ☛ Metropolis employee passport and bank details compromised in cyberattack
The Viz and Nursing Times publisher is latest media company to be targeted by hackers.
-
OpenSSF (Linux Foundation) ☛ Red Hat’s Collaboration with the OpenSSF and OSV.dev Yields Results: Red Bait Security Data Now Available in the OSV Format
OSV is an open format for describing software vulnerabilities. It provides security researchers, vendors, and consumers with an easy to understand format for exchanging vulnerability information. OSV.dev is a database that hosts and aggregates OSV data.
-
Federal News Network ☛ Rethinking continuous risk metrics to fortify federal cybersecurity
Public trust hinges on the resilience of critical infrastructure and government agencies against cyber threats.