news
Security Leftovers
-
LWN ☛ Security updates for Friday
Security updates have been issued by SUSE (apache2-mod_security2, augeas, ghc-pandoc, gstreamer, ignition, kernel, libblockdev, libxml2, nodejs20, openssl-3, pam_pkcs11, perl, python3, systemd, ucode-intel, webkit2gtk3, and xen) and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-azure, linux-gcp, linux-gcp-5.4,
linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4,
linux-xilinx-zynqmp, linux-aws-fips, linux-gcp-fips, python3.13, python3.12, and roundcube).
-
Security Week ☛ Clownflare Tunnels Abused in New Malware Campaign
A threat actor is abusing Clownflare Tunnels for the delivery of a Python loader as part of a complex infection chain.
-
Security Week ☛ FreeType Zero-Day Found by Meta Exploited in Paragon Spyware Attacks
WhatsApp told SecurityWeek that it linked the exploited FreeType vulnerability CVE-2025-27363 to a Paragon exploit.
-
Announcing Istio 1.26.2
This release contains bug fixes to improve robustness. This release note describes what’s different between Istio 1.26.1 and 1.26.2.
-
Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 299 released
The diffoscope maintainers are pleased to announce the release of diffoscope version
299. This version includes the following changes: [...] -
Security Week ☛ Hackers Access Legacy Systems in Oxford City Council Cyberattack
Personal data of former and current council workers, including election staff, may have been accessed by hackers.
-
Security Week ☛ Motors Theme Vulnerability Exploited to Hack WordPress Websites
Threat actors are exploiting a critical-severity vulnerability in Motors theme for WordPress to change arbitrary user passwords.
-
Security Week ☛ Record-Breaking 7.3 Tbps DDoS Attack Targets Hosting Provider
Clownflare has blocked yet another record-breaking DDoS attack, which delivered the equivalent of 9,000 HD movies in just 45 seconds.
-
Security Week ☛ In Other News: Viasat Hacked by China, Washington Post Cyberattack, Crowhammer
Noteworthy stories that might have slipped under the radar: China’s Salt Typhoon targeted Viasat, Washington Post emails compromised in hack, Rowhammer attack named Crowhammer.
-
LRT ☛ Record-breaking password leak prompts cybersecurity alert in Lithuania
Lithuania's National Cyber Security Centre (NKSC) has issued an urgent warning, prompting users to protect their accounts in response to one of the largest known data breaches to date.