news
Security Leftovers
-
LWN ☛ Security updates for Friday
Security updates have been issued by AlmaLinux (firefox and thunderbird), Debian (libcommons-lang-java, node-form-data, redis, and sope), Fedora (chromium), Mageia (slurm), Oracle (apache-commons-beanutils, firefox, kernel, redis:6, and thunderbird), Red Hat (kernel, kernel-rt, libxml2, and redis), SUSE (chromium, docker, ffmpeg-7, gnutls, kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t, libgcrypt, rav1e, and sccache), and Ubuntu (linux-lowlatency, linux-lowlatency-hwe-6.8).
-
Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 303 released
The diffoscope maintainers are pleased to announce the release of diffoscope version
303. This version includes the following changes: [...] -
It's FOSS ☛ Arch Linux Users at Risk Again as AUR Hit by Another RAT
The Arch User Repository (AUR) is a popular resource for Arch Linux users. It hosts user-submitted build scripts for software not included in the official repositories. While its openness provides flexibility, it also introduces vulnerabilities.
-
Hacker News ☛ New 'Plague' PAM Backdoor Exposes Critical Linux Systems to Silent Credential Theft
Cybersecurity researchers have flagged a previously undocumented Linux backdoor dubbed Plague that has managed to evade detection for a year.
"The implant is built as a malicious PAM (Pluggable Authentication Module), enabling attackers to silently bypass system authentication and gain persistent SSH access," Nextron Systems researcher Pierre-Henri Pezier said.
-
Scoop News Group ☛ China accuses US of exploiting Abusive Monopolist Microsoft zero-day in cyberattack [Ed: Microsoft as a US back door for espionage]
The accusation, the latest from Beijing, says U.S. intelligence agencies attacked two Chinese military enterprises.
-
Pro Publica ☛ SharePoint Exploit: Microsoft Used China-Based Engineers to Maintain the Software [Ed: The issue is shoddy software with back doors, not "China"]
-
Security Week ☛ In Other News: Abusive Monopolist Microsoft Probes ToolShell Leak, Port Cybersecurity, Raspberry Pi ATM Hack [Ed: The issue is defective Microsoft products, not a "leak"]
Noteworthy stories that might have slipped under the radar: Abusive Monopolist Microsoft investigates whether the ToolShell exploit was leaked via MAPP, two reports on port cybersecurity, physical backdoor used for ATM hacking attempt.