news
Security Leftovers
-
TechRepublic ☛ AI Beats Hackers to a Zero-Day Cybersecurity Discovery, Twice [Ed: "Hey hi" hype, likely marketing]
AI prevented real-world cyberattacks before they began. Can Hey Hi (AI) continue to beat human threat actors to zero-day vulnerabilities?
-
OpenSSF (Linux Foundation) ☛ OpenSSF at DEF CON 33: Hey Hi (AI) Cyber Challenge (AIxCC), MLSecOps, and Securing Critical Infrastructure [Ed: OpenSSF promoting mindless hype]
-
MalCare Plugin for WordPress: A Security Implementation Guide for Developers and Site Owners
WordPress is a flexible and widely used CMS, but its popularity also makes it a high-value target for attackers.
-
Tom's Hardware ☛ Nvidia defiant over backdoors and kill switches in GPUs as U.S. mulls tracking requirements — calls them 'permanent flaws' that are 'a gift to hackers'
Nvidia has denied backdoors or kill switches in its GPUs amid U.S. proposals for location tracking to enforce export controls. The company calls such features a security risk and “permanent flaw,” warning they could undermine trust. Nvidia lost $8B in sales from recent export restrictions.
-
Security Week ☛ Trend Micro Patches Apex One Vulnerabilities Exploited in Wild
Trend Micro has rushed to fix two Apex One zero-days that may have been exploited by Chinese threat actors.
-
Security Week ☛ Enterprise Secrets Exposed by CyberArk Conjur Vulnerabilities [Ed: When garbage "security products" only worsen things]
CyberArk has patched several vulnerabilities that could be chained for unauthenticated remote code execution.
-
The Cyber Resilience Act: A Five Alarm Fire
On October 21, 2016, CNN’s website was knocked offline. So was the BillBC and Guardian’s. Amazon, Etsy and Shopify too, along with Quora, Reddit, and Ex-Twitter – among others. Huge swaths of the internet were taken down by a series of attacks on the DNS provider Dyn.
-
Reproducible Builds: Reproducible Builds in July 2025
Welcome to the seventh report from the Reproducible Builds project in 2025. Our monthly reports outline what we’ve been up to over the past month, and highlight items of news from elsewhere in the increasingly-important area of software supply-chain security. If you are interested in contributing to the Reproducible Builds project, please see the Contribute page on our website.
-
LWN ☛ Security updates for Wednesday
Security updates have been issued by AlmaLinux (kernel and python3.12-setuptools), Fedora (perl-Crypt-CBC and unbound), Gentoo (FontForge, GPL Ghostscript, Mozilla Network Security Service (NSS), and PAM), Oracle (gdk-pixbuf2, jq, kernel, mod_security, ncurses, python-requests, and python3-setuptools), Red Hat (python-requests and socat), SUSE (docker, kernel-livepatch-MICRO-6-0-RT_Update_2, kernel-livepatch-MICRO-6-0-RT_Update_4, kernel-livepatch-MICRO-6-0-RT_Update_5, kernel-livepatch-MICRO-6-0-RT_Update_6, kernel-livepatch-MICRO-6-0-RT_Update_7, kernel-livepatch-MICRO-6-0_Update_2, kernel-livepatch-MICRO-6-0_Update_4, kernel-livepatch-MICRO-6-0_Update_5, kernel-livepatch-MICRO-6-0_Update_6, kubeshark-cli, libgcrypt, pam-config, perl, python-requests, python311, and python313), and Ubuntu (linux-raspi).
-
Security Week ☛ Google Discloses Data Breach via Salesfarce Hack
A Surveillance Giant Google Salesfarce instance may have been targeted as part of a ShinyHunters campaign that hit several major companies.