news
Security Leftovers
-
LWN ☛ Security updates for Monday
Security updates have been issued by Debian (lxd, orthanc, and thunderbird), Fedora (cef, chromium, gimp, nextcloud, pgadmin4, python-django4.2, python-django5, python3-docs, python3.12, python3.13, and python3.9), Oracle (container-tools:rhel8 and mingw-fontconfig), Slackware (gvfs, mozilla, and telnet), SUSE (avahi, cockpit-356, cockpit-podman, cockpit-podman-120, containerized-data-importer, digger-cli, docker, evolution-data-server, expat, firefox, freerdp2, gimp, glib2, glibc, go1, google-guest-agent, google-osconfig-agent, gosec, gpg2, heroic-games-launcher, ImageMagick, kernel, kernel-firmware, kubevirt, libIex-3_4-33, libjxl-devel, libpng16, libsodium, libsoup, libsoup2, libssh, libudisks2-0, libwireshark19, protobuf, python-pyasn1, python-urllib3, python311, python311-Flask, rust-keylime, thunderbird, ucode-intel, and valkey), and Ubuntu (git).
-
Scoop News Group ☛ Google addresses actively exploited Qualcomm zero-day in fresh batch of 129 Android vulnerabilities
The company’s latest security update contains the highest number of Android vulnerabilities patched in a single month since April 2018.
-
Pen Test Partners ☛ Breaking Out of Citrix and other Restricted Desktop Environments
Many organisations are turning to virtualisation of apps and desktops. This often involves virtualisation platforms such as Citrix to deliver these services. Get your configuration or lock-down wrong and you’ll find users ‘breaking out’ of the environment you thought you had secured.
-
Federal News Network ☛ Leader of federal cyber defense programs resigns from CISA
Shelly Hartsook led CISA efforts to improve cybersecurity capacity governmentwide. Her departure continues a steady string of resignations at the cyber agency.
-
Security Week ☛ North Korean APT Targets Air-Gapped Systems in Recent Campaign
Using backdoored Windows shortcut files, the APT deployed a new implant, a loader, a propagation tool, and two backdoors.
-
Security Week ☛ OpenClaw Vulnerability Allowed Websites to Hijack Hey Hi (AI) Agents
Malicious websites could open a WebSocket connection to localhost on the OpenClaw gateway port, brute force passwords, and take control of the agent.
-
OpenSSF (Linux Foundation) ☛ Case Study: Defending the Open Source Supply Chain in a New Regulatory Era
-
The Register UK ☛ Israel hacks prayer app to push propaganda to Iran: report
The availability of user location data and other app telemetry, he suggested, "can be (ab)used in many different and interesting ways!"
-
Reuters ☛ Hackers hit Iranian apps, websites after US-Israeli strikes
The cyberattack on BadeSaba was a smart move because government supporters use it and they tend to be more religious, said Hamid Kashfi, a security researcher and founder of cybersecurity firm DarkCell.
-
Malicious Go Module github.com/xinfeisoft/crypto Targets Ubuntu and CI/CD Environments With Rekoobe Backdoor and Credential Theft [Ed: GitHub is controlled by Microsoft and contains a lot of malware]
GitHub-hosted staging
-
Windows TCO / Windows Bot Nets