news
Security Leftovers
-
LWN ☛ Security updates for Friday
Security updates have been issued by Fedora (anaconda, dnf5, firefox, flatpak-builder, libexif, minetest, nss, plasma-setup, python-blivet, rpki-client, and xorg-x11-server), Oracle (bind, kernel, osbuild-composer, thunderbird, webkit2gtk3, and wireshark), Red Hat (java-25-openjdk), SUSE (cacti, cacti, cacti-spine, cockpit-machines, cockpit-podman, cockpit-tukit, csync2, flannel, gdk-pixbuf, go1.25-openssl, go1.26-openssl, haproxy, kernel, libcap, libpng16, libtree-sitter0_26, libvirt, ncurses, ntfs-3g_ntfsprogs, openssl-1_1, openssl-3, openvswitch, perl, python-pyOpenSSL, python311, rclone, sudo, and tomcat), and Ubuntu (gst-plugins-bad1.0, jq, libopenmpt, linux-ibm, linux-ibm-5.15, and php-league-commonmark).
-
Security Week ☛ Bitwarden NPM Package Hit in Supply Chain Attack [Ed: NPM, so this is Microsoft distributing malware]
Tied to a fresh Checkmarx supply chain attack claimed by TeamPCP, the incident references the Shai-Hulud worm.
-
Security Week ☛ Vulnerabilities Patched in CrowdStrike, Tenable Products
CrowdStrike has fixed a critical LogScale vulnerability, while Tenable addressed a high-severity Nessus flaw.
-
Security Week ☛ US Federal Agency’s Cisco Firewall Infected With ‘Firestarter’ Backdoor
The malware provides remote access and control of infected devices and maintains post-patching persistence.
-
Security Week ☛ Pre-Stuxnet Sabotage Malware ‘Fast16’ Linked to US-Iran Cyber Tensions
It targeted high-precision calculation software to tamper with results and packed a self-propagation mechanism.
-
Bleeping Computer ☛ New ‘Pack2TheRoot’ flaw gives hackers root Linux access
A new vulnerability dubbed Pack2TheRoot could be exploited in the PackageKit daemon to allow local Linux users to install or remove system packages and gain root permissions.
-
open PR ☛ AxCrypt expands to Linux, bringing trusted encryption to the open-source ecosystem
AxCrypt has introduced native Linux support, bringing the most trusted 256-bit encryption to developers, cybersecurity professionals and open-source users across Linux and other major platforms.
AxCrypt's most anticipated release is here. The launch of native Linux support answers long-standing requests from developers, cybersecurity experts, and open-source users who rely on the platform for secure workflows.