news
Security Leftovers
-
LWN ☛ Security updates for Thursday
Security updates have been issued by AlmaLinux (buildah, firefox, gdk-pixbuf2, giflib, grafana, java-1.8.0-openjdk, java-21-openjdk, LibRaw, OpenEXR, PackageKit, pcs, python3.11, python3.12, python3.9, sudo, tigervnc, vim, xorg-x11-server, xorg-x11-server-Xwayland, yggdrasil, and yggdrasil-worker-package-manager), Debian (calibre, firefox-esr, and openjdk-17), Fedora (asterisk, binaryen, buildah, dokuwiki, lemonldap-ng, libexif, libgcrypt, miniupnpd, openvpn, podman, python3.9, rust-rpm-sequoia, skopeo, and xdg-dbus-proxy), Red Hat (buildah, gdk-pixbuf2, and nodejs:20), SUSE (dnsdist, libheif, openCryptoki, polkit, sed, and xen), and Ubuntu (linux-bluefield, python-marshmallow, and roundcube).
-
Security Week ☛ Critical cPanel & WHM Vulnerability Exploited as Zero-Day for Months
The authentication bypass flaw allows attackers to gain administrative access to vulnerable servers.
-
Security Week ☛ EnOcean SmartServer Flaws Expose Buildings to Remote Hacking
Claroty researchers discovered two vulnerabilities that can be exploited for security bypass and remote code execution.
-
Security Week ☛ Sandhills Medical Says Ransomware Breach Affects 170,000
It took the healthcare organization nearly one year to publicly disclose a data breach after it was targeted by Inc Ransom.
-
Security Week ☛ SAP NPM Packages Targeted in Supply Chain Attack
The Mini Shai-Hulud attack introduced a preinstall hook to fetch and execute a Bun binary and bypass security monitoring.
-
Security Week ☛ SonicWall Urges Immediate Patching of Firewall Vulnerabilities
The bugs could be exploited to bypass security controls, access restricted services, and crash firewalls.
-
Scoop News Group ☛ Two new extortion crews are speedrunning the Scattered Spider playbook
CrowdStrike says The Com-affiliated threat groups are using voice phishing and fake SSO pages to break into SaaS environments and steal data fast for extortion.
-
Bruce Schneier ☛ Fast16 Malware
Researchers have reverse-engineered a piece of malware named Fast16. It’s almost certainly state-sponsored, probably US in origin, and was deployed against Iran years before Stuxnet: [...]
-
Security Week ☛ Critical Gemini CLI Flaw Enabled Host Code Execution, Supply Chain Attacks
An attacker could have planted a malicious configuration to execute commands outside the sandbox.
-
PR Newswire ☛ Civil Infrastructure Platform Celebrates 10 Years of Supporting Industrial Grade Linux
The Civil Infrastructure Platform (CIP), a collaborative, open source project hosted by the Linux Foundation, today commemorates its 10th anniversary. Originally formed in 2016 by industry leaders in railways, electric power, and factory automation, CIP is celebrating the maturity of its industrial grade Linux development activities – including Super Long Term Support (SLTS), CIP Core, and advanced testing – as a foundational platform for global critical infrastructure.