news
Security Leftovers
-
LWN ☛ Security updates for Thursday
Security updates have been issued by AlmaLinux (firefox, gdk-pixbuf2, glibc, gnutls, kernel, libexif, mysql8.4, postgresql16, postgresql18, python3.14, ruby:3.3, and ruby:4.0), Debian (krb5, roundcube, starlette, unbound, and varnish), Fedora (kernel, nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, perl-Imager, poppler, python-uv-build, rrdtool, rust-astral-tokio-tar, rust-astral_async_http_range_reader, rust-astral_async_zip, uv, and xen), Oracle (.NET 10.0, .NET 9.0, glibc, ruby:3.3, and thunderbird), Red Hat (.NET 10.0, .NET 8.0, .NET 9.0, containernetworking-plugins, gvisor-tap-vsock, podman, runc, and skopeo), SUSE (agama, alloy, bubblewrap, cockpit, cups, dnsmasq, emacs, glibc, gnutls, go1.25, go1.25-openssl, go1.26, go1.26-openssl, google-guest-agent, hplip, ibus-rime, librime, kernel, libarchive, libzypp, nginx, openexr, openssh, php7, postgresql14, postgresql15, postgresql16, python311-pytest-html, redis, redis7, rsync, tree-sitter, valkey, xen, and yq), and Ubuntu (cableswig, commons-beanutils, dnsmasq, ffmpeg, foomuuri, gst-plugins-good1.0, libcaca, libgcrypt20, mediawiki, memcached, papers, postorius, tgt, and tika).
-
Security Week ☛ New BTMOB Android Malware Enables Full Device Takeover
Delivered via phishing lures, the malware combines financial theft with data exfiltration and remote access.
-
OpenSSF (Linux Foundation) ☛ OpenSSF Newsletter – May 2026
What a month! May was packed with milestones for the OpenSSF community, and we're still riding the high from an incredible OpenSSF Community Day North America in Minneapolis. Read OpenSSF May Newsletter.
-
Tom's Hardware ☛ Wide-ranging 7-zip vulnerability with 8.8 CVE rating allows for code execution — hundreds of millions of machines potentially at risk
Wide-ranging 7-zip vulnerability allows for code execution and has an 8.8 CVE rating, hundreds of millions of machines potentially vulnerable
-
Security Week ☛ IBM and Red Bait Commit $5 Billion to Secure Open Source Supply Chains Under “Project Lightwell” [Ed: Chrunalism and PR]
Project Lightwell is designed to fix vulnerabilities without breaking what is already in production.
-
LWN ☛ IBM's "Project Lightwell" [Ed: Marketing spam to pretend to be rich when the company is deep in debt]
IBM has sent out a
press release touting a claimed $5 billion investment into an
operation called Project Lightwell: [...]
-
Silicon Angle ☛ IBM, Red Bait launch $5B Project Lightwell to boost open-source security [Ed: Timely distraction from the layoffs]
IBM Corp. and its Red Bait subsidiary today launched an initiative called Project Lightwell to improve the security of open-source projects. Project Lightwell is backed by a $5 billion commitment. In addition, I.C.B.M. and Red Bait will assign more than 20,000 engineers to the initiative.