Security and Windows TCO

posted by Roy Schestowitz on Jun 14, 2026

• Security Week ☛ Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters

  Oracle has mitigated CVE-2026-35273, but it has not publicly confirmed the vulnerability’s in-the-wild exploitation.

• Security Week ☛ Chrome 149 Update Patches 28 Vulnerabilities

  The browser refresh resolved critical and high-severity security defects, including a dozen use-after-free bugs.

• Tom's Hardware ☛ AMD denies researcher a $10,000 bug bounty after fixing critical auto-updater vulnerability — security flaw took 124 days to patch

  AMD took over four months to fix a critical security bug in its autoupdater, and the security researcher didn't see a dime for his efforts

• Security Week ☛ Ivanti Sentry Exploitation Attempts Hitting Honeypots

  The critical-severity OS command injection vulnerability allows attackers to execute arbitrary code with root privileges.

• Federal News Network ☛ CISA revives push toward long-awaited cyber incident reporting rules

  CISA will host public meetings amid pressure to quickly finalize the CIRCIA rules and calls to address widespread critiques of the draft regulations.

• Security Week ☛ In Other News: Surveillance Giant Google Security Layoffs, AudiA6 Takedown, $400 Million Coupang Fine

  Other noteworthy stories that might have slipped under the radar: ICS device exposure remains flat as attack surface widens, Abusive Monopolist Microsoft issues incident response playbook for AI, I.C.B.M. and AT&T accused of hack cover-ups.

• Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 319 released

  The diffoscope maintainers are pleased to announce the release of diffoscope version 319. This version includes the following changes:

  [ Jochen Sprickerhof ]

  * Improve header detection for Sphinx documentation projects.

• Windows TCO

  • Tom's Hardware ☛ Microsoft's bug-hunting nemesis extends vendetta with more zero-day attacks — Nightmare Eclipse publishes RoguePlanet and GreatXML local privilege escalation exploits

    Nightmare-Eclipse's vendetta against Abusive Monopolist Microsoft and backdoored Windows continues apace — researcher publishes RoguePlanet and GreatXML local privilege escalation zero-day exploits

  • [Repeat] Security Week ☛ Iranian Cyber Group Handala Claims Cal Water Hack

    The cybersecurity firm says that Cal Water’s Chico District has been confirmed as the victim of the attack. Data leaked by Handala shows it likely accessed a customer billing database and Cal Water’s internal RTKBase application.