news
Security Leftovers
-
Trail of Bits ☛ Building secure Uniswap v4 hooks
Uniswap v4 hooks let developers add custom behavior to pools, including dynamic fees, custom accounting, and external integrations. This flexibility moves some security responsibilities into application and hook code.
The Cork and Bunni exploits are two app-level incidents that show what can go wrong in that code. Together, they account for more than $20M in losses. Neither incident stemmed from a flaw in the Uniswap v4 core protocol or the PoolManager; both arose from application-specific authorization and accounting logic built around hooks.
-
LWN ☛ Security updates for Thursday
Security updates have been issued by AlmaLinux (gstreamer1-plugins-bad-free, libtiff, libXfont2, nodejs:22, nodejs:24, and rest), Debian (expat and nss), Fedora (libssh, nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, nodejs24, perl-HTTP-Date, proftpd, squid, unbound, and wordpress), Oracle (c-ares, edk2, freerdp, go-fdo-server, libreswan, mariadb-connector-c, and nginx), SUSE (alloy, apache-commons-lang3, google-guice, maven, maven-resolver, xmvn, apache-sshd, apptainer, avahi, distribution, glib2, go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21, gstreamer-plugins-bad, helm, ImageMagick, java-17-openjdk, java-25-openjdk, liboqs, oqs-provider, libssh, nginx, nm-configurator, nmap, openssl-3, openvpn, PackageKit, perl, perl-DBI, perl-HTTP-Date, perl-XML-Bare, python-msgpack-python, python-sh, python-ujson, python-urllib3, runc, samba, sssd, wget, wpa_supplicant, and xen), and Ubuntu (linux-nvidia, linux-nvidia-7.0 and linux-nvidia-6.17).
-
OpenSSF (Linux Foundation) ☛ OpenSSF Newsletter – July 2026
The July 2026 OpenSSF Newsletter highlights the upcoming Community Day Europe agenda and new compliance resources for the EU Cyber Resilience Act (CRA). It also introduces a dedicated Policy & Regulatory section, technical updates on dependency firewalls and Hey Hi (AI) artifact signing, and global community outreach efforts.
-
Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 326 released
The diffoscope maintainers are pleased to announce the release of diffoscope version
326. This version includes the following changes:[ Vagrant Cascadian ] * Add external tool reference for "pedump" to use the "mono" package on GNU guix. -
Scoop News Group ☛ CISA issues recommendations to federal agencies on open-source software security
One expert said they were pleased by the guidance, which touches on open-weight Hey Hi (AI) models, patching and more.
-
Security Week ☛ Semiconductor Firm Analog Devices Discloses Data Breach
Hackers were detected on Analog Devices systems in June, and an investigation found that they stole files.
-
The modern path to unified Linux identity security: Securing hybrid infrastructure in a cloud-first world
Cloud-first strategies have transformed enterprise infrastructure, but many organizations still face a significant obstacle to modernization: Linux servers that remain dependent on legacy on-premises directory services.
-
Kapersky ☛ New GenieLocker ransomware for Windows, ESXi, and Linux | Securelist
The new GenieLocker ransomware family has been active since March 2026. It has been used in attacks against organizations in the Russian Federation, primarily in the manufacturing sector, and attributed to the Toy Ghouls group by open-source intelligence (link in Russian).
-
Cybernews ☛ pfSense co-creator building new open-soure firewall platform: “will correct the mistakes of the past”
Twenty years ago, pfSense, the major open source firewall and router platform, was released. One of its original co-founders, Scott Ullrich, is building a new Linux-based “modern networking operating system” – nfSensei – from scratch. It will feature an AI brain, a Rust heart, modern VPNs, and many other bells and whistles.