Security and Windows TCO Leftovers

posted by Roy Schestowitz on Aug 14, 2026

• LWN ☛ Security updates for Thursday

  Security updates have been issued by AlmaLinux (abrt, dhcpcd, edk2, freerdp, gegl04, grafana, gstreamer1-plugins-good, iscsi-initiator-utils, isns-utils, kernel, kernel-rt, keylime, libarchive, libyang, nodejs-nodemon, opencryptoki, osbuild-composer, pacemaker, postgresql-jdbc, postgresql18, python-idna, python3.9, udisks2, valkey, vim, xorg-x11-server-Xwayland, and yggdrasil-worker-package-manager), Debian (flatpak, lemonldap-ng, neutron, python-django, spip, xdg-dbus-proxy, and xorg-server), Fedora (apr-util, cri-o1.34, libcupsfilters, linux-firmware, sqlite, and vaultwarden), Gentoo (FreeType), Oracle (dovecot, evince, fence-agents, gnutls, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, isns-utils, java-1.8.0-openjdk, kernel, libarchive, osbuild-composer, pipewire, postgresql, ruby, ruby:3.3, sudo, and udisks2), Red Hat (bind, bind9.16, gnome-remote-desktop, grafana, opentelemetry-collector, python-pillow, python3, python3.12, python3.14, python3.9, and rhc), SUSE (chromium, clusterctl, dracut, gd, git-cliff, gleam, govulncheck-vulndb, graphicsmagick, gzip, kernel, kubevirt, libheif, librest0_7, nodejs22, nodejs24, openssh, openvpn, python3, python313-scikit-learn, rpm, stunnel, and zk), and Ubuntu (kernel, libgit2, linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-6.8,

  linux-azure-fde, linux-azure-fde-6.8, linux-azure-fips, linux-fips,

  linux-ibm, linux-ibm-6.8, linux-nvidia, linux-nvidia-6.8,

  linux-nvidia-lowlatency, linux-realtime, linux-realtime-6.8, linux-xilinx, linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-fde,

  linux-azure-fips, linux-gkeop, linux-ibm, linux-ibm-5.15,

  linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15,

  linux-oracle-5.15, linux-realtime, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-fips, linux-azure-4.15, linux-azure-fips,

  linux-fips, linux-gcp-4.15, linux-gcp-fips, linux-kvm, linux, linux-aws, linux-azure, linux-azure-fde, linux-ibm, linux-oracle,

  linux-raspi, linux-realtime, linux-azure, linux-azure-6.17, linux-gcp-6.17, linux-hwe-6.17, linux-oem-6.17,

  linux-realtime-6.17, node-follow-redirects, and yelp).

• GamingOnLinux ☛ Make sure your Flatpak is up to date due to security issues | GamingOnLinux

  Version 1.18.1 and 1.19.0 pre-release rolled out for Flatpak, due to some security issues that were found so it's an essential update for all Linux systems. If you use Flatpak, that is.

• Security Week ☛ Critical VMware vCenter Vulnerability in Attackers’ Crosshairs

  Tracked as CVE-2026–59310, the directory traversal bug allows remote attackers to execute arbitrary code.

• Security Week ☛ Fortinet Patches Authentication Flaws in FortiWeb and FortiManager

  The vulnerabilities could allow attackers to log in with random usernames and passwords or impersonate any FortiGate appliance.

• Security Week ☛ Adobe Commerce Bug Targeted Immediately After Disclosure

  The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches.

• LWN ☛ Domas: Bypassing memory protection with AMD's memory controllers

  Christopher Domas has published a proof of concept with a description showing how to use AMD memory controllers' bank swizzle mode to bypass memory protection and read or write arbitrary data, including CPU microcode definitions and memory belonging to the platform security processor.

• Tom's Hardware ☛ Critical 'Zoomsday' flaw enables total device takeover during Zoom calls — AI-assisted research only used 20 prompts to find an exploit to hack hundreds of millions of people.

  Zoomsday vulnerability let anyone in a Zoom meeting take over anybody else. The vulnerability was developed with Hey Hi (AI) assistance and took research only used 20 prompts to find an exploit to hack hundred of millions of people.

• Tom's Hardware ☛ Coin-sized device can hack a Boeing 737’s Flight Management Computer, mess with takeoff weights, or even divert an aircraft — gadget connects to an easily accessible port that overrides commands from the pilots, uses in-flight Wi-Fi

  Security researchers discovered a way to tap into the avionics of a Boeing 737 and remotely give its flight management computer erroneous data through in-flight Wi-Fi. This coin-sized device plugs into a diagnostic port in the plane's avionics bay and could easily be hidden behind its protective dust cover.

• Windows TCO / Windows Bot Nets

  • Security Week ☛ Nightmare Eclipse Drops backdoored Windows Zero-Day Exploit ‘ShieldBreak’

    Dropped on Patch Tuesday, the exploit allows any user to spawn a shell with System privileges.

  • Tom's Hardware ☛ Microsoft's nemesis drops new zero-day privilege escalation vulnerability — attack grants system-level privileges, but it could already be patched

    Nightmare Eclipse drops ShieldBreak, another backdoored Windows zero-day privilege escalation vulnerability, but Abusive Monopolist Microsoft has rushed quickly to block it with Defender