news
Security News and FUD/Hype
-
LWN ☛ Security updates for Thursday
Security updates have been issued by AlmaLinux (cjose, emacs, expat, gcc-toolset-15-gcc, java-17-openjdk, java-25-openjdk, kernel, kernel-rt, libX11, libXi, libXrender, libXtst, mod_auth_openidc:2.3, pki-deps:10.6, thunderbird, webkit2gtk3, and yggdrasil), Debian (chromium, firefox-esr, and openjdk-25), Fedora (firefox, librabbitmq, libreswan, python-pillow, and unbound), Mageia (fio and python3, python-pip), Oracle (buildah, cjose, container-tools:ol8, emacs, flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac, kernel, libX11, libXi, libXrender, libXtst, podman, python-urllib3, thunderbird, and yggdrasil), Red Hat (firefox, goose, kernel, kernel package, kernel-rt, librsvg2, multiple packages, php:7.4, sudo, thunderbird, and xorg-x11-server), and SUSE (alsa, ca-certificates-mozilla, chromedriver, cifs-utils, coredns, coreutils, cpupower, curl, cyrus-sasl, docker, dpdk, haproxy, kernel, libpoppler-cpp3, libsndfile-devel, libzbar-devel, mozilla-nss, MozillaFirefox, nginx, openai-codex, and perl-Cpanel-JSON-XS).
-
Security Week ☛ Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.
-
Security Week ☛ BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts
BAE Systems says no data was extracted and no PII was breached in the incident that disrupted US bankruptcy court notices for weeks.
-
Federal News Network ☛ Federal security leaders team up as post-quantum deadlines tighten
An informal CISO group is helping agencies find gaps as the 2030 post-quantum migration deadline nears.
-
Security Week ☛ Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation.
-
SANS ☛ Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
Building your malware analysis lab is a key point before playing with malware.
-
Tom's Hardware ☛ Fake PS5 emulators are being used to steal gamers' passwords
Malware disguised as two popular PS5 game emulators, distributed via Microsoft's proprietary prison GitHub , has been identified as stealing passwords from unsuspecting gamers.
-
Security Week ☛ Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload.
-
Security Week ☛ Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net
The data of So-net and Plala customers in Japan was exposed, along with 54,401 email account passwords and 16 bank account records.
-
Security Affairs ☛ U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog.
-
Bleeping Computer ☛ CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.
Tracked as CVE-2026-46300 and known as Fragnesia, this vulnerability stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem that lets attackers run malicious code with root permissions.
-
IT Brief NZ ☛ Hexnode expands Linux patching & login controls in ANZ
Hexnode has expanded its Linux support in Australia and New Zealand, adding patch management in Hexnode UEM and cloud identity-based device login in Hexnode Access. The move is aimed at organisations managing devices across multiple operating systems.
-
Fear, Uncertainty, Doubt/Fear-mongering/Dramatisation
-
Hacker News ☛ Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions [Ed: Looks like PR/marketing by shady slop vendor]
A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale.
-
Linux Kernel CVE-2026-98432: Critical TCP Use-After-Free, No RHEL or Ubuntu Fix Yet
-
Hacker News ☛ Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October.
The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI configuration. Alpine found no evidence that the attack worked but cannot rule it out, so it rebuilt the server from scratch and reset every account's password.
-