Security Leftovers

posted by Roy Schestowitz on Nov 14, 2026

• Scoop News Group ☛ Industry guidelines for offensive cyber tools unveiled through international Pall Mall Process

  The United States this week signed on to an international set of industry standards for commercial offensive cyber tools that human rights groups and other advocates wish had been stronger.

• LWN ☛ Security updates for Friday

  Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, firefox, gcc, grafana, grafana-pcp, gstreamer1, gstreamer1-plugins-base, java-1.8.0-openjdk, kernel, kernel-rt, libimobiledevice, mingw-libpng, nginx:1.24, nodejs:22, nodejs:24, perl-CGI, perl-DBI, qt5-qtbase, tigervnc, vim, and xorg-x11-server), Debian (apache2, c-ares, linux-6.12, node-shell-quote, nova, parted, postgresql-17, python-django, sympa, and tomcat10), Fedora (cockpit, erlang-ssl_verify_fun, httpd, ignition, jackson-bom, jackson-core, jackson-databind, jackson-modules-base, libvirt, mod_http2, mongo-c-driver, poppler, prometheus, pylint, python-discovery, python-loguru, python-PyMuPDF, rabbitmq-server, rust-crypto-bigint, rust-ctutils, rust-elliptic-curve, rust-num-bigint, rust-num-bigint0.4, rust-num-modular, rust-num-modular0.6, rust-num-prime, rust-routinator, rust-zmij, strongswan, xen, xorg-x11-server, and zvbi), Mageia (amule, peazip, and python-pytest), Red Hat (buildah, fence-agents, go-fdo-server, grafana, grafana-pcp, oci-seccomp-bpf-hook, osbuild-composer, podman, and rhc), SUSE (ansible-core, apr-util, aspell, brotli, cadvisor, civetweb, distribution-registry, elemental, elemental-register,, elemental-operator, elemental-system-agent, elemental- toolkit, ffmpeg, firefox, gimp, git-annex, go1.26, go1.27, golang-github-prometheus-prometheus, google-cloud-sap-agent, google-guest-agent, google-osconfig-agent, goose, gosec, graphicsmagick, haproxy, hauler, hawk-apiserver, hawk2, hcloud-cli, jhead, jsoup, kernel, librsvg, libXtst, libxtst, nodejs24, nvidia-open-driver-G07-signed, nvidia-open-driver-g07-signed, open-iscsi, perl-XS-Parse-Keyword, perl-xs-parse-keyword, python-asyncssh, python-Brotli, python-django, python-joserfc, python-M2Crypto, python-Pillow, python-pillow, python313-setuptools, rsyslog, speex, tiff, trivy, udisks2, vsftpd, xen, and xorg-x11-server), and Ubuntu (apache2, charybdis, debian-lan-config, glibc, golang-github-seccomp-libseccomp-golang, hiredis, httpie, imapfilter, lhasa, libjgraphx-java, libjwt, libsolv, linux-fips, linux-hwe-6.8, linux-hwe-7.0, linux-nvidia-tegra, minissdpd, ncmpc, nfdump, node-tough-cookie, openconnect, pillow, pngquant, python-gevent, radicale, ruby-openid, sa-exim, signing-party, sudo, tigervnc, and x11vnc).

• Security Week ☛ PHP2Shell Exploited in Destructive Check Point Gateway Attacks

  PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.

• Security Week ☛ Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure

  Investigators seized 235 servers and 257 domains, along with 6.4 million victim credentials as part of Operation Endgame.

• Security Week ☛ Citrix Patches 10 Critical NetScaler Vulnerabilities

  Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.

• Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 339 released

  The diffoscope maintainers are pleased to announce the release of diffoscope version 339. This version includes the following changes: [...]

• Reproducible Builds: Reproducible Builds in October 2026

  Welcome to the October 2026 report from the Reproducible Builds project!

• Qt ☛ New release cadence for Qt WebEngine and Qt PDF

  Starting with Qt 6.12, Qt WebEngine and Qt PDF are released as Qt Extensions modules, on their own schedule, separate from the Qt Framework releases. For you, this means Chromium security fixes reach your applications sooner, and newer Chromium versions arrive more often. Read on to learn about the new version numbers and how to pick the right release for your Qt version.

• Qt ☛ Security advisory: CVE-2026-103645 Integer overflow vulnerability in QTextCodec fromUnicode() and toUnicode() impacts Qt

  An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility Hey Hi (AI) module (Qt 6) and the Qt Core module (Qt 5) has been discovered and has been assigned the CVE id CVE-2026-103645. Only builds where Qt is compiled with ICU support are affected.

• Security Week ☛ SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks

  Enea says SilentAir hijacked mobile network nodes to intercept calls and messages, with Taiwanese subscribers the primary targets.

• Security Week ☛ Apify Confirms Customer Data Accessed in Cyberattack

  The web scraping company says an intruder accessed customer accounts and obtained personal information or stored data.

• Security Week ☛ FAA Ground Stop Issued Due to ‘Extraordinary Circumstances’

  Federal officials have yet to say what caused the communications disruption or whether they are investigating a possible cyberattack.

• France24 ☛ US flights resume after nationwide ground stop lifted

  The United States on Friday lifted an hours-long ground stop at the nation's airports, with top officials explaining that the disruption was not due to a cyberattack or a sweeping Abusive Monopolist Microsoft outage. Transportation Secretary Sean Duffy said that US airspace was now "opened up," and blamed "old hardware" for the travel chaos.

• Federal News Network ☛ Flights halted at airports across US due to air traffic control communications problems

  The Federal Aviation Administration has grounded all flights for just the second time since the Sept. 11 attacks, with officials citing “extraordinary circumstances” caused by communications problems at regional air traffic control centers. The nation’s top homeland security official attributed the problem to a telecommunications outage and said there was no indication yet of a nefarious act. But the consequences were profound. The ground stop disrupted potentially thousands of planned flights through at least late Friday night and upended travel plans for passengers who were heading home, expected as wedding guests or had other weekend plans.

• Security Week ☛ In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach

  Noteworthy stories that might have slipped under the radar: Siemens details security advisory policy, Proprietary Chaffbot Company Codex backdoor risk, Abusive Monopolist Microsoft warns of model weight backdoors.

• NVISO Labs ☛ Detection Engineering: Implementing Detection-as-Code in an Existing Environment: Part 3 – Validation and Future Possibilities

  Consolidating detection data is only the first step. In Part 3 of our Detection-as-Code series, we explain how we validate schemas and shared fields, resolve inconsistencies, and integrate checks into Microsoft's proprietary prison GitHub CI pipelines. Tiered validation blocks invalid changes while allowing teams to fix non-urgent issues over time.

• SANS ☛ Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)