// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack
A red-team report found OpenAI's monitoring of its agents during a Hugging Face attack was partial and easily bypassed.
-
Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches
Linux kernel maintainer Linus Torvalds says AI-generated patches are acceptable if competent developers produce good code, but drive-by submissions should be avoided.
-
UK threatens subsea cable saboteurs with 14 years behind bars
The UK government proposed tougher penalties for damaging subsea cables and new powers over telecoms operators amid concerns about sabotage.
# Yesterday
-
PHP2Shell exploit bypasses protections designed to stop remote code execution
A PHP2Shell exploit reportedly bypasses protections designed to prevent remote code execution, according to researchers.
-
Max-severity GitLab bug allows remote code execution over 12 years of releases
GitLab disclosed a critical bug enabling remote code execution affecting releases over 12 years.
-
Disgraced Indian cert issuer leaves the cert issuing business
Indian certificate authority eMudhra said it will stop issuing SSL/TLS certificates after a private key was reportedly the number 4.
-
PHP2Shell puts dozens of UK government services out of service
A PHP-related issue disrupted dozens of UK government services, with ministers reporting 32 unavailable and four partly disrupted but no confirmed compromise.
-
When the attacker becomes the user: Rethinking account takeover
A sponsored feature discusses how AI makes phishing easier, prompting a reevaluation of account takeover threats.
-
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
AWS says attacks on PHP2Shell began before disclosure, and Cloudflare reported millions of exploit attempts against the vulnerability.
-
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Microsoft reports that a ConnectWise breach enabled Chinese spies to access 2,250 cloud tenants, with privileged access gained in some environments within three hours.
-
IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall
Auditors and IT staff at a pharmacy chain argued over using the word 'password' as a Cisco firewall password, citing misaligned incentives.
-
Certification authority eMudhra defends its laughably weak private keys
eMudhra says it passed audits and made a minor error after reports of weak private keys.
-
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
PHP project criticized Chainguard for its coordinated vulnerability disclosure approach, saying it could expose widely used web software to risk.
# 21 Oct
-
LiteLLM supply chain attack hoovers up passwords and secrets
A supply chain attack involving LiteLLM reportedly collected passwords and secrets and delivered a remote access trojan.
-
Signal bug could keep your mic - and camera - on after hangup
A Signal bug may leave the microphone and camera active after a call ends.