Security updates for Thursday

https://lwn.net/Articles/1096407/

#LWN #Linux #security

Critical security vulnerabilities in the Radicle network protocol

https://lwn.net/Articles/1096200/

#LWN #Linux #security

Critical WordPress RCE vulnerability announced

https://lwn.net/Articles/1096195/

#LWN #Linux #security

Security updates for Wednesday

https://lwn.net/Articles/1096191/

#LWN #Linux #security

Security updates for Tuesday

https://lwn.net/Articles/1096022/

#LWN #Linux #security

I love my fairphone, in case you are considering one. Daily driver in the US and while traveling. Murena is a/the? US distributor.
I'm not affiliated with either, but this was my choice to move away from/off oligarch technology.
#repairability #antioligarchy #opensource #security

Security updates for Monday

https://lwn.net/Articles/1095702/

#LWN #Linux #security

its good wider community (mostly older folk/seniors?) came out in support after this Islamic Centre in #Cornwall was attacked (including funding upgraded #CCTV and #security equipment!) but offenders need to be caught

After ramming gates, they poured used engine oil around the grounds from what appears to be a 20/25 litre container + maybe a smaller 5l one.

Not stuff you generally have lying around, unless you do your own oil changes or work in a repair garage!

Also to bust the gates they needed access to a large vehicle they didn't mind putting a few (more?) dents/cracks in the bumper, suggesting lads from local rural community (building not obviously Islamic from outside) with an interest in vehicles (but also with history of reckless driving)

https://www.bbc.co.uk/news/articles/cm62exggn0nwo

...

- #Surveillance
- Controlling content we see
- Making unaccountable life-changing decisions

The #Labour manifesto promised it would regulate AI. But #Starmer succumbed to pressure from #BigTech and pursued ‘growth’ over our rights

It’s time for our new Prime Minister & Minister for AI, Narayan, to introduce legislation that will #regulate AI and ensure that works for all of us and does not harm our #HumanRights

https://action.openrightsgroup.org/tell-andy-burnham-regulate-ai

#safety #security #privacy #DigitalAlert

[2/2]

Security updates for Friday

https://lwn.net/Articles/1095219/

#LWN #Linux #security

Security updates for Thursday

https://lwn.net/Articles/1094962/

#LWN #Linux #security

[$] Ways to encrypt data on servers

At the 2026 edition of FOSSY, Romeo Solano gave a fast-paced, humorous presentation on what could have been a rather boring topic: server encryption. There are a number of threats [...]

https://lwn.net/Articles/1092553/

#LWN #Linux #security #systemd #OpenSSH #XFS

Security updates for Wednesday

https://lwn.net/Articles/1094720/

#LWN #Linux #security

EuroBSDCon 2026 talks online https://undeadly.org/cgi?action=article;sid=20260916093106 #openbsd #eurobsdcon #conference #development #security

Adamsdesk Bans Font Squirrel Over Privacy Concerns?

Find out what lead to the discovery of privacy concerns, complications whether to ban linking to certain websites and what decision was made.

https://www.adamsdesk.com/posts/font-squirrel-privacy-concern/

#blog #privacy #security #tech #technology

Alt...

A squirrel sitting in an opening covered in grass with a row of tall trees stand in the background around bushes. Above is bold title that reads, 'Adamsdesk Bans Font Squirrel?' with a red no symbol over top of the squirrel.

Security updates for Tuesday

https://lwn.net/Articles/1094469/

#LWN #Linux #security

Emacs arbitrary code execution flaw

https://lwn.net/Articles/1094224/

#LWN #Linux #security

Security updates for Monday

https://lwn.net/Articles/1094211/

#LWN #Linux #security

This one goes close to my heart.

If you work in #IT and you think you made systems safer by implementing logout timeout, then the only thing you did is that you forced people to find “ways around”.

And it is yours and only yours fault if the people do something silly and insecure.

#Security #Password

Security through obscurity - the last days

The traditional approach to ‘if no one knows then they won’t find out’ that has been adopted by many companies and organisations to protect their systems is finally on it’s way out - and in part we have AI attacks to thank for it.

https://www.theregister.com/security/2026/09/13/security-through-obscurity-is-dead-and-ai-delivered-the-fatal-blow/5296000

#Security #Obscurity #AI #IT

We had a big wave of automated Mastodon signups with very predictable usernames.

I first tried the sledgehammer approach and blocked known VPN ranges at the firewall.

It (partially) worked.

It also blocked legitimate ProtonVPN users. 😬

So I replaced that with a tiny custom Mastodon validator that rejects the actual abusive username pattern instead.

Much cleaner: block the abuse, not the transport.

How-to + code:
https://gist.github.com/chofstede/a422427570004719196cde948521dd04

#Mastodon #Mastoadmin #Fediverse #SysAdmin #Ruby #Rails #Security @tux @AlienJay @aping

The "Vaults" folder encryption app (https://flathub.org/apps/io.github.mpobaschnig.Vaults) is a very cool concept, I think it would benefit from being more widely discovered (keywords may help: https://github.com/mpobaschnig/vaults/issues/195)

I wonder what I could use it for, in a future where GNOME OS will provide per-user home directory encryption out of the box with #systemd, and Pika Backups already has encryption.

Anyone using Vaults (or similar) for something interesting?

#encryption #gocryptfs #CryFS #infosec #security #Linux #GNOMEOS

Imagine you're having a remote appointment with your doctor for a very personal health issue.

Your doctor is a tech enthusiast, and is proudly wearing the new Apple Watch with all the recording features enabled.

You don't see the "Audible and visible signals for Live Rewind", because you don't see your doctor's wrist on videochat or on speakerphone.

The "Omitted content" safeguard fails to detect the sensitive conversation, because none of the pre-selected keywords are detected.

"What about all the privacy laws protecting me?", you claim in distress.

Sadly, your doctor is unaware and thinks "surely Apple respects all the laws by default?"

The medical clinic isn't informed about privacy risks related to new technologies, and hasn't implemented any training or policies about it yet.

Your sensitive health data is collected by Apple's new features, stored on their servers, blissfully unaware of the infringements to your consent, your privacy, and all the laws supposed to protect you.

This is only one scenario of the many surveillance nightmares we might hear about in the coming months and years.

Brace yourself.

#Privacy #Security #Consent #Apple

The Open Source Security Summit is less than a week away! Featuring insights on cyber policy and geopolitics, the ethics and culture shaping the #security community, and more, this free virtual event is one you won’t want to miss.

Save your spot now: https://bitwarden.com/open-source-security-summit/

Security updates for Friday

https://lwn.net/Articles/1093765/

#LWN #Linux #security

Forgejo 16.0.4 and 15.0.8 address critical security vulnerability

https://lwn.net/Articles/1093671/

#LWN #Linux #security #Git

Security updates for Thursday

https://lwn.net/Articles/1093566/

#LWN #Linux #security

The #ColdWar is over. " #PaxAmericana" is over

It's regional powers abusing their neighbors now

#Ukraine, #Georgia etc near #Russia

#Canada, #Venezuela etc near #USA

#Taiwan, #Philippines etc near #China

Here's an amazing bit of #diplomacy #drama on the point

Philippine #Defense Secretary #GilbertoTeodoro at a #SouthKorea #security forum is handed a note apparently from a Chinese #military attaché

And ad libs this witty, dignified reaction

https://www.deccanherald.com/world/asia/have-a-little-shame-philippines-defence-chief-gets-chinas-note-mid-speech-fires-salvo-over-south-china-sea-claims-4140722

#SouthChinaSea #UNCLOS

A decade of Rustls

https://lwn.net/Articles/1093391/

#LWN #Linux #security

Security updates for Wednesday

https://lwn.net/Articles/1093342/

#LWN #Linux #security

Beware the monster inside. But I am sure that Musk would approve

https://www.theguardian.com/australia-news/2026/sep/09/how-one-womans-tesla-was-remotely-controlled-and-harass-by-her-abusive-ex-partner-ntwnfb

#Security #Privacy #Tesla

I've had admin powers at 5+ companies' Google Workspace/G Suite over the past decade or so. Every single one had groups which were misconfigured, often so anyone in the whole company could join without approval or see the message history at https://groups.google.com without being a member at all.

This is because for any sensible configuration of Google Groups when using it for email groups you have to use the "Custom" permissions mode. The default Public mode doesn't allow external people to email the group, but does allow the whole company to see all the messages. The default Team mode, has the same problem of everyone being able to see all the messages.

Also let's not forget that dangerous little "Anyone in the organisation can join" toggle at the bottom which is on by default. So any random new starter can join your confidential company directors group and get all the emails sent to it.

Giving Google the benefit of the doubt here, I think the reasoning might be that Google Groups is intended as a kind of company forum, not for private email groups. However that isn't how anyone uses it in my experience...

#security #infosec #google #googleworkspace

Alt...

Screenshot of the default Google Group settings for team mode

Alt...

Screenshot of the default Google Group settings for public mode