Security updates for Saturday

https://lwn.net/Articles/1085272/ #LWN #Linux #security

httpd(8) gains support for custom HTTP headers https://www.undeadly.org/cgi?action=article;sid=20260725103657 #openbsd #httpd #customheaders #securityheaders #webserver #security #libresoftware #freesoftware

Google now support account recovery with AI and your face. What could possibly go wrong? Google having my face is not just bad enough but chances are high that selfie video may not work in edge cases or network down etc.

https://blog.google/innovation-and-ai/technology/safety-security/selfie-video-sign-in/

#privacy #security #DoNotwant

Alt...

The tweet from Google offical account reads: Forgot your password? Lost your phone? Can’t get into your account? You can now use a selfie video to log into your Google Account. The new feature is easy to use and lets you sign in — even if you forget your password or don’t have your usual phone or laptop — with a quick selfie. There is a short video showing how to use a selfie video to log into your Google Account and link to https://blog.google/innovation-and-ai/technology/safety-security/selfie-video-sign-in/

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

Security updates for Friday

https://lwn.net/Articles/1084860/ #LWN #Linux #security

Security updates for Thursday

https://lwn.net/Articles/1084401/ #LWN #Linux #security

PyPI now rejects new files after 14 days

https://lwn.net/Articles/1084218/ #LWN #Linux #security #Python

Security updates for Wednesday

https://lwn.net/Articles/1084210/ #LWN #Linux #security

A Device Hidden in #Cars Across the US Leaves Them #Vulnerable to #Hacking and Paralysis. Patch It Now

#Dealerships installed alarms in millions of vehicles—and left them in even if the buyer didn’t want them. Now researchers warn they can be hacked to unlock, track, and disable cars.
#privacy #security

https://www.wired.com/story/a-device-hidden-in-cars-across-the-us-leaves-them-vulnerable-to-hacking-and-paralysis-patch-it-now/

The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised.

https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days

#python #security #supplychain #pypi

New, exclusive, by me: LG to Ban Residential Proxy Providers from Smart TV Apps

The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV.

https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/

#smarttv #lg #residentialproxies #spur #security

Alt...

A Pac-Man smart TV app from Bright Data offers users the choice between viewing ads in the game or agreeing to allow their TV to serve as a residential proxy node. The image features a picture of Pac-Man celebrating, and some ghosts on the right. It says: Play Pac-Man without ads! For an ad free experience, please allow web indexing by Bright Data to use your device's free resources and IP address to download web data from the Internet. None of your personal information is collected, except your IP address. Bright Data does not track you. Bright Data may continue running in the background even after you close the app. Scan the QR code to learn more about Bright Data policy and ethical usage. Image: Spur.us.

Today I received an email from Supermicro that they've released new BMC firmware and a BIOS for some systems I subscribed to. Nothing special.

That is, until I noticed what machine was listed. Introduced late 2015/early 2016

I have never purchased whatever support. Both Supermicro and Dell work this way.

HPE does not. They require you to have overzealous support agreements, costing an arm and a leg. No agreement, no BIOS updates for you

In most cases, companies do prefer these support agreements. Having someone to assist you when shit hits the fan for a (relatively) small stack of dough is a no-brainer.

However - this is completely fucked up. It really hurts the second hand market, homelabs, etc. Imagine not being able to patch against nasty silicon-level vulnerabilities because those fuckers want to see 5K of your hard earned cash

#Rant #Security #Vulnerabilities #Hardware #Servers #HPE #SysOp #Homelab

OpenBSD relayd(8) adds ECDSA support with CA engine code from smtpd(8) https://undeadly.org/cgi?action=article;sid=20260721124747 #openbsd #relayd #ecdsa #cryptography #security #https #loadbalancing #webserver #networking #develppment #freesoftware #libresoftware

Security updates for Tuesday

https://lwn.net/Articles/1083948/ #LWN #Linux #security

When building a multi-factor authentication system for clients, backups codes should be generated just in case the user does not have their second factor with them.

The backup codes should all be one-time use of course, but how do you store them on the backend? What is best practice here? What is a real-world threat model?

#passwords #security #cybersecurity

Catanzaro: Some changes to GNOME security tracking

https://lwn.net/Articles/1083754/ #LWN #Linux #security

Security updates for Monday

https://lwn.net/Articles/1083708/ #LWN #Linux #security

Looks like nextcloud.com has been hacked (now down).

https://www.reddit.com/r/NextCloud/comments/1v0wxw7/nextcloudcom_cloudbox/

#Nextcloud #security #infosec #opensource

🚨 Actively abused vulnerability in WP 🚨

WordPress has an actively abused SQL injection in the core in versions =<7.0.1. You should update to 7.0.2 as soon as humanly possible. Sites are already exploited.

Check whether the site has admin users that you don't recognize

More info: patchstack

Note: it has been a long time since there was a nasty vuln like this in the WP core.

#WordPress #Security #Vulnerability #Exploit #Patch

RFC 9116: security.txt

Does your website have a security.txt file to let security researchers know how to responsibly contact you regarding security vulnerabilities on your site?

Alt...

a red security sign and a blue security sign

"Half a Second" — a book on the XZ backdoor

https://lwn.net/Articles/1083466/ #LWN #Linux #security

Security updates for Friday

https://lwn.net/Articles/1083388/ #LWN #Linux #security

Asking various #AI bots to generate 10 #passwords, then using #Vim syntax highlighting to match different character classes to visually identify patterns.

The prompt is exactly "Generate 10 passwords". I did not elaborate further or otherwise restrict the bot in what to generate.

Aside from the #security risks of servers generating secrets for you, I think it's obvious that these lack quality entropy.

Just use the password generator that ships with your password manager.

Alt...

Screenshot of passwords generated from 8 different LLMs using view(1) in Konsole

GrapheneOS version 2026071500 released:

https://grapheneos.org/releases#2026071500

See the linked release notes for a summary of the improvements over the previous release.

Forum discussion thread:

https://discuss.grapheneos.org/d/40416-grapheneos-version-2026071500-released

#GrapheneOS #privacy #security

Security updates for Thursday

https://lwn.net/Articles/1083201/ #LWN #Linux #security

Local DoS attack vectors in seunshare 3.10 (SUSE Security Team Blog)

https://lwn.net/Articles/1083076/ #LWN #Linux #security #SUSE

Security updates for Wednesday

https://lwn.net/Articles/1083044/ #LWN #Linux #security

Many old shim versions are still accepted by secure boot

https://lwn.net/Articles/1082940/ #LWN #Linux #security

Security updates for Tuesday

https://lwn.net/Articles/1082832/ #LWN #Linux #security

g2k26 Hackathon Report: Job Snijders (job@) on rpki-client(8) progress https://www.undeadly.org/cgi?action=article;sid=20260714094547 #openbsd #rpkiclient #pki #bgp #routing #security #hackathon #development #freesoftware #libresoftware

Security updates for Monday

https://lwn.net/Articles/1082642/ #LWN #Linux #security

#FacialRecognition in #UK Shops Will Soon Instantly Alert #Police About Offenders
#ai #privacy #surveillance #security #biometrics

https://news.slashdot.org/story/26/07/12/0259226/facial-recognition-in-uk-shops-will-soon-instantly-alert-police-about-offenders?utm_source=rss1.0mainlinkanon&utm_medium=feed

For those who have been following the Israeli company’s Pegasus product being used to spy on journalists and politicians around the world, this might amuse. A podcast from Australia’s ABC. I might disagree with some of their conclusions, but it is a very fun listen.

https://www.abc.net.au/listen/programs/if-youre-listening/criminals-if-you-re-listening/106885272

#Podcast #ABC #Australia #Pegasus #Security #Privacy #Palentir

GrapheneOS version 2026071100 released:

https://grapheneos.org/releases#2026071100

See the linked release notes for a summary of the improvements over the previous release.

Forum discussion thread:

https://discuss.grapheneos.org/d/39301-grapheneos-version-2026071100-released

#GrapheneOS #privacy #security

[$] An update on the scraper situation

Our article "Fighting the AI scraper bot scourge", published in early 2025, discussed the problem of widespread scraping of web sites in search of training data for large language [...]

https://lwn.net/Articles/1080822/ #LWN #Linux #security

Security updates for Friday

https://lwn.net/Articles/1082272/ #LWN #Linux #security

The state of "#AI" #security:
How do we keep Captain Crunch from phreaking by inventing elaborate melodies?

#InBandSignalling

https://en.wikipedia.org/wiki/John_Draper

Security updates for Thursday

https://lwn.net/Articles/1082030/ #LWN #Linux #security

A few implementations of collecting mouse entropy for secure randomness generation.

https://gist.github.com/atoponce/aab1532438dd047d73567edccc3ecf93

#cryptography #security

Security updates for Wednesday

https://lwn.net/Articles/1081798/ #LWN #Linux #security

xorg-server 21.1.24 and xwayland 24.1.13 released to fix more security issues https://www.gamingonlinux.com/2026/07/xorg-server-21-1-24-and-xwayland-24-1-13-released-to-fix-more-security-issues/

#OpenSource #Security #Linux #Xwayland #xorg