Security
Four more fixes for your VPS this week
A backdoored OVHcloud CLI, a Brotli bug in Node.js, a BIND flaw that mostly affects Kerberos setups and a CVSS 10 in GitLab, and what each means for a small server.
Security
Everything netsec
Privacy
The Cellebrite iPhone leak is about seized phones, not remote hacking
A leaked flyer claims Cellebrite can unlock iPhone 11 to 16 from eight metres away. It is not a mass remote exploit, and it isn't confirmed. If your phone could be taken from you, it still changes what you should do.
Security
PHP2Shell: millions of attempts so far. Is your server next?
Two critical PHP flaws let an unauthenticated request run code on a PHP server before your application's login page loads. Patched releases are out, and anything you run on PHP, from billing front ends to phpMyAdmin, needs them now.
Security
eMudhra's private key was the number 4, and your command line may still trust it
Eight eMudhra intermediate CA keys were small enough to guess. Browsers blocked them within hours and Chrome drops the root on 27 October. Curl, old Go builds and stale trust stores are where the risk now sits.
Security
Your relay's version number is lying to you about an HTTP/3 bug
A header-compression flaw lets one connection exhaust an HTTP/3 server's memory. Hysteria2, Xray and sing-box all inherit it through quic-go, and many builds that look patched are not.
Investigations
Fake Proton and Amnezia are still on the Chrome Web Store
Kush Pandya found 274 Chrome extensions wearing other people's VPN brands. They set a SOCKS5 hop on port 1082 for a shop called Myxa.
zero-day
The Patch Wave: Eleven Breaches, One Week, and the Myth of the AI Collapse
A single week saw Linux, Windows, macOS, Next.js, and the global software supply chain battered by critical exploits and mass advisories. Is this the long-feared AI-driven collapse of digital infrastructure, or just the new normal? A technical, evidence-driven investigation.
Linux
Copy Fail: 732 bytes to root on almost every Linux server since 2017
A subtle 2017 optimisation in the Linux kernel's crypto layer has just been turned into a reliable, 732-byte path from any user account to root. Here's what it means for your servers and what to do right now.
Security
Cloudflare launches 1.1.1.1, a fast privacy-first DNS service
DNS is the system that converts websites' domain names (e.g. google.com) to an IP address. But not all public DNS servers are created equal. Right now, you're most certainly using your ISP's default DNS. But it may be slow, vulnerable to attacks or
Security
SpiderOak Semaphor 2.0 is the Slack alternative you've been waiting for
Group chat is now the backbone of millions of businesses - from small teams to Fortune 500 enterprises -. The first service that comes to mind is Slack, the one that started it all. But Slack is not perfect: the app is well-known for using too much RAM and making your
News
8tracks music service breached, millions of passwords stolen
8tracks internet radio and playlist service has been hit by an attack where over 18 million accounts' email and passwords have been stolen. Only users who signed up with their email as a mode of login have their password in the database. If you signed up to 8tracks via
Security
All-in-one Network management app NetX Pro free today on Google Play
NetGEL has made the NetX Pro app free today on Google Play. > NetX PRO - Android Apps on Google Play [https://play.google.com/store/apps/details?id=com.tools.netgel.netxpro] Discovers and manages all devices connected to the network WiFi/Mobile This feature-rich app allows you to