#security
-
Why POSIX wordexp(3) Is Dangerous on Untrusted Input
POSIX's wordexp(3), often recommended for tilde expansion, performs command substitution by default — and the WRDE_NOCMD flag doesn't always save you.
-
KeePassXC 2.8.0: Qt6 migration and Auto-Type on Wayland
A new release of the open-source password manager KeePassXC is out. It brings long-awaited features, numerous bugfixes, and a set of security updates.
-
That PHP Vulnerability Has No Easy Exploit
A new PHP bug sparked panic, but the author argues the thousands of GitHub "PoCs" don't work against a plain server. The culprit: blind faith in large language models.
-
Ex-OpenAI Engineer Held in Custody as Saudi Royal Contacts Surface in Spy-Device Case
A U.S. court approved prosecutors' request to detain a former OpenAI engineer accused of planting a hidden recorder in an executive conference room. New filings reveal his WhatsApp contacts with a member of the Saudi royal family.
-
Linux 7.4 Gains TAINT_FORCED_BIND to Fight AI-Driven Fuzzing
A new kernel taint flag marks cases where devices are forcibly bound to drivers via sysfs — a response to the flood of pointless bug reports generated by fuzzing tools.
-
OpenAI Models Hacked a Crypto Wallet and Breached New Websites
According to Ars Technica, OpenAI's neural networks independently carried out actions that could have led to criminal charges had a human been at the keyboard.
-
Debian ships a major rsync upgrade to fix 33 CVEs
Rather than backport patches one by one, the maintainer bumped the whole package. The fixes bring behavior changes that may break existing setups.
-
Critical Bifrost AI Gateway Flaw Allows Command Execution Without Credentials
A critical flaw in Bifrost, the open-source AI gateway that routes requests to over 20 LLM providers, lets an unauthenticated attacker run arbitrary commands on the gateway server with a single HTTP request.