Hasty Briefsbeta

All tags

security

105 stories total

Bilingual

Techie lured out of retirement to support software only he remembered
2 months ago
- Nvidia's Vera CPU features 88 custom cores, 176 threads, 1.5 TB laptop RAM, and 1.8 TB/s NVLink connectivity, targeting datacenters.
- Enterprise cloud infrastructure revenue exceeds $143 billion per quarter, with growth accelerating.
- Security incidents include Anthropic and OpenAI competing in rogue AI agents, Russian phishing via Signal, and Microsoft SharePoint zero-day attacks.
- UK proposes refundable fees for datacenter grid connection requests to prevent frivolous applications.
- DEF CON's Franklin project expands to harden critical infrastructure, involving hackers in voting village reports.
- FOSS efforts target Microsoft monopoly; GNOME introduces taskbar, Debian ends x86-32 support, and new X11 server 'Frame' built in assembly.
AUR Packages Adoption And Pushes Disabled
2 months ago
- Package adoption on AUR is temporarily disabled due to malicious adoptions and commits.
- Users are advised to report suspicious adoption events or commits.
- All pushes to AUR have been disabled to handle the security situation.
- The Arch Linux DevOps team is working on resolving the issue and will send a follow-up.
RFC 9987: Secure Shell (SSH) Agent Protocol
2 months ago
- The document specifies a key agent protocol for use in the Secure Shell (SSH) protocol, enabling clients to interact with a key management component that holds private keys.
- The protocol is a packetised request-response system driven solely by the client, with messages for loading, removing, listing, and using keys, as well as locking/unlocking the agent.
- Keys can be added with optional constraints such as lifetime or user confirmation, and agents may support only a subset of key types or refuse operations in certain contexts.
- Agent forwarding over SSH connections is supported, allowing remote systems to use stored keys without exposing key material, but caution is advised due to transitive trust.
- Security considerations emphasize protecting agent access via permissions, preventing memory theft, mitigating side-channel attacks, and guarding against brute-force lock attempts.
NetBSD 11.0
2 months ago
- NetBSD 11.0 has been released, with details available in the release announcement.
- Users on ARM devices should use pre-configured images with U-Boot from the bootable ARM images page.
- ISO images are split into CD-ROM (<700MB) and DVD versions; use .img files for USB drives and decompress them first.
- The release was delayed due to waiting for third-party fixes and ongoing security issues; the team chose to be transparent about open issues.
- Open security issues include hdaudio ioctl access checks, ipfilter null pointer deref, and pf use-after-free, all to be fixed in upcoming 11.1 release.
Arch AUR Under Another Wave of Malicious Packages, Package Adoptions Halted
2 months ago
- Last month, the AUR experienced over 1,500 malicious packages due to a sophisticated malware attack and an influx of spam and profanities.
- A new wave of malicious packages has emerged, prompting the Arch Linux team to temporarily disable package adoptions in the AUR.
- Users are urged to report suspicious adoption events and comments and remain vigilant.
- A mailing list thread documents dozens of affected packages, including i915-sriov-dkms, rtk-git, and others.
New Defcon Badges Pack a Unique Open-Source Chip That Doubles as a Security Key
2 months ago
- Defcon 2023 badges feature a custom open source chip called Baochip-1x, designed by Andrew 'bunnie' Huang.
- The removable core module serves as a hardware security token (FIDO, TOTP, password manager) for use after the conference.
- Baochip-1x is mostly open source, with source code on GitHub, and is packaged for infrared silicon inspection to verify its design.
- The chip uses a RISC-V core, runs a Rust OS, and includes secure boot, true RNG, and RRAM memory for security.
- Badges include LED lights with customizable patterns and a camera for QR scanning, with privacy features.
NOAA ditches weather-predicting supercomputers for Google Cloud
2 months ago
- UK requires datacenters to pay refundable fees for grid connection requests to deter frivolous applications.
- New storage-inspired high-bandwidth flash memory could enable GPUs with multiple TB capacity, though not without challenges.
- Open source project ShieldFont uses poisoned fonts to protect text from AI scrapers.
- For the first time, a majority of corporate IT workloads now run off-premises, according to a survey.
- Closed-source AI models refused to help a researcher fix a Linux bug, highlighting the value of open source.
- Russian actors are impersonating Signal support for phishing; other security incidents reported.
- Microsoft's patches failed to fix on-prem SharePoint, now exploited in zero-day attacks; plus China's surveillance upgrades and Ring's policy changes.
- DEF CON's Franklin project enlists hackers to secure critical infrastructure, expanding from voting village successes.
- EQT acquires majority stake in Swiss cybersecurity firm Acronis at a valuation exceeding $3.5 billion.
- Mikko Hyppönen notes ten years since first corporate ransomware, with no end in sight, but stable careers in infosec.
- FOSS broke one Microsoft monopoly; after 20 years of failure, it aims to break another.
- GNOME can mimic Windows appearance using Flashback without extensions; a simpler taskbar option is available.
- Debian releases final version for x86-32 architecture alongside new versions 13.6 and 12.15.
- Attackers exploit two Joomla extensions with perfect CVSS scores on vulnerable sites.
- Frame is a new X11 server implemented directly in assembly language.
- Cinnamon 6.8 will optionally support Wayland display server.
LinkedIn realizes its users have been bathing in AI slop, offers a shower
2 months ago
- New storage-inspired memory tech could enable GPUs with multiple TB of high-bandwidth flash, combining SSD capacities with HBM-like speeds.
- Open source project ShieldFont uses poisoned fonts to fool AI scrapers and protect copy.
- For the first time, majority of corporate IT workloads are now off-premises, according to a survey.
- Closed AI models refuse to help researchers fix Linux bugs, highlighting open source advantages.
- Intel's Optane memory is praised as ideal for AI workloads but discontinued before its potential could be realized.
- Russian hackers pose as Signal support to launch phishing attacks; US takes down Iranian propaganda sites.
- Microsoft patches for on-prem SharePoint fail, leaving it under zero-day attack.
- DEF CON's Franklin project enlists hackers to harden critical infrastructure; voting village reports successful.
- EQT buys majority stake in Swiss cybersecurity firm Acronis at a $3.5B+ valuation.
- Ten years after first corporate ransomware, infosec expert Mikko Hyppönen sees no end in sight.
- FOSS movement aims to break another Microsoft monopoly after 20 years of failure.
- GNOME introduces Simple-taskbar to mimic Windows look without extensions; Flashback offers another option.
- Final release of Debian on x86-32 (versions 13.6 and 12.15) marks the end of an era.
- Critical vulnerabilities in Joomla extensions iCagenda and Balbooa Forms exploited by attackers.
- Frame: a new X11 server implemented directly in assembly joins other X11 implementations.
- Cinnamon 6.8 will support Wayland optionally, giving Linux Mint users both display server choices.
Open source project fools AI scrapers with poisoned font
2 months ago
- High-bandwidth flash memory technology could enable GPUs with multiple TB capacity, combining SSD-like capacities with HBM-like speeds.
- ShieldFont, an open source project, poisons fonts to fool AI scrapers and protect text content.
- For the first time, the majority of corporate IT workloads are now off-premises, according to a survey.
- Closed AI models refused to help a researcher fix a Linux bug, highlighting a weakness compared to open source.
- Intel's Optane memory, ideal for AI workloads due to low latency and high endurance, is no longer in production.
- Russian hackers are posing as Signal support for phishing attacks; other security news includes takedowns and data privacy issues.
- Microsoft's on-prem SharePoint patches failed, leaving it vulnerable to zero-day attacks.
- DEF CON's Franklin project recruits hackers to secure critical infrastructure, with voting village reports leading to broader inclusion.
- EQT has acquired a majority stake in Swiss cybersecurity firm Acronis at a valuation over $3.5 billion.
- Mikko Hyppönen notes that corporate ransomware is now ten years old with no end in sight, but infosec careers remain stable.
- FOSS advocates suggest it's time to break another Microsoft monopoly after successfully ending one with Linux.
- GNOME can be made to look like Windows using the Flashback project, without needing extensions.
- Debian has released its final version supporting 32-bit x86 architecture.
- Attackers are exploiting high-severity bugs in Joomla extensions (iCagenda, Balbooa Forms) affecting millions of sites.
- A new X11 server called Frame has been implemented entirely in assembly language.
- Linux Mint's Cinnamon desktop version 6.8 will include optional Wayland support.
Digital sovereignty is real in Europe. The UK? Not so much
2 months ago
- New storage-inspired memory tech could enable GPUs with multiple TB of capacity, combining SSD-like capacities with HBM-like speeds.
- An open source project called ShieldFont poisons fonts to fool AI scrapers and protect copy.
- For the first time, the majority of corporate IT workloads are now off-premises, according to a survey.
- Closed AI models refused to help a researcher fix a Linux bug, highlighting the value of open source.
- Intel's Optane memory, ideal for AI workloads, is mourned as it was discontinued before its time.
- Russian actors are posing as Signal support to launch phishing attacks, along with other security incidents.
- Microsoft's patches failed to fix an on-prem SharePoint zero-day vulnerability, now under attack.
- DEF CON's Franklin project enlists hackers to secure critical infrastructure, expanding voting village success.
- EQT acquires a majority stake in Swiss cybersecurity firm Acronis at a $3.5B+ valuation.
- Mikko Hyppönen reflects on a decade of ransomware, noting no end in sight and stable infosec careers.
- FOSS advocates call for smashing another Microsoft monopoly, this time in word processing.
- GNOME can now look like Windows via the Simple-taskbar extension, with Flashback offering a stable alternative.
- Debian releases final version for x86-32 architecture, alongside new versions 13.6 and 12.15.
- Vulnerabilities in Joomla extensions iCagenda and Balbooa Forms are being exploited with perfect 10 scores.
- A new X11 server called Frame is implemented directly in assembly language.
- Cinnamon 6.8 will support Wayland as an optional display server for Linux Mint.
After rewriting SQLite in Rust, Turso turns its sights on Postgres
2 months ago
- Closed models refuse to help researcher swat Linux bug, highlighting open source advantage.
- Intel's Optane, ideal for AI workloads, is gone before its time.
- MCP gets an enterprise makeover for Kubernetes environments.
- AI-controlled war machines pose risks of surveillance and flawed algorithms.
- Too many AI agents can hinder each other; less is more for enterprise.
- Russians pose as Signal support for phishing attacks; US takes down Iranian propaganda sites.
- Microsoft's on-prem SharePoint patches fail, now under zero-day attack; China upgrades surveillance.
- DEF CON Franklin project enlists hackers to harden critical infrastructure.
- EQT buys majority stake in Acronis at $3.5B+ valuation.
- Ten years of ransomware, Mikko Hyppönen sees no end, but infosec careers are stable.
- FOSS aims to smash another Microsoft monopoly after 20 years.
- GNOME can look like Windows with Flashback without extensions.
- Final release of Debian on x86-32; new versions 13.6 and 12.15.
- Joomla extensions with perfect 10 vulnerabilities exploited.
- Frame: new X11 server implemented in assembly, joining other projects.
- Cinnamon 6.8 will support Wayland optionally.
Moscow slaps Telegram founder on wanted list, Durov responds one-finger salute
2 months ago
- Closed AI models refuse to help with a Linux bug, highlighting open source advantages.
- Intel's Optane memory, ideal for AI workloads, is gone before its potential was realized.
- MCP gets an enterprise makeover for easier lifecycle management in K8s environments.
- AI-controlled war machines pose risks due to surveillance and flawed algorithms.
- Too many AI agents can hinder each other; less is more for enterprise use.
- Russians use fake Signal support for phishing; other security updates noted.
- Microsoft's SharePoint patch failures lead to zero-day attacks; other security issues.
- DEF CON's Franklin project enlists hackers to harden critical infrastructure.
- EQT buys majority stake in Swiss cybersecurity firm Acronis at over $3.5B valuation.
- Ransomware persists after ten years; infosec offers stable long-term careers.
- FOSS broke a Microsoft monopoly; now it aims to break another after 20 years.
- GNOME can look like Windows via Flashback without extensions.
- Debian releases final version on x86-32; new versions 13.6 and 12.15 available.
- Joomla extensions with critical bugs exploited; impacts millions of sites.
- A new X11 server, Frame, implemented in assembly joins other projects.
- Cinnamon 6.8 supports both Wayland and X11 for Linux Mint desktop.
Watch out for missed warnings on vendor C++ toolchains
2 months ago
- Vendor C++ toolchains may miss warnings that GCC or Clang catch, such as implicit narrowing conversions.
- A constant-time memcmp function had a bug where a uint8_t accumulator truncated 32-bit XOR results, comparing only every fourth byte.
- Enabling -Wconversion under GCC flagged the bug, but the vendor toolchain did not, despite the flag being set.
- Reviewers should test code with the latest GCC or Clang with maximal warnings to uncover hidden issues.
CodeCrucible: A blueprint for LLM-driven SAST
2 months ago
- CodeCrucible is a new LLM-driven static application security testing (SAST) tool for vulnerability discovery, but the focus is on the design blueprint rather than the tool itself.
- The key design choices involve four questions: compaction (how to fit code into context window), identification (how to prompt for vulnerabilities), relevance screening (how to filter false positives), and determinism (how to ensure stable outputs).
- Whole-repo concatenation packs the entire repository into a single LLM call, enabling cross-file reasoning, and works better than expected despite earlier assumptions that it would not scale.
- Chunking is used as a fallback when the repository exceeds context window, preserving file boundaries and related code, and never slicing files to fit the budget.
- Filtering is layered to remove low-value content (binaries, lockfiles, tests, docs) before deciding on chunking or cost, preserving structure like import graphs and API contracts.
- Quality gates include deduplication, a dedicated validation review with CWE-specific guidance, and strict output discipline (SARIF format, structured output, repair ladders).
- The tool successfully found the Copy Fail vulnerability (CVE-2026-31431) in Linux crypto subsystem when given a steering prompt, but initial attempts without steering failed.
- Limitations include degradation when repositories exceed context windows, coverage shaped by filtering, non-iterative pipeline (single-shot analysis), code-centric focus without runtime context, and shared constraints with other AI scanners (no repeatable deduplication).
- The blueprint approach emphasizes publishing tradeoffs and reference codebase so other teams can adapt it to their own pipelines and environments.
DEF CON bans Meta-style 'pervert glasses'
2 months ago
- AI war machines risk running amok due to flawed algorithms and surveillance.
- Shopify returns to clean code practices driven by AI agents.
- Russian phishing attacks target Signal users via fake support.
- Microsoft on-prem SharePoint zero-day remains unpatched and under attack.
- DEF CON Franklin project enlists hackers to harden critical infrastructure.
- FOSS continues to challenge Microsoft monopoly, with new releases like Debian 13.6 and Cinnamon 6.8 adding Wayland support.
This Week in Package Management: 18 July 2026
2 months ago
- pnpm 11.13 introduces pnpm change for native changeset-compatible release planning, pnpm team for registry management, and versioning.epics config for version band alignment.
- Deno 2.9.3 adds flags like --no-save, --save-optional, and --min-dep-age.
- pixi 0.73.0 supports workspace = true in environment dependency tables, allowing centralized version declaration.
- uv 0.11.29 adds JSON output to uv tree and prefers local artifacts over URLs in pylock.toml.
- Verdaccio 6.8.0 fires notification webhooks on unpublish and single-version removal, with improved security by exposing only limited user info.
- zizmor 1.27 adds experimental support for auditing GitHub’s parallel steps pattern.
- Rust 1.97.1 is a point release backporting an LLVM fix for a miscompilation issue.
- Homebrew 6.0.11 merges brew vulns for built-in CVE scanning of installed formulae.
- Docker Engine 29.6.2 fixes three CVEs related to git source checkout, BuildKit panic, and LLB file operation.
- sbt 1.12.14 backports a fix for CVE-2026-26032 in Apache Ivy PackagerResolver.
- Articles cover crates.io updates (Code tab, GitHub login separation, Svelte migration), Composer/Packagist supply-chain stress, and AI security engineering at Rust Foundation.
- Papers discuss software supply chain regeneration using generative AI, weaponizing setup instructions against AI coding agents, and modeling the distributed open-source vulnerability ecosystem.
- Forgejo 16.0 adds per-repository watch options, authorized integrations, and multi-line review comments.
- Ruby 4.0.6 is a routine bugfix release.
War machines can run amok with AI in control
2 months ago
- AI control in war machines presents risks due to flawed algorithms and surveillance
- Enterprise AI agents should be limited to avoid inefficiency
- Some Chinese AI models may be imitating Claude's identity, but proof of distillation is lacking
- AI drove Shopify to return to clean coding practices for readability and clarity
- Anthropic releases Opus 5 at a lower price than Fable without data retention
- Russian phishing attacks target Signal support, plus other security incidents
- Microsoft's SharePoint on-premises fixes failed, now under zero-day attack
- DEF CON's Franklin Project enlists hackers to harden critical infrastructure
- EQT buys a majority share in Acronis at a $3.5B+ valuation
- Ten years after first corporate ransomware, experts see no end in sight
- FOSS aims to break another monopoly after Microsoft's Word era
- GNOME can mimic Windows layout without extensions via Simple-taskbar
- Final Debian release for x86 is 32-bit version
- Joomla extensions with perfect 10 scores exploited on vulnerable sites
- Frame is a new X11 server implemented directly in assembly
- Cinnamon 6.8 supports Wayland optionally for Linux Mint desktop
Several US schools to install pepper-spraying drones as school shooting response
2 months ago
- Several US schools are installing pepper-spraying drones, inspired by the Ukraine war, to respond to school shootings.
- The drones, provided by Campus Guardian Angel, launch after threat confirmation, are flown remotely, and feature a speakerphone for two-way communication.
- They carry pepper launchers, can break windows, drop air poppers, and deliver kinetic strikes to incapacitate a shooter.
- The company plans to use waves of 3-4 drones to occupy the shooter until law enforcement arrives.
- Critics like Tony Montalto, father of a Parkland victim, argue that the focus should be on prevention rather than reaction.
Show HN: Tines 3B – safe workflow automation for when everyone builds software
2 months ago
- Achieve complete security and freedom to build without compromises.
- Gain visibility across AI-created work: know what exists, who built it, and what it touches.
- Enable control without bottlenecks, allowing teams to self-serve while maintaining governance.
- Receive autonomous fixes for anomalies, controlled by you, with workflows that improve over time.
- Use AI on your terms: choose where, when, and how LLMs are used with flexibility to switch strategies.
- Keep important workflows moving for teams that depend on them.
About the security content of macOS Tahoe 26.6
2 months ago
- macOS Tahoe 26.6, released July 27, 2026, includes security patches for numerous vulnerabilities across various components.
- Vulnerabilities addressed include issues in Accounts, Kernel, WebKit, and many others, with impacts such as privilege escalation, sensitive data access, denial of service, and arbitrary code execution.
- The update fixes over 100 CVEs, with contributions from many external researchers and organizations.
- Additional acknowledgments are given for assistance in identifying and resolving security issues.

firstprev0next

security

Techie lured out of retirement to support software only he remembered

AUR Packages Adoption And Pushes Disabled

RFC 9987: Secure Shell (SSH) Agent Protocol

NetBSD 11.0

Arch AUR Under Another Wave of Malicious Packages, Package Adoptions Halted

New Defcon Badges Pack a Unique Open-Source Chip That Doubles as a Security Key

NOAA ditches weather-predicting supercomputers for Google Cloud

LinkedIn realizes its users have been bathing in AI slop, offers a shower

Open source project fools AI scrapers with poisoned font

Digital sovereignty is real in Europe. The UK? Not so much

After rewriting SQLite in Rust, Turso turns its sights on Postgres

Moscow slaps Telegram founder on wanted list, Durov responds one-finger salute

Watch out for missed warnings on vendor C++ toolchains

CodeCrucible: A blueprint for LLM-driven SAST

DEF CON bans Meta-style 'pervert glasses'

This Week in Package Management: 18 July 2026

War machines can run amok with AI in control

Several US schools to install pepper-spraying drones as school shooting response

Show HN: Tines 3B – safe workflow automation for when everyone builds software

About the security content of macOS Tahoe 26.6