mattotcha, to Cybersecurity
@mattotcha@mastodon.social avatar
majorlinux, to linux
@majorlinux@toot.majorshouse.com avatar

Patch your systems if you haven't already!

Federal agency warns critical Linux vulnerability being actively exploited

https://arstechnica.com/security/2024/05/federal-agency-warns-critical-linux-vulnerability-being-actively-exploited/

PC_Fluesterer,
@PC_Fluesterer@social.tchncs.de avatar

@majorlinux
Calm down. This weakness is exploitable only by an insider ("evil maid").

majorlinux,
@majorlinux@toot.majorshouse.com avatar

@PC_Fluesterer Why are you telling me to calm down?

I'm only sharing information and informing people that they should patch a system.

Also, who cares how it can be exploited?

There is an exploit that needs to patched regardless.

This is why we can't have nice things.

kubikpixel, (edited ) to linux German
@kubikpixel@chaos.social avatar

Meiner Meinung nach wird in der Open-Source Szene die IT-Sicherheit nicht versprochen, sondern meistens rasch umgesetzt und frei verteilt. Auch wenn das hier nun anders ist.

»Linux – root-Lücke wird aktiv missbraucht:
Die IT-Sicherheitsbehörde CISA warnt vor aktiven Angriffen auf eine Linux-Lücke. Angreifer verschaffen sich damit root-Rechte.«

🔥 https://www.heise.de/news/Linux-Luecke-Angreifer-verschaffen-sich-root-Rechte-9742699.html


#linux #itsicherheit #root #debian #fedora #redhat #ubuntu #opensource #it #cisa

gischpelino,
@gischpelino@mastodon.online avatar

@blackstream @kubikpixel genau das ist der Punkt: die Schwachstelle ist schon vor Längerem in den stabilen und lange gepflegten kernels beseitigt worden. Lange vor der Veröffentlichung!
Das schafft so mancher Softwarehersteller nicht. 😜

kubikpixel,
@kubikpixel@chaos.social avatar
governa, to random
@governa@fosstodon.org avatar
br00t4c, to chinese
@br00t4c@mastodon.social avatar

CISA boss: Secure code is the 'only way to make ransomware a shocking anomaly'

https://go.theregister.com/feed/www.theregister.com/2024/05/08/cisa_ransomware_rsac/

br00t4c, to random
@br00t4c@mastodon.social avatar

CISA's early-warning system helped critical orgs close 852 ransomware holes

https://go.theregister.com/feed/www.theregister.com/2024/05/07/cisas_ransomware_warnings/

br00t4c, to random
@br00t4c@mastodon.social avatar

The truth about KEV: CISA's vuln deadlines good influence on private-sector patching

https://go.theregister.com/feed/www.theregister.com/2024/05/07/cisas_vulnerability_deadlines/

br00t4c, to random
@br00t4c@mastodon.social avatar

CISA says 'no more' to decades-old directory traversal bugs

https://go.theregister.com/feed/www.theregister.com/2024/05/06/cisa_alert_dt_bugs/

governa, to random
@governa@fosstodon.org avatar

Critical #GitLab Bug Under Exploit Enables Account Takeover, #CISA Warns ⚠️ :gitlab:

https://www.darkreading.com/application-security/critical-gitlab-bug-exploit-account-takeover-cisa

tallship, to browsers

After several years of warning after warning after advisory after advisory and calls to repeatedly update or remove and NOT USE CHROME by the Department of Homeland Security, it should be inconceivable that anyone does - but they do.

Sometimes these are patched with automatic updates before horrific and catastrophic results occur, sometimes not. To be frank, part of the problem stems from the fact that Chrome is the largest attack surface out there where browsers are concerned, but notwithstanding it being the fav target are also serious privacy concerns that aren't shared by other chromium based browsers.

To be fair, many exploits are indeed shared by other chromium based browsers, but not most, while some are related to other browser capabilities, like WebRTC, but it's still best to just ditch Chrome and never look back.

Here's more coverage on vulnerabilities issued less than a month ago. It took 3 seconds to bring this up, and no, not using Google, which didn't reveal this when I tried that search engine in a subsequent search, lolz. Why would they return SERPs that poo poo their own product?

This one did come up in a google search

There's truly only one way to ensure safety - unplug. But there's a lot of simple things you can do to exact a reasonable level of security, so why not observe some of those best practices? It's not like it will cramp your style.

Anyway, that's my two cents. h/t to @darnell for raising awareness of this latest brokewell. Make sure you take the time to visit the link he's provided for you too.

There are plenty of #Browsers that run on #Android (to name a few, alphabetized):

  • Brave Browser
  • Chromium
  • DuckDuckGo
  • Firefox
  • Kiwi
  • Vivaldi

IMO, No one should be running Chrome - Desktop or otherwise. It's a privacy nightmare even when there aren't CERT warnings circulating.

#tallship #brokewell #zero_day #CISA #CERT #DHS

.

RE: https://one.darnell.one/users/darnell/statuses/112371221294882180

@darnell

br00t4c, to Cybersecurity
@br00t4c@mastodon.social avatar
RedPacketSecurity, to OSINT
carol, to rust
@carol@crabby.fyi avatar

I wrote a guest post on the Rust Foundation blog on my experience attending the Open Source Software Security Summit:

https://foundation.rust-lang.org/news/attending-cisas-open-source-software-security-summit/

johnleonard, to Russia
@johnleonard@mastodon.social avatar

CISA issues emergency order on Microsoft breach by Russian hackers

Affected bodies must take immediate action, agency says

https://www.computing.co.uk/news/4196664/cisa-issues-emergency-order-microsoft-breach-russian-hackers

br00t4c, to random
@br00t4c@mastodon.social avatar
  • All
  • Subscribed
  • Moderated
  • Favorites
  • provamag3
  • thenastyranch
  • magazineikmin
  • ethstaker
  • InstantRegret
  • tacticalgear
  • rosin
  • love
  • Youngstown
  • slotface
  • ngwrru68w68
  • kavyap
  • cubers
  • DreamBathrooms
  • megavids
  • mdbf
  • modclub
  • GTA5RPClips
  • normalnudes
  • khanakhh
  • everett
  • cisconetworking
  • osvaldo12
  • anitta
  • Leos
  • Durango
  • tester
  • JUstTest
  • All magazines