Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.

https://fixupx.com/i/status/2056949168208552080

Introducing nginx-poolslip, a fresh RCE for the the latest nginx release 1.31.0.

https://x.com/i/status/2057071579876753643

Fedora 移除深度桌面环境包

2026-05-20 18:43 by 基因先知者

在 openSUSE 之后，Fedora 发行版移除了深度桌面环境包（Deepin Desktop）。2025 年初 SUSE 安全团队在一次例行审查中发现深度桌面环境有名叫 deepin-feature-enable 的软件包，该软件包是在 2021 年 4 月加入的，并没有咨询或通知 SUSE，它包含了一个“许可协议对话框（license agreement dialog）”，基本上说讲因为 openSUSE 的安全规定，它禁用了 deepin-api 和 deepin-daemon 需要的所有 dbus 和 polkit 功能，这可能导致 Deepin Desktop 不能正常工作，部分功能无效。如果用户不在意这些安全问题，可选择点击确认，之后会自动安装缺少的 dbus 和 polkit。安全团队的调查发现，deepin-daemon 中的核心组件从未递交进行安全审查，它们被悄悄的引入到了 openSUSE 中。鉴于 Deepin 社区过去几年多次违规，openSUSE 决定移除 Deepin Desktop。Fedora 项目随后也对深度桌面环境包展开安全审查，期间开发者发现难以联系部分深度软件包的维护者，因为安全担忧和软件包缺乏维护，它最终决定移除深度桌面环境。

https://pagure.io/fesco/issue/3409
https://www.phoronix.com/news/Fedora-Removing-Deepin

#Redhat

PinTheft is CVE-2026-43494

GET http://foo/ HTTP/1.1 <- Used for virtual host routing
User-Agent: UA
Host: bar <- Used for $http_host

Debian's proxy_param file used to use $http_host:

proxy_set_header Host $http_host;

https://bugs.debian.org/1126960
https://seclists.org/oss-sec/2026/q2/645

Single-Click Code Execution Exploit for Evince, Atril, and Xreader

CVE-2026-46529 is an argument injection vulnerability in Evince, Atril, and Xreader caused by missing shell quoting when composing a command line.

The vulnerability is fixed in:

Evince 48.4 (fix commit) (I originally reported that it is fixed in 48.2, but there was no successful release for that tag)
Atril 1.28.4 and 1.26.3 (fix commit)
Xreader 4.6.4 and 3.6.7 (fix commit)

https://blogs.gnome.org/mcatanzaro/2026/05/21/single-click-code-execution-exploit-for-evince-atril-and-xreader/
https://medeiros.zip/posts/CVE-2026-46529-evince

Cloudflare 针对 Mythos 模型发布了评测报告，提出了他们自己的一些使用大模型进行安全审查的 Harness 思考，可以空闲的时候当阅读材料看一看：
https://blog.cloudflare.com/cyber-frontier-models/

这篇文章好像有点 PR 的感觉了
xbow 的这篇更中性一点: https://xbow.com/blog/mythos-offensive-security-xbow-evaluation

It passes
Hand touch

https://fxtwitter.com/i/status/2057487876183760945

To: oss-security@lists.openwall.com                                                                                                                            
Subject: [oss-security] CVE-2026-45250: FreeBSD setcred(2) stack overflow -> local privilege escalation (FatGid)                                               
User-Agent: Mozilla Thunderbird                                                                                                                                
                                                                                                                                                               
A kernel stack buffer overflow exists in the setcred(2) system call                                                                                            
introduced in FreeBSD 14.x.  The overflow occurs before any privilege                                                                                          
check, allowing any unprivileged local user to trigger anything from a                                                                                         
kernel panic to full local privilege escalation.                                                                                                               
                                                                                                                                                               
Working LPE exploits have been developed and verified end-to-end                                                                                               
against amd64 GENERIC, both with and without SMAP/SMEP enabled.  The                                                                                           
SMAP/SMEP-safe variant requires no kernel info-leak; it only requires                                                                                          
that zfs.ko be loaded -- the typical case on any FreeBSD installation                                                                                          
with a ZFS pool.  

https://www.freebsd.org/security/advisories/FreeBSD-SA-26:18.setcred.asc
https://www.openwall.com/lists/oss-security/2026/05/21/3

在 FreeBSD 14.4-RELEASE 可造成提权，FreeBSD 15.0 可造成 panic 但无法提权。FreeBSD main 已由 commit 4cd93df95e (2025-11-14) 修复，FreeBSD 13.x 及更早的版本不存在 setcred(2)，不受影响。

GitHub 面临生存之战
#微软

在被微软收购八年之后，最大的代码托管平台 GitHub 正面临生存之战，它的宕机和安全问题频发，而竞争对手的压力也越来越大。过去几周，GitHub 发生了多起严重的宕机事故，因员工的 VS Code 安装了一个恶意库扩展导致 3800 个内部代码库被窃取。GitHub 现员工和前员工在接受采访时描述了公司在领导层缺乏和竞争对手压力下挣扎的困境。2025 年夏天 CEO Thomas Dohmke 离职之后，微软没有再任命新 CEO，而是让领导团队成员向 CoreAI 汇报工作，CoreAI 由前 Meta 工程主管 Jay Parikh 负责，他由 CEO Satya Nadella 亲自招揽，负责帮助公司向 AI 转型。他在公司内部并不受欢迎，正是他决定不再任命 GitHub 新 CEO。有很多 GitHub 员工跟着离职去了 Dohmke 的新创公司 Entire。GitHub 高管过去几个月也不断流失，高级副总裁 Jared Palmer、前首席营收管 Elizabeth Pemmerl 都已经离职。GitHub 现员工称公司已经名存实亡，如今的一切都归微软。
https://www.theverge.com/tech/935250/microsoft-github-struggles-notepad

我说还是太仁慈了

摩根大通：将富途控股(FUTU.O)目标价从300美元降至87美元。

CVE-2026-9256
NGINX ngx_http_rewrite_module buffer overflow
https://seclists.org/oss-sec/2026/q2/671
https://cybersecuritynews.com/nginx-poolslip-vulnerability/