To: oss-security@lists.openwall.com                                                                                                                            
Subject: [oss-security] CVE-2026-45250: FreeBSD setcred(2) stack overflow -> local privilege escalation (FatGid)                                               
User-Agent: Mozilla Thunderbird                                                                                                                                
                                                                                                                                                               
A kernel stack buffer overflow exists in the setcred(2) system call                                                                                            
introduced in FreeBSD 14.x.  The overflow occurs before any privilege                                                                                          
check, allowing any unprivileged local user to trigger anything from a                                                                                         
kernel panic to full local privilege escalation.                                                                                                               
                                                                                                                                                               
Working LPE exploits have been developed and verified end-to-end                                                                                               
against amd64 GENERIC, both with and without SMAP/SMEP enabled.  The                                                                                           
SMAP/SMEP-safe variant requires no kernel info-leak; it only requires                                                                                          
that zfs.ko be loaded -- the typical case on any FreeBSD installation                                                                                          
with a ZFS pool.  

https://www.freebsd.org/security/advisories/FreeBSD-SA-26:18.setcred.asc
https://www.openwall.com/lists/oss-security/2026/05/21/3

在 FreeBSD 14.4-RELEASE 可造成提权，FreeBSD 15.0 可造成 panic 但无法提权。FreeBSD main 已由 commit 4cd93df95e (2025-11-14) 修复，FreeBSD 13.x 及更早的版本不存在 setcred(2)，不受影响。

GitHub 面临生存之战
#微软

在被微软收购八年之后，最大的代码托管平台 GitHub 正面临生存之战，它的宕机和安全问题频发，而竞争对手的压力也越来越大。过去几周，GitHub 发生了多起严重的宕机事故，因员工的 VS Code 安装了一个恶意库扩展导致 3800 个内部代码库被窃取。GitHub 现员工和前员工在接受采访时描述了公司在领导层缺乏和竞争对手压力下挣扎的困境。2025 年夏天 CEO Thomas Dohmke 离职之后，微软没有再任命新 CEO，而是让领导团队成员向 CoreAI 汇报工作，CoreAI 由前 Meta 工程主管 Jay Parikh 负责，他由 CEO Satya Nadella 亲自招揽，负责帮助公司向 AI 转型。他在公司内部并不受欢迎，正是他决定不再任命 GitHub 新 CEO。有很多 GitHub 员工跟着离职去了 Dohmke 的新创公司 Entire。GitHub 高管过去几个月也不断流失，高级副总裁 Jared Palmer、前首席营收管 Elizabeth Pemmerl 都已经离职。GitHub 现员工称公司已经名存实亡，如今的一切都归微软。
https://www.theverge.com/tech/935250/microsoft-github-struggles-notepad

我说还是太仁慈了

摩根大通：将富途控股(FUTU.O)目标价从300美元降至87美元。

CVE-2026-9256
NGINX ngx_http_rewrite_module buffer overflow
https://seclists.org/oss-sec/2026/q2/671
https://cybersecuritynews.com/nginx-poolslip-vulnerability/

This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context.

An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart.

Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

https://my.f5.com/manage/s/article/K000161377

大概是这个？
https://github.com/nginx/nginx/pull/1395

Anthropic posted a blog yesterday giving an update on their Project Glasswing
efforts to find, report, and disclose vulnerabilities in a wide range of
software:
https://www.anthropic.com/research/glasswing-initial-update

In it, they link to their new disclosure dashboard at:
https://red.anthropic.com/2026/cvd/

It currently says:
"As of May 22, 2026, we've disclosed 1,596 vulnerabilities across 281 open
source projects. To our knowledge, 97 of these have been patched. Of those,
88 have been assigned a Common Vulnerabilities and Exposure (CVE) record or
a GitHub Security Advisory (GHSA). In other cases, maintainers have shipped
a fix without publishing an advisory. The number of vulnerabilities we've
disclosed is a subset of the total number of vulnerabilities that Mythos
Preview has found, since the process of independent human triage and review
is the rate limiting step."

In their chart below that, they clarify that in this case, "disclosed" means
"reported to maintainers", not made public.

They include a list of identifiers of their reports (currently up to 1611
entries), but do not show the project name or bug type until the project
has fixed the bug.

They also include lists of CVE's and GHSA's that have been published for
the issues they've found. The CVE list currently includes CVE's from nginx,
jq, wolfSSL, and more. The GHSA list includes libyang, mastodon, freerdp,
and more.


--
-Alan Coopersmith- alan.coopersmith@oracle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris

[Disclaimer: while my employer is identified in the blog post as a partner,
I am not personally involved with Project Glasswing, and know nothing more
about it than what has been publicly disclosed.]

1986: Email - the Perfect Tech for the Jet Set? | Micro Live | BBC Archive
@BBC Archive
Electronic mail - linking a computer to the telephone network using a modem - is one of the fastest growing areas of personal computer use. It seems like a technology that could offer real benefits to people whose job requires them to do a lot of travelling abroad. Lesley Judd takes a flight to Schiphol Airport in the Netherlands, armed with her trusty portable computer and an acoustic coupler, to see just how easy it is to send an email back to Britain.


Clip taken from Micro Live, originally broadcast on BBC Two, 12 December, 1986.





You have now entered the BBC Archive, a time machine that will transport you back to the golden age of TV to educate, entertain and enlighten you with classic clips from the BBC vaults.

Make sure yo…

YouTube

▶️225.6K 👍5.7K

虎牙旗下apkpure应用商店正在分发恶意软件

近日有多名开发者发现，虎牙旗下的知名第三方应用商店 APKPure 在分发 Telegram 相关应用时存在严重安全问题，强烈建议用户立即停止使用该平台下载任何 APK。开发者南宫雪珊在其电报频道发文警告 apkpure 不可信，其中 Telegram 商店版 apk 签名不正确；Telegram X 包名不正确；目前仅web版正常，但版本也不是最新的。除此之外，安全研究员、逆向工程师 Eric Parker 在社交媒体平台 X 上也发文警告，APKPure 正在分发恶意版本的 Telegram。公开资料显示，虎牙于2023年以8100万美元的总现金对价，从腾讯手中收购apkpure应用商店的100%股权。

——南宫雪珊、Eric Parker

传台积电减少分红，员工扬言下班关手机不待命、仿效三星罢工
https://www.worldjournal.com/wj/story/121475/9523393

看热闹不嫌事大

Firefox 加入对 Web Serial API 的支持，与 Adafruit 合作

2026-05-25 14:20 by 泰山归林

刚刚发布的 Firefox 151 加入了对 Web Serial API 的支持。Web Serial API 允许网站使用 JavaScript 向串口设备如 USB 和蓝牙设备写入或读取数据。Mozilla 称大部分人不会使用到该 API，它的主要使用群体是开发者，他们将能利用浏览器与兼容硬件设备直接进行通信。Mozilla 同时宣布与知名开源硬件平台 Adafruit 展开合作。Adafruit 基于浏览器的硬件工作流程能在 Firefox 上直接运行。以 Adafruit ESP32-S 开发板为例，通过 Web Serial 可以将网页代码发送的消息直接显示在设备上，或者直接在手持设备上修改网页的 CSS 属性。

https://blog.mozilla.org/en/firefox/firefox-web-serial-adafruit/

#Firefox

“Operating system provider” does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.
“Application” does not include software components that are not themselves offered to consumers as a stand-alone executable application through a covered application store.

Snap store / Flathub 呢
Synapse 呢

Lessons from the linux-distros mailing list
By Jake Edge, October 27, 2021
https://lwn.net/Articles/874069/