Forwarded from Solidot 纯净版
GitHub 面临生存之战
#微软
在被微软收购八年之后，最大的代码托管平台 GitHub 正面临生存之战，它的宕机和安全问题频发，而竞争对手的压力也越来越大。过去几周，GitHub 发生了多起严重的宕机事故，因员工的 VS Code 安装了一个恶意库扩展导致 3800 个内部代码库被窃取。GitHub 现员工和前员工在接受采访时描述了公司在领导层缺乏和竞争对手压力下挣扎的困境。2025 年夏天 CEO Thomas Dohmke 离职之后，微软没有再任命新 CEO，而是让领导团队成员向 CoreAI 汇报工作，CoreAI 由前 Meta 工程主管 Jay Parikh 负责，他由 CEO Satya Nadella 亲自招揽，负责帮助公司向 AI 转型。他在公司内部并不受欢迎，正是他决定不再任命 GitHub 新 CEO。有很多 GitHub 员工跟着离职去了 Dohmke 的新创公司 Entire。GitHub 高管过去几个月也不断流失，高级副总裁 Jared Palmer、前首席营收管 Elizabeth Pemmerl 都已经离职。GitHub 现员工称公司已经名存实亡，如今的一切都归微软。
https://www.theverge.com/tech/935250/microsoft-github-struggles-notepad
#微软
在被微软收购八年之后，最大的代码托管平台 GitHub 正面临生存之战，它的宕机和安全问题频发，而竞争对手的压力也越来越大。过去几周，GitHub 发生了多起严重的宕机事故，因员工的 VS Code 安装了一个恶意库扩展导致 3800 个内部代码库被窃取。GitHub 现员工和前员工在接受采访时描述了公司在领导层缺乏和竞争对手压力下挣扎的困境。2025 年夏天 CEO Thomas Dohmke 离职之后，微软没有再任命新 CEO，而是让领导团队成员向 CoreAI 汇报工作，CoreAI 由前 Meta 工程主管 Jay Parikh 负责，他由 CEO Satya Nadella 亲自招揽，负责帮助公司向 AI 转型。他在公司内部并不受欢迎，正是他决定不再任命 GitHub 新 CEO。有很多 GitHub 员工跟着离职去了 Dohmke 的新创公司 Entire。GitHub 高管过去几个月也不断流失，高级副总裁 Jared Palmer、前首席营收管 Elizabeth Pemmerl 都已经离职。GitHub 现员工称公司已经名存实亡，如今的一切都归微软。
https://www.theverge.com/tech/935250/microsoft-github-struggles-notepad
💊10
Cherr panic
Introducing nginx-poolslip, a fresh RCE for the the latest nginx release 1.31.0. https://x.com/i/status/2057071579876753643
CVE-2026-9256
NGINX ngx_http_rewrite_module buffer overflow
https://seclists.org/oss-sec/2026/q2/671
https://cybersecuritynews.com/nginx-poolslip-vulnerability/
NGINX ngx_http_rewrite_module buffer overflow
https://seclists.org/oss-sec/2026/q2/671
https://cybersecuritynews.com/nginx-poolslip-vulnerability/
seclists.org
oss-sec: NGINX ngx_http_rewrite_module buffer overflow (CVE-2026-9256)
鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
CVE-2026-9256 NGINX ngx_http_rewrite_module buffer overflow https://seclists.org/oss-sec/2026/q2/671 https://cybersecuritynews.com/nginx-poolslip-vulnerability/
X (formerly Twitter)
Nebula Security (@nebusecurity) on X
Kudos to the Nginx team, after a close collaboration with F5, nginx-poolslip has now been fixed. Check if your Nginx is affected and apply mitigation or upgrade to the latest version
https://t.co/9q1OxD2JBd
https://t.co/9q1OxD2JBd
鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
CVE-2026-9256 NGINX ngx_http_rewrite_module buffer overflow https://seclists.org/oss-sec/2026/q2/671 https://cybersecuritynews.com/nginx-poolslip-vulnerability/
This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context.
An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart.
Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
https://my.f5.com/manage/s/article/K000161377
An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart.
Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
https://my.f5.com/manage/s/article/K000161377
F5
NGINX ngx_http_rewrite_module vulnerability CVE-2026-9256
Security Advisory Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression…
Anthropic posted a blog yesterday giving an update on their Project Glasswing
efforts to find, report, and disclose vulnerabilities in a wide range of
software:
https://www.anthropic.com/research/glasswing-initial-update
In it, they link to their new disclosure dashboard at:
https://red.anthropic.com/2026/cvd/
It currently says:
"As of May 22, 2026, we've disclosed 1,596 vulnerabilities across 281 open
source projects. To our knowledge, 97 of these have been patched. Of those,
88 have been assigned a Common Vulnerabilities and Exposure (CVE) record or
a GitHub Security Advisory (GHSA). In other cases, maintainers have shipped
a fix without publishing an advisory. The number of vulnerabilities we've
disclosed is a subset of the total number of vulnerabilities that Mythos
Preview has found, since the process of independent human triage and review
is the rate limiting step."
In their chart below that, they clarify that in this case, "disclosed" means
"reported to maintainers", not made public.
They include a list of identifiers of their reports (currently up to 1611
entries), but do not show the project name or bug type until the project
has fixed the bug.
They also include lists of CVE's and GHSA's that have been published for
the issues they've found. The CVE list currently includes CVE's from nginx,
jq, wolfSSL, and more. The GHSA list includes libyang, mastodon, freerdp,
and more.
--
-Alan Coopersmith- alan.coopersmith@oracle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
[Disclaimer: while my employer is identified in the blog post as a partner,
I am not personally involved with Project Glasswing, and know nothing more
about it than what has been publicly disclosed.]
efforts to find, report, and disclose vulnerabilities in a wide range of
software:
https://www.anthropic.com/research/glasswing-initial-update
In it, they link to their new disclosure dashboard at:
https://red.anthropic.com/2026/cvd/
It currently says:
"As of May 22, 2026, we've disclosed 1,596 vulnerabilities across 281 open
source projects. To our knowledge, 97 of these have been patched. Of those,
88 have been assigned a Common Vulnerabilities and Exposure (CVE) record or
a GitHub Security Advisory (GHSA). In other cases, maintainers have shipped
a fix without publishing an advisory. The number of vulnerabilities we've
disclosed is a subset of the total number of vulnerabilities that Mythos
Preview has found, since the process of independent human triage and review
is the rate limiting step."
In their chart below that, they clarify that in this case, "disclosed" means
"reported to maintainers", not made public.
They include a list of identifiers of their reports (currently up to 1611
entries), but do not show the project name or bug type until the project
has fixed the bug.
They also include lists of CVE's and GHSA's that have been published for
the issues they've found. The CVE list currently includes CVE's from nginx,
jq, wolfSSL, and more. The GHSA list includes libyang, mastodon, freerdp,
and more.
--
-Alan Coopersmith- alan.coopersmith@oracle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
[Disclaimer: while my employer is identified in the blog post as a partner,
I am not personally involved with Project Glasswing, and know nothing more
about it than what has been publicly disclosed.]
Anthropic
Project Glasswing: An initial update
An early update on what we've learned from Project Glasswing.
Forwarded from 仔bot
Media is too big
VIEW IN TELEGRAM
1986: Email - the Perfect Tech for the Jet Set? | Micro Live | BBC Archive
@BBC Archive
Electronic mail - linking a computer to the telephone network using a modem - is one of the fastest growing areas of personal computer use. It seems like a technology that could offer real benefits to people whose job requires them to do a lot of travelling abroad. Lesley Judd takes a flight to Schiphol Airport in the Netherlands, armed with her trusty portable computer and an acoustic coupler, to see just how easy it is to send an email back to Britain.
Clip taken from Micro Live, originally broadcast on BBC Two, 12 December, 1986.
You have now entered the BBC Archive, a time machine that will transport you back to the golden age of TV to educate, entertain and enlighten you with classic clips from the BBC vaults.
Make sure yo…
YouTube
▶️225.6K 👍5.7K
@BBC Archive
Electronic mail - linking a computer to the telephone network using a modem - is one of the fastest growing areas of personal computer use. It seems like a technology that could offer real benefits to people whose job requires them to do a lot of travelling abroad. Lesley Judd takes a flight to Schiphol Airport in the Netherlands, armed with her trusty portable computer and an acoustic coupler, to see just how easy it is to send an email back to Britain.
Clip taken from Micro Live, originally broadcast on BBC Two, 12 December, 1986.
You have now entered the BBC Archive, a time machine that will transport you back to the golden age of TV to educate, entertain and enlighten you with classic clips from the BBC vaults.
Make sure yo…
YouTube
▶️225.6K 👍5.7K
Forwarded from 风向旗参考快讯
虎牙旗下apkpure应用商店正在分发恶意软件
近日有多名开发者发现，虎牙旗下的知名第三方应用商店 APKPure 在分发 Telegram 相关应用时存在严重安全问题，强烈建议用户立即停止使用该平台下载任何 APK。开发者南宫雪珊在其电报频道发文警告 apkpure 不可信，其中 Telegram 商店版 apk 签名不正确；Telegram X 包名不正确；目前仅web版正常，但版本也不是最新的。除此之外，安全研究员、逆向工程师 Eric Parker 在社交媒体平台 X 上也发文警告，APKPure 正在分发恶意版本的 Telegram。公开资料显示，虎牙于2023年以8100万美元的总现金对价，从腾讯手中收购apkpure应用商店的100%股权。
——南宫雪珊、Eric Parker
近日有多名开发者发现，虎牙旗下的知名第三方应用商店 APKPure 在分发 Telegram 相关应用时存在严重安全问题，强烈建议用户立即停止使用该平台下载任何 APK。开发者南宫雪珊在其电报频道发文警告 apkpure 不可信，其中 Telegram 商店版 apk 签名不正确；Telegram X 包名不正确；目前仅web版正常，但版本也不是最新的。除此之外，安全研究员、逆向工程师 Eric Parker 在社交媒体平台 X 上也发文警告，APKPure 正在分发恶意版本的 Telegram。公开资料显示，虎牙于2023年以8100万美元的总现金对价，从腾讯手中收购apkpure应用商店的100%股权。
——南宫雪珊、Eric Parker
😱6
Forwarded from 每日消费电子观察 (无羽の翼 (｢ • ̀ω•́ )｢)
世界新聞網
傳台積電砍分紅 員工揚言下班關手機不待命、仿效三星罷工
台積電將在27日公布首季員工分紅數字，員工原期待分紅創高，但內部傳出台積將調降員工的分紅提撥比率，引發反彈，有匿名的員工在臉書社團號召發起下班關手機、不待命，甚至仿效三星罷工。對於此傳聞，台積電官方尚未回應。
😁20
Forwarded from Solidot
Firefox 加入对 Web Serial API 的支持，与 Adafruit 合作
2026-05-25 14:20 by 泰山归林
刚刚发布的 Firefox 151 加入了对 Web Serial API 的支持。Web Serial API 允许网站使用 JavaScript 向串口设备如 USB 和蓝牙设备写入或读取数据。Mozilla 称大部分人不会使用到该 API，它的主要使用群体是开发者，他们将能利用浏览器与兼容硬件设备直接进行通信。Mozilla 同时宣布与知名开源硬件平台 Adafruit 展开合作。Adafruit 基于浏览器的硬件工作流程能在 Firefox 上直接运行。以 Adafruit ESP32-S 开发板为例，通过 Web Serial 可以将网页代码发送的消息直接显示在设备上，或者直接在手持设备上修改网页的 CSS 属性。
https://blog.mozilla.org/en/firefox/firefox-web-serial-adafruit/
#Firefox
2026-05-25 14:20 by 泰山归林
刚刚发布的 Firefox 151 加入了对 Web Serial API 的支持。Web Serial API 允许网站使用 JavaScript 向串口设备如 USB 和蓝牙设备写入或读取数据。Mozilla 称大部分人不会使用到该 API，它的主要使用群体是开发者，他们将能利用浏览器与兼容硬件设备直接进行通信。Mozilla 同时宣布与知名开源硬件平台 Adafruit 展开合作。Adafruit 基于浏览器的硬件工作流程能在 Firefox 上直接运行。以 Adafruit ESP32-S 开发板为例，通过 Web Serial 可以将网页代码发送的消息直接显示在设备上，或者直接在手持设备上修改网页的 CSS 属性。
https://blog.mozilla.org/en/firefox/firefox-web-serial-adafruit/
#Firefox
❤13👍2
California's Age Verification Law May End Up Exempting Most Linux Distributions
https://www.phoronix.com/news/California-AB-1856
https://www.phoronix.com/news/California-AB-1856
Phoronix
California's Age Verification Law May End Up Exempting Most Linux Distributions
While not as good as repealing AB 1043 outright for requiring operating system providers to ask for a user's age or birth date at device setup, open-source Linux distributions and other open-source OSes may end up seeing some reprieve before this law goes…
👏3
鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
California's Age Verification Law May End Up Exempting Most Linux Distributions https://www.phoronix.com/news/California-AB-1856
“Operating system provider” does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.
“Application” does not include software components that are not themselves offered to consumers as a stand-alone executable application through a covered application store.
“Application” does not include software components that are not themselves offered to consumers as a stand-alone executable application through a covered application store.
鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
“Operating system provider” does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software. “Application” does not include software components…
Snap store / Flathub 呢
Synapse 呢
Synapse 呢
鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
Snap store / Flathub 呢 Synapse 呢
it would still impact platforms like Valve's SteamOS. With Steam shipping the proprietary Steam client it would still be treated as a covered application store and likely still affected by California's original law along with any other similar Linux distribution with proprietary apps.
😱3✍1
Lessons from the linux-distros mailing list
By Jake Edge, October 27, 2021
https://lwn.net/Articles/874069/
By Jake Edge, October 27, 2021
https://lwn.net/Articles/874069/
LWN.net
Lessons from the linux-distros mailing list
The oss-security mailing list is specifically set up for reports and discussion of security fla [...]