鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
CVE-2026-9256 NGINX ngx_http_rewrite_module buffer overflow https://seclists.org/oss-sec/2026/q2/671 https://cybersecuritynews.com/nginx-poolslip-vulnerability/
This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context.
An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart.
Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
https://my.f5.com/manage/s/article/K000161377
An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart.
Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
https://my.f5.com/manage/s/article/K000161377
F5
NGINX ngx_http_rewrite_module vulnerability CVE-2026-9256
Security Advisory Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression…
Anthropic posted a blog yesterday giving an update on their Project Glasswing
efforts to find, report, and disclose vulnerabilities in a wide range of
software:
https://www.anthropic.com/research/glasswing-initial-update
In it, they link to their new disclosure dashboard at:
https://red.anthropic.com/2026/cvd/
It currently says:
"As of May 22, 2026, we've disclosed 1,596 vulnerabilities across 281 open
source projects. To our knowledge, 97 of these have been patched. Of those,
88 have been assigned a Common Vulnerabilities and Exposure (CVE) record or
a GitHub Security Advisory (GHSA). In other cases, maintainers have shipped
a fix without publishing an advisory. The number of vulnerabilities we've
disclosed is a subset of the total number of vulnerabilities that Mythos
Preview has found, since the process of independent human triage and review
is the rate limiting step."
In their chart below that, they clarify that in this case, "disclosed" means
"reported to maintainers", not made public.
They include a list of identifiers of their reports (currently up to 1611
entries), but do not show the project name or bug type until the project
has fixed the bug.
They also include lists of CVE's and GHSA's that have been published for
the issues they've found. The CVE list currently includes CVE's from nginx,
jq, wolfSSL, and more. The GHSA list includes libyang, mastodon, freerdp,
and more.
--
-Alan Coopersmith- alan.coopersmith@oracle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
[Disclaimer: while my employer is identified in the blog post as a partner,
I am not personally involved with Project Glasswing, and know nothing more
about it than what has been publicly disclosed.]
efforts to find, report, and disclose vulnerabilities in a wide range of
software:
https://www.anthropic.com/research/glasswing-initial-update
In it, they link to their new disclosure dashboard at:
https://red.anthropic.com/2026/cvd/
It currently says:
"As of May 22, 2026, we've disclosed 1,596 vulnerabilities across 281 open
source projects. To our knowledge, 97 of these have been patched. Of those,
88 have been assigned a Common Vulnerabilities and Exposure (CVE) record or
a GitHub Security Advisory (GHSA). In other cases, maintainers have shipped
a fix without publishing an advisory. The number of vulnerabilities we've
disclosed is a subset of the total number of vulnerabilities that Mythos
Preview has found, since the process of independent human triage and review
is the rate limiting step."
In their chart below that, they clarify that in this case, "disclosed" means
"reported to maintainers", not made public.
They include a list of identifiers of their reports (currently up to 1611
entries), but do not show the project name or bug type until the project
has fixed the bug.
They also include lists of CVE's and GHSA's that have been published for
the issues they've found. The CVE list currently includes CVE's from nginx,
jq, wolfSSL, and more. The GHSA list includes libyang, mastodon, freerdp,
and more.
--
-Alan Coopersmith- alan.coopersmith@oracle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
[Disclaimer: while my employer is identified in the blog post as a partner,
I am not personally involved with Project Glasswing, and know nothing more
about it than what has been publicly disclosed.]
Anthropic
Project Glasswing: An initial update
An early update on what we've learned from Project Glasswing.
Forwarded from 仔bot
Media is too big
VIEW IN TELEGRAM
1986: Email - the Perfect Tech for the Jet Set? | Micro Live | BBC Archive
@BBC Archive
Electronic mail - linking a computer to the telephone network using a modem - is one of the fastest growing areas of personal computer use. It seems like a technology that could offer real benefits to people whose job requires them to do a lot of travelling abroad. Lesley Judd takes a flight to Schiphol Airport in the Netherlands, armed with her trusty portable computer and an acoustic coupler, to see just how easy it is to send an email back to Britain.
Clip taken from Micro Live, originally broadcast on BBC Two, 12 December, 1986.
You have now entered the BBC Archive, a time machine that will transport you back to the golden age of TV to educate, entertain and enlighten you with classic clips from the BBC vaults.
Make sure yo…
YouTube
▶️225.6K 👍5.7K
@BBC Archive
Electronic mail - linking a computer to the telephone network using a modem - is one of the fastest growing areas of personal computer use. It seems like a technology that could offer real benefits to people whose job requires them to do a lot of travelling abroad. Lesley Judd takes a flight to Schiphol Airport in the Netherlands, armed with her trusty portable computer and an acoustic coupler, to see just how easy it is to send an email back to Britain.
Clip taken from Micro Live, originally broadcast on BBC Two, 12 December, 1986.
You have now entered the BBC Archive, a time machine that will transport you back to the golden age of TV to educate, entertain and enlighten you with classic clips from the BBC vaults.
Make sure yo…
YouTube
▶️225.6K 👍5.7K
Forwarded from 风向旗参考快讯
虎牙旗下apkpure应用商店正在分发恶意软件
近日有多名开发者发现，虎牙旗下的知名第三方应用商店 APKPure 在分发 Telegram 相关应用时存在严重安全问题，强烈建议用户立即停止使用该平台下载任何 APK。开发者南宫雪珊在其电报频道发文警告 apkpure 不可信，其中 Telegram 商店版 apk 签名不正确；Telegram X 包名不正确；目前仅web版正常，但版本也不是最新的。除此之外，安全研究员、逆向工程师 Eric Parker 在社交媒体平台 X 上也发文警告，APKPure 正在分发恶意版本的 Telegram。公开资料显示，虎牙于2023年以8100万美元的总现金对价，从腾讯手中收购apkpure应用商店的100%股权。
——南宫雪珊、Eric Parker
近日有多名开发者发现，虎牙旗下的知名第三方应用商店 APKPure 在分发 Telegram 相关应用时存在严重安全问题，强烈建议用户立即停止使用该平台下载任何 APK。开发者南宫雪珊在其电报频道发文警告 apkpure 不可信，其中 Telegram 商店版 apk 签名不正确；Telegram X 包名不正确；目前仅web版正常，但版本也不是最新的。除此之外，安全研究员、逆向工程师 Eric Parker 在社交媒体平台 X 上也发文警告，APKPure 正在分发恶意版本的 Telegram。公开资料显示，虎牙于2023年以8100万美元的总现金对价，从腾讯手中收购apkpure应用商店的100%股权。
——南宫雪珊、Eric Parker
😱6
Forwarded from 每日消费电子观察 (无羽の翼 (｢ • ̀ω•́ )｢)
世界新聞網
傳台積電砍分紅 員工揚言下班關手機不待命、仿效三星罷工
台積電將在27日公布首季員工分紅數字，員工原期待分紅創高，但內部傳出台積將調降員工的分紅提撥比率，引發反彈，有匿名的員工在臉書社團號召發起下班關手機、不待命，甚至仿效三星罷工。對於此傳聞，台積電官方尚未回應。
😁20
Forwarded from Solidot
Firefox 加入对 Web Serial API 的支持，与 Adafruit 合作
2026-05-25 14:20 by 泰山归林
刚刚发布的 Firefox 151 加入了对 Web Serial API 的支持。Web Serial API 允许网站使用 JavaScript 向串口设备如 USB 和蓝牙设备写入或读取数据。Mozilla 称大部分人不会使用到该 API，它的主要使用群体是开发者，他们将能利用浏览器与兼容硬件设备直接进行通信。Mozilla 同时宣布与知名开源硬件平台 Adafruit 展开合作。Adafruit 基于浏览器的硬件工作流程能在 Firefox 上直接运行。以 Adafruit ESP32-S 开发板为例，通过 Web Serial 可以将网页代码发送的消息直接显示在设备上，或者直接在手持设备上修改网页的 CSS 属性。
https://blog.mozilla.org/en/firefox/firefox-web-serial-adafruit/
#Firefox
2026-05-25 14:20 by 泰山归林
刚刚发布的 Firefox 151 加入了对 Web Serial API 的支持。Web Serial API 允许网站使用 JavaScript 向串口设备如 USB 和蓝牙设备写入或读取数据。Mozilla 称大部分人不会使用到该 API，它的主要使用群体是开发者，他们将能利用浏览器与兼容硬件设备直接进行通信。Mozilla 同时宣布与知名开源硬件平台 Adafruit 展开合作。Adafruit 基于浏览器的硬件工作流程能在 Firefox 上直接运行。以 Adafruit ESP32-S 开发板为例，通过 Web Serial 可以将网页代码发送的消息直接显示在设备上，或者直接在手持设备上修改网页的 CSS 属性。
https://blog.mozilla.org/en/firefox/firefox-web-serial-adafruit/
#Firefox
❤13👍2
California's Age Verification Law May End Up Exempting Most Linux Distributions
https://www.phoronix.com/news/California-AB-1856
https://www.phoronix.com/news/California-AB-1856
Phoronix
California's Age Verification Law May End Up Exempting Most Linux Distributions
While not as good as repealing AB 1043 outright for requiring operating system providers to ask for a user's age or birth date at device setup, open-source Linux distributions and other open-source OSes may end up seeing some reprieve before this law goes…
👏3
鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
California's Age Verification Law May End Up Exempting Most Linux Distributions https://www.phoronix.com/news/California-AB-1856
“Operating system provider” does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.
“Application” does not include software components that are not themselves offered to consumers as a stand-alone executable application through a covered application store.
“Application” does not include software components that are not themselves offered to consumers as a stand-alone executable application through a covered application store.
鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
“Operating system provider” does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software. “Application” does not include software components…
Snap store / Flathub 呢
Synapse 呢
Synapse 呢
鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
Snap store / Flathub 呢 Synapse 呢
it would still impact platforms like Valve's SteamOS. With Steam shipping the proprietary Steam client it would still be treated as a covered application store and likely still affected by California's original law along with any other similar Linux distribution with proprietary apps.
😱3✍1
Lessons from the linux-distros mailing list
By Jake Edge, October 27, 2021
https://lwn.net/Articles/874069/
By Jake Edge, October 27, 2021
https://lwn.net/Articles/874069/
LWN.net
Lessons from the linux-distros mailing list
The oss-security mailing list is specifically set up for reports and discussion of security fla [...]
Forwarded from nowano
据国外安全团队Cybernews披露，知名街机制造商华立科技1890万条用户记录数据在互联网暴露，部分涉及用户名、手机号、用户使用街机设备的位置、用户玩游戏的数据等信息；
https://cybernews.com/security/wahlap-arcade-game-maker-data-leak-wechat/
https://cybernews.com/security/wahlap-arcade-game-maker-data-leak-wechat/
Cybernews
Major arcade game company leaked millions of user records
Wahlap, a major Chinese arcade maker, leaked 18.9 million user records via WeChat mini app including names, IDs, locations, and gaming data from underage users.
Forwarded from #ak1ra-lab (#ak1ra-RSStT-bot)
Telegraph
The pressure
I’m doing Open Source primarily because I love it. The social aspects, the for-the-good angle and for the challenge of engineering this to work for everyone. I also do it because it is my full-time job and getting food on the table and provide for my family…
Software Freedom Conservancy: Comprehensive Response to Bambu's AGPLv3 Violations
https://sfconservancy.org/news/2026/may/18/bambu-studio-3d-printer-agpl-violation-response/
https://sfconservancy.org/news/2026/may/18/bambu-studio-3d-printer-agpl-violation-response/
Software Freedom Conservancy
Comprehensive Response to Bambu's AGPLv3 Violations
Software Freedom Conservancy (“SFC”) announces a new
initiative regarding the software right to repair for users and consumers
of 3D printers manufactured by Bambu Lab. After recent news of violations of the Affero General Public License,
version…
initiative regarding the software right to repair for users and consumers
of 3D printers manufactured by Bambu Lab. After recent news of violations of the Affero General Public License,
version…