Collaborate Disseminate
If you roll way back through the history of open source webmail projects, you’ll find Horde, a groupware web application. First released in 1998 on Freshmeat, it gained some notoriety …read more Continue reading This Week in Security: For The Horde, Feature Not a Bug, and Confluence
Depending on who you ask, there’s either 2 vulnerabilities at play in Follina, only one, or according to Microsoft a week ago, no security problem whatsoever. On the 27th of …read more Continue reading This Week In Security: Follina, Open Redirect RCE, and Annoyware
There’s a danger in security research that we’ve discussed a few times before. If you discover a security vulnerability on a production system, and there’s no bug bounty, you’ve likely …read more Continue reading This Week in Security: Good Faith, Easy Forgery, and I18N
As conspiracy theories go, one of the more plausible is that a cell phone could be running malicious firmware on its baseband processor, and be listening and transmitting data even …read more Continue reading This Week in Security: iPhone Unpowered, Python Unsandboxed, and Wizard Spider Unmasked
There is gathering momentum around the idea of adding Rust to the Linux kernel. Why exactly is that a big deal, and what does this mean for the rest of …read more Continue reading Things Are Getting Rusty in Kernel Land
[Alyssa Rosenzweig] has been tirelessly working on reverse engineering the GPU built into Apple’s M1 architecture as part of the Asahi Linux effort. If you’re not familiar, that’s the project …read more Continue reading Asahi GPU Hacking
F5’s BIG-IP platform has a Remote Code Execution (RCE) vulnerability: CVE-2022-1388. This one is interesting, because a Proof of Concept (PoC) was quickly reverse engineered from the patch and released …read more Continue reading This Week in Security: F5 Twitter PoC, Certifried, and Cloudflare Pages Pwned
DNS spoofing/poisoning is the attack discovered by [Dan Kaminski] back in 2008 that simply refuses to go away. This week a vulnerability was announced in the uClibc and uClibc-ng standard …read more Continue reading This Week in Security: uClibc and DNS Poisoning, Encryption is Hard, and the Goat
To start our week of vulnerabilities in everything, there’s a potentially big vulnerability in Android handsets, but it’s Apple’s fault. OK, maybe that’s a little harsh — Apple released the …read more Continue reading This Week in Security: Android and Linux, VirusTotal, More Psychic Signatures
[Jeff Geerling] saw the Raspberry Pi Compute Module 4 and its exposed PCI-Express 1x connection, and just naturally wondered whether he could plug a GPU into that slot and get …read more Continue reading A Real GPU on the Raspberry Pi — Barely.