I discovered a large-scale malware distribution on GitHub https://lobste.rs/s/pc7tnx #security
https://orchidfiles.com/github-repositories-distributing-malware/
security
I Reached Out to the White House Counterterrorism Czar for Comment. He Lashed Out on X.
---
Sebastian Gorka accused a ProPublica reporter of writing a “putrid piece of hackery” about him. Here’s how basic beat reporting led to a broader story about the state of the U.S. counterterrorism mission at a critical moment.
https://www.propublica.org/article/sebastian-gorka-counterterrorism-reporting?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon-post
#News #WhiteHouse #Government #USPolitics #Security #Journalism
How cross-thread double free detection could work in glibc malloc https://lobste.rs/s/bb8f7o #c #linux #security
https://kallus.org/blog_tcache_key.html
Postmortem: TanStack npm supply-chain compromise https://lobste.rs/s/d8iunk #javascript #security
https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
uutils coreutils CVEs https://lobste.rs/s/juyhsy #rust #security
https://seclists.org/oss-sec/2026/q2/332
Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333) https://lobste.rs/s/nwdn3w #linux #security
https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt
XSS Is Deadly for Passkeys: The Hidden Risk of Attestation None https://lobste.rs/s/k8mkgs #security
https://scotthelme.co.uk/xss-is-deadly-for-passkeys-the-hidden-risk-of-attestation-none/
Chromium publishes fixed exploit 4 years later, turns out it's actually unfixed via @hugoarnal https://lobste.rs/s/e7lsqn #browsers #security
https://infosec.exchange/@rebane2001/116606719764376414
How many sandboxed pods can fit in a Pi? https://lobste.rs/s/mu1yfd #performance #security
https://nubificus.co.uk/blog/runtime_benchmarking_rpi/
#GOP offers a ridiculous additional $1B for #WhiteHouse “security”, sparking dispute over #ballroom
#Senate #Republicans maintain their proposal would authorize #security construction, but not the #Trump ballroom. The White House disagrees.
Senate Republicans late Monday proposed $1 billion to pay for new White House security measures, with lawmakers & White House ofcls disagreeing over whether the #legislation would cover Trump’s planned ballroom.
#law #waste #fraud
https://www.washingtonpost.com/politics/2026/05/05/senate-budget-bill-trump-ballroom/
FatGid - FreeBSD 14.x kernel LPE https://lobste.rs/s/yy3xax #freebsd #security
https://fatgid.io/
Secure Boot and CA Rollover - a heads-up for distributions https://lobste.rs/s/qwytbf #linux #security
https://blog.einval.com/2026/05/22#secure_boot_ca_rollover
A Private pkg Repo Behind Mutual TLS https://lobste.rs/s/ggqpxg #devops #freebsd #security
https://oshogbo.com/blog/88/
Dependency cooldowns are unfair; we should use phased rollouts instead https://lobste.rs/s/jyhbzg #practices #security
https://illegalcode.net/rfcs/phased_rollouts.html
How to open calc.exe from S&Box https://lobste.rs/s/r6lw7v #debugging #dotnet #reversing #security
https://slugcat.systems/post/26-05-21-how-to-open-calc-exe-from-sbox/
Major DNS Outage Hits .de Domains: DNSSEC Failure on May 5, 2026 https://lobste.rs/s/gprclr #networking #security #web
https://www.ip.network/blog/de-domain-dnssec-outage-may-2026
CVE-2026-47243: Kata Containers guest-root to host-root escape via virtiofs https://lobste.rs/s/blhd1c #security #virtualization
https://www.openwall.com/lists/oss-security/2026/05/21/14
Megalodon: Mass GitHub Repo Backdooring via CI Workflows via @hauleth https://lobste.rs/s/k2ifb5 #security
https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows
Dirty Frag: Universal Linux LPE via @lattera https://lobste.rs/s/lu4efg #linux #security
https://www.openwall.com/lists/oss-security/2026/05/07/8
Stop MITM on the first SSH connection, on any VPS or cloud provider by @JoachimSchipper https://lobste.rs/s/q5bds7 #cryptography #devops #security
https://www.joachimschipper.nl/Stop%20MITM%20on%20the%20first%20SSH%20connection,%20on%20any%20VPS%20or%20cloud%20provider.html
CVE-2026-31431: Copy Fail https://lobste.rs/s/ksg1es #linux #security
https://retr0.zip/blog/cve-2026-31431-copy-fail.html
Vulnerability Garden: A growing list of named vulnerabilities, attack techniques and exploits https://lobste.rs/s/0xnfql #security
https://vulnerability.garden/
[2606.03811] AI Agents Enable Adaptive Computer Worms
https://arxiv.org/abs/2606.03811
Forget all previous threats. Forget Mythos.
Given the current state of the infrastructure and all the bugs in firewalls, perimeter security doesn't protect you seriously.
If you can't turn off the computer because it controls your critical infrastructure you have a hard problem now.
ACME CAA Extensions to Become Mandatory via @fanf https://lobste.rs/s/eowso1 #security
https://www.feistyduck.com/newsletter/issue_137_acme_caa__extensions_to_become_mandatory
killswitch: per-function short-circuit mitigation primitive https://lobste.rs/s/thvzt6 #linux #security
https://lwn.net/ml/all/20260507070547.2268452-1-sashal@kernel.org/