The VPN Server Your Firebox Trusts Could Hand It Root Commands
WatchGuard fixed 15 Fireware vulnerabilities, including a root-command path through a hostile BOVPN over TLS server and adjacent-network code execution.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
Two WatchGuard Wireless Flaws Need No Login
Check installed firmware and management reachability. Patch availability does not prove protection.
Your .NET Upgrade Can Pass CI and Still Miss November’s Support Deadline
.NET 8 LTS and .NET 9 STS leave Microsoft support on 10 November. A new SDK and a green build do not prove the production application has moved.
A Stalled DTLS Handshake Could Make OpenSSL Send Heap Memory in Plaintext
OpenSSL fixed a high-severity DTLS flaw that can expose heap memory in plaintext. The condition is narrow, but every branch analysed in the advisory is affected.
Google Cloud Fixed Three Workflow Flaws That Could Reach Its Own Systems
Google disclosed three Application Integration flaws on 28 September. Its managed service was patched in June, and customers have no update to install. The questions now concern trust boundaries and what customer-side logs can show.
NeedyMantis Is Hiding Behind Poedit, curl, Vim and TightVNC
Microsoft found NeedyMantis hiding beside legitimate software in targeted intrusions. The real hunt starts before the backdoor appears.
Researchers Read a Linux Root Hash With Spectre Defences Still On
Branch Target Reuse recovered a Linux root hash on Intel test systems, exposing a local JIT weakness that Linux updates now target.
Securing the Alert Box Is No Longer Enough Under the FCC’s New Cyber Rules
The FCC's EAS cybersecurity rule reaches beyond alert encoders to studio transmitter links and remotely managed equipment in the programming path. Three targeted controls apply from 29 September.
A Real ChatGPT Page Led Users Into a Fake Verification Trap
An attacker-built Custom GPT used a real ChatGPT page to lead people to a fake check on Google Sites. The practical boundary is the instruction to run code outside the browser.
DIVD’s Intrusion Trail Did Not Settle the Damage
Preserve the sequence, verify the installed build and keep preliminary exposure findings separate from confirmed losses.