Notifire — Tech news that matters

Ubuntu has patched several Linux kernel vulnerabilities, including two in its OverlayFS file system. These flaws could allow a local attacker to bypass permission checks and gain elevated privileges, potentially leading to unauthorized system control. Users should update their systems immediately to mitigate the risk.

Drupal has announced an upcoming core security release for all supported branches, scheduled for May 20, 2026. The Drupal Security Team is urging site administrators to prepare for immediate updates, warning that exploits could be developed within hours or days of the patch's release.

Multiple vulnerabilities have been found in the GnuTLS library, a core component for secure communications. The flaws could allow attackers to cause a denial of service, access sensitive information, or potentially execute arbitrary code by sending specially crafted data during a DTLS handshake.

Ubuntu has released security updates for the Linux kernel on Xilinx ZynqMP systems. These patches address multiple vulnerabilities, including critical flaws in the OverlayFS implementation that could allow a local attacker to gain elevated privileges and compromise the security of affected devices.

Proof-of-concept exploit code, named DirtyDecrypt, has been publicly released for a recently patched Linux kernel vulnerability. The flaw allows for local privilege escalation, enabling an attacker with local access to gain higher-level system permissions. The vulnerability was discovered and reported by security researchers in early May.

A compromised version of the popular Nx Console extension (v18.95.0) was published on the VS Code Marketplace. The malicious version, installed by developers, contained a credential stealer. The extension, with over 2.2 million installations, poses a significant risk to affected users and their organizations.

A new vulnerability called YellowKey allows attackers with access to a Windows device to bypass Bitlocker encryption and access files. Microsoft is working on a permanent patch for the flaw (CVE-2026-45585) and has released temporary mitigation steps for companies to implement immediately.

The npm registry has experienced another malware attack, this time affecting the AntV data visualization tool. The incident occurred after an attacker compromised the credentials of a maintainer for the popular `timeago.js` library, highlighting ongoing risks in the open-source software supply chain.

Ubuntu has issued a security notice detailing several vulnerabilities discovered in the Linux kernel. The flaws affect network drivers, NVME drivers, and IPv4 networking subsystems. An attacker could potentially exploit these issues to compromise a system, making the provided security update essential for all users.

A security researcher has released a proof-of-concept exploit for a new Windows zero-day vulnerability called MiniPlasma. The exploit can grant full SYSTEM privileges on fully patched Windows 11 systems. The flaw is reportedly an unfixed version of a bug Microsoft claimed to have patched in 2020.

Phishing emails that bypass security filters create a dangerous gap for businesses. After a single click, security teams are often unsure about the extent of the exposure. Early detection systems are crucial for closing this gap, helping teams quickly understand the risk and respond effectively to threats.

Every radio signal ever broadcast from Earth is expanding into space at the speed of light, creating a 'radio bubble' over 100 light-years wide. This sphere contains everything from early broadcasts to modern communications, representing a passive, expanding archive of human technological history for the cosmos.

A nine-year-old vulnerability (CVE-2026-46333) has been found in the Linux kernel. The flaw, caused by improper privilege management, allows a local user without special permissions to access sensitive files and execute commands with root privileges on default installations of several major Linux distributions.

A new Linux malware named Showboat has been discovered targeting a telecommunications provider in the Middle East. Active since at least mid-2022, Showboat is a modular post-exploitation tool. It can create a remote shell, transfer files, and establish a SOCKS5 proxy for attackers to use.

The creator of NanoClaw, a secure, containerized platform for running AI agents, has turned down a $20 million buyout offer. Instead, the company has secured $12 million in a seed funding round to continue developing its sandboxed platform for AI automation and marketing.

Google is integrating AI-generated summaries, called AI Overviews, directly into its main search results. This feature is now the default for users in the U.S., with a global rollout planned. The goal is to provide direct, synthesized answers for complex questions, fundamentally changing the traditional search experience.

Ubuntu has released a security update for the Linux kernel, fixing several vulnerabilities. The most critical flaw, known as Copy Fail, could allow a local attacker to escalate privileges or escape from a container. The patch also addresses issues in various other kernel subsystems to prevent system compromise.

Grafana Labs confirmed a security breach limited to its GitHub environment, exposing public and private source code. The company stated that its investigation found no evidence of customer production systems being compromised. The incident was linked to a supply chain attack involving a TanStack npm package.

Ubuntu has patched two vulnerabilities in the rsync utility. One flaw could allow a remote attacker to cause a denial of service, while another could let a local attacker overwrite files on systems with specific configurations. The issues affect recent versions of Ubuntu, including 22.04 and 24.04 LTS.

The Software Freedom Conservancy is taking Vizio to trial in California. The nonprofit has been fighting for eight years to force Vizio to release the complete source code for its Linux-based smart TV operating system, giving users more control over their devices and data.

Microsoft has uncovered a supply chain attack targeting the @antv npm ecosystem. Attackers compromised a maintainer's account to publish malicious versions of data-visualization packages. The code aims to steal credentials from CI/CD pipelines and affects widely used libraries like echarts-for-react.

GitHub is investigating a claim by a threat actor group called TeamPCP. The group alleges it accessed GitHub's internal repositories and is attempting to sell the platform's source code on a cybercrime forum. GitHub has found no evidence that customer data has been impacted so far.

A China-aligned hacking group known as Webworm is using new custom backdoors, EchoCreep and GraphWorm. The group leverages popular services like Discord and the Microsoft Graph API for its command-and-control communications, primarily targeting government agencies with this updated tooling, according to recent cybersecurity research.

Traditional identity verification is no longer enough to stop sophisticated attacks. Attackers are increasingly using stolen session tokens and compromised devices to bypass logins. Security strategies must evolve to include continuous device verification, making it a critical component of any modern Zero Trust security framework.