Notifire — Tech news that matters

Ubuntu has released security updates for the Linux kernel on Xilinx ZynqMP systems. These patches address multiple vulnerabilities, including critical flaws in the OverlayFS implementation that could allow a local attacker to gain elevated privileges and compromise the security of affected devices.

Microsoft has uncovered a supply chain attack targeting the @antv npm ecosystem. Attackers compromised a maintainer's account to publish malicious versions of data-visualization packages. The code aims to steal credentials from CI/CD pipelines and affects widely used libraries like echarts-for-react.

Microsoft has released a mitigation for a BitLocker security bypass vulnerability known as "YellowKey." The zero-day flaw, tracked as CVE-2026-45585, was publicly disclosed last week and carries a CVSS score of 6.8, affecting the Windows disk encryption feature.

Apple announced it has prevented over $11 billion in fraudulent transactions on its App Store since 2018. The company's fraud prevention systems, which combine machine learning with human review, stopped more than $2.2 billion in a single year alone, safeguarding developers and users.

Grafana Labs confirmed a security breach limited to its GitHub environment, exposing public and private source code. The company stated that its investigation found no evidence of customer production systems being compromised. The incident was linked to a supply chain attack involving a TanStack npm package.

Ubuntu has patched several vulnerabilities in the Linux kernel. One major flaw, known as 'Copy Fail,' could allow a local attacker to escalate privileges or escape a container. Other issues were found in subsystems like networking, cryptography, and I/O, which could also lead to system compromise.

A BeyondTrust report found that while Microsoft's total vulnerability count was stable in 2023, critical flaws doubled. Attackers are shifting focus from initial access to privilege escalation, using identity-based attacks to gain deeper control over systems. This trend highlights the growing importance of internal security controls.

GitHub is investigating a claim by a threat actor group called TeamPCP. The group alleges it accessed GitHub's internal repositories and is attempting to sell the platform's source code on a cybercrime forum. GitHub has found no evidence that customer data has been impacted so far.

A new phishing-as-a-service platform called EvilTokens has compromised over 340 Microsoft 365 organizations. The attack tricks users into authorizing a malicious app via a device login flow, effectively bypassing multi-factor authentication and granting attackers access to their accounts without needing passwords or MFA codes.

Grafana Labs has disclosed a security incident where attackers used a stolen GitHub access token to access its environment. The breach resulted in the unauthorized download of some of its source code. Grafana is investigating but states no customer data was compromised.

The FBI has issued a request to purchase access to a commercial, nationwide license plate reader database. This would provide the agency with real-time and historical location data on vehicles across the US, raising significant privacy concerns among civil liberties groups and the public.

Google is integrating AI-generated summaries, called AI Overviews, directly into its main search results. This feature is now the default for users in the U.S., with a global rollout planned. The goal is to provide direct, synthesized answers for complex questions, fundamentally changing the traditional search experience.

Microsoft details an attack where a threat actor used a single compromised identity to breach an entire cloud environment. The attack began with social engineering and escalated through Microsoft Entra ID and M365 to compromise critical Azure services, including databases and virtual machines.

Ubuntu has patched two vulnerabilities in the rsync utility. One flaw could allow a remote attacker to cause a denial of service, while another could let a local attacker overwrite files on systems with specific configurations. The issues affect recent versions of Ubuntu, including 22.04 and 24.04 LTS.

A China-aligned hacking group known as Webworm is using new custom backdoors, EchoCreep and GraphWorm. The group leverages popular services like Discord and the Microsoft Graph API for its command-and-control communications, primarily targeting government agencies with this updated tooling, according to recent cybersecurity research.

A new Linux malware named Showboat has been discovered targeting a telecommunications provider in the Middle East. Active since at least mid-2022, Showboat is a modular post-exploitation tool. It can create a remote shell, transfer files, and establish a SOCKS5 proxy for attackers to use.

A proof-of-concept exploit is now public for a high-severity Linux kernel vulnerability dubbed 'DirtyDecrypt.' The flaw allows a local user to gain root privileges on systems with the `rxgk` module enabled. Major distributions are affected, and patches are available. Teams should update their systems immediately.

The Software Freedom Conservancy is taking Vizio to trial in California. The nonprofit has been fighting for eight years to force Vizio to release the complete source code for its Linux-based smart TV operating system, giving users more control over their devices and data.

Ubuntu has released a security update for the Linux kernel, fixing several vulnerabilities. The most critical flaw, known as Copy Fail, could allow a local attacker to escalate privileges or escape from a container. The patch also addresses issues in various other kernel subsystems to prevent system compromise.

The creator of NanoClaw, a secure, containerized platform for running AI agents, has turned down a $20 million buyout offer. Instead, the company has secured $12 million in a seed funding round to continue developing its sandboxed platform for AI automation and marketing.

Traditional identity verification is no longer enough to stop sophisticated attacks. Attackers are increasingly using stolen session tokens and compromised devices to bypass logins. Security strategies must evolve to include continuous device verification, making it a critical component of any modern Zero Trust security framework.

A new report highlights that traditional security benchmarks are ineffective for evaluating AI systems. Unlike standard software, AI security is an emergent property that cannot be measured by simple tests, challenging teams to rethink how they approach securing their AI models and applications.

Microsoft has taken down a major malware code-signing service that enabled ransomware groups to make their malicious software appear legitimate. The operation involved seizing a website, revoking over 1,000 abused certificates, and shutting down hundreds of virtual machines hosted on Azure.

GitHub has confirmed that a recent breach of 3,800 internal repositories was caused by a malicious VS Code extension. The extension was compromised in a wider supply-chain attack targeting the popular TanStack npm packages, highlighting the growing risks of software dependencies.