Notifire — Tech news that matters

Ubuntu has patched several Linux kernel vulnerabilities, including two in its OverlayFS file system. These flaws could allow a local attacker to bypass permission checks and gain elevated privileges, potentially leading to unauthorized system control. Users should update their systems immediately to mitigate the risk.

Proof-of-concept exploit code, named DirtyDecrypt, has been publicly released for a recently patched Linux kernel vulnerability. The flaw allows for local privilege escalation, enabling an attacker with local access to gain higher-level system permissions. The vulnerability was discovered and reported by security researchers in early May.

Multiple vulnerabilities have been found in the GnuTLS library, a core component for secure communications. The flaws could allow attackers to cause a denial of service, access sensitive information, or potentially execute arbitrary code by sending specially crafted data during a DTLS handshake.

A compromised version of the popular Nx Console extension (v18.95.0) was published on the VS Code Marketplace. The malicious version, installed by developers, contained a credential stealer. The extension, with over 2.2 million installations, poses a significant risk to affected users and their organizations.

Drupal has announced an upcoming core security release for all supported branches, scheduled for May 20, 2026. The Drupal Security Team is urging site administrators to prepare for immediate updates, warning that exploits could be developed within hours or days of the patch's release.

Every radio signal ever broadcast from Earth is expanding into space at the speed of light, creating a 'radio bubble' over 100 light-years wide. This sphere contains everything from early broadcasts to modern communications, representing a passive, expanding archive of human technological history for the cosmos.

Google is integrating AI-generated summaries, called AI Overviews, directly into its main search results. This feature is now the default for users in the U.S., with a global rollout planned. The goal is to provide direct, synthesized answers for complex questions, fundamentally changing the traditional search experience.

The FBI has issued a request to purchase access to a commercial, nationwide license plate reader database. This would provide the agency with real-time and historical location data on vehicles across the US, raising significant privacy concerns among civil liberties groups and the public.

A BeyondTrust report found that while Microsoft's total vulnerability count was stable in 2023, critical flaws doubled. Attackers are shifting focus from initial access to privilege escalation, using identity-based attacks to gain deeper control over systems. This trend highlights the growing importance of internal security controls.

The creator of NanoClaw, a secure, containerized platform for running AI agents, has turned down a $20 million buyout offer. Instead, the company has secured $12 million in a seed funding round to continue developing its sandboxed platform for AI automation and marketing.

GitHub is investigating a claim by a threat actor group called TeamPCP. The group alleges it accessed GitHub's internal repositories and is attempting to sell the platform's source code on a cybercrime forum. GitHub has found no evidence that customer data has been impacted so far.

Traditional identity verification is no longer enough to stop sophisticated attacks. Attackers are increasingly using stolen session tokens and compromised devices to bypass logins. Security strategies must evolve to include continuous device verification, making it a critical component of any modern Zero Trust security framework.

A new Linux malware named Showboat has been discovered targeting a telecommunications provider in the Middle East. Active since at least mid-2022, Showboat is a modular post-exploitation tool. It can create a remote shell, transfer files, and establish a SOCKS5 proxy for attackers to use.

A China-aligned hacking group known as Webworm is using new custom backdoors, EchoCreep and GraphWorm. The group leverages popular services like Discord and the Microsoft Graph API for its command-and-control communications, primarily targeting government agencies with this updated tooling, according to recent cybersecurity research.

Grafana Labs confirmed a security breach limited to its GitHub environment, exposing public and private source code. The company stated that its investigation found no evidence of customer production systems being compromised. The incident was linked to a supply chain attack involving a TanStack npm package.

A proof-of-concept exploit is now public for a high-severity Linux kernel vulnerability dubbed 'DirtyDecrypt.' The flaw allows a local user to gain root privileges on systems with the `rxgk` module enabled. Major distributions are affected, and patches are available. Teams should update their systems immediately.

Ubuntu has patched two vulnerabilities in the rsync utility. One flaw could allow a remote attacker to cause a denial of service, while another could let a local attacker overwrite files on systems with specific configurations. The issues affect recent versions of Ubuntu, including 22.04 and 24.04 LTS.

Ubuntu has patched several vulnerabilities in the Linux kernel. One major flaw, known as 'Copy Fail,' could allow a local attacker to escalate privileges or escape a container. Other issues were found in subsystems like networking, cryptography, and I/O, which could also lead to system compromise.

Microsoft has released a mitigation for a BitLocker security bypass vulnerability known as "YellowKey." The zero-day flaw, tracked as CVE-2026-45585, was publicly disclosed last week and carries a CVSS score of 6.8, affecting the Windows disk encryption feature.

Microsoft details an attack where a threat actor used a single compromised identity to breach an entire cloud environment. The attack began with social engineering and escalated through Microsoft Entra ID and M365 to compromise critical Azure services, including databases and virtual machines.

Apple announced it has prevented over $11 billion in fraudulent transactions on its App Store since 2018. The company's fraud prevention systems, which combine machine learning with human review, stopped more than $2.2 billion in a single year alone, safeguarding developers and users.

A new phishing-as-a-service platform called EvilTokens has compromised over 340 Microsoft 365 organizations. The attack tricks users into authorizing a malicious app via a device login flow, effectively bypassing multi-factor authentication and granting attackers access to their accounts without needing passwords or MFA codes.

Microsoft has detailed a financially motivated group called Fox Tempest that operates a service selling fraudulent code-signing certificates to other criminals. This service helps malware, including ransomware, appear legitimate to bypass security software and infect systems more easily.

New research suggests a novel way to find dark matter. Instead of looking for it directly, scientists propose listening for its effects on gravitational waves. These ripples in spacetime, created by merging black holes, could carry a subtle signature of dark matter, detectable by instruments like LIGO.