InfoSec

oss-sec: AWStats awdownloadcsv.pl command injection and path traversal vulnerabilities Posted by christopher.downs on Mar 08 Evening, Two vulnerabilities were identified in the AWStats CGI script awdownloadcsv.pl that may allow command injection and arbitrary file access. Repository: https://github.com/eldy/AWStats/tree/develop Examples shown below are running locally in a Docker container for demonstration.  Download functionality is disabled. The Default.  my $ALLOWDOWNLOAD=0 #!/usr/bin/perl...

AWStats awdownloadcsv.pl command injection and path traversal vulnerabilities

Re: AWStats awdownloadcsv.pl command injection and path traversal vulnerabilities

oss-sec: Re: Telnetd Vulnerability Report Posted by Solar Designer on Mar 08 Actually, the strings would be in .rodata (or after linking, in .text) with your previous patch version as well. It's the array of pointers that you're also moving to there now. It sounds like one of you will have to rebase this on the other's work. You shouldn't need to have this one extern now - you can make it static. You shouldn't need this anymore. This second const here looks wrong as you're changing the...

Re: Telnetd Vulnerability Report

Re: Telnetd Vulnerability Report

Claude Code Security vs. OpenAI Codex Security – AI Arms Race A Technical Comparison for AppSec Engineers | March 2026 TL;DR Both tools launched within two weeks of each other in early 2026. Both use LLM-driven reasoning to find and patch vulnerabilities beyo…

Claude Code Security vs. OpenAI Codex Security – AI Arms Race

Cylake Offers AI-Native Security Without Relying on Cloud Services Cylake's platform will analyze security data locally and identify potential attacks for organizations concerned about data sovereignty.

Cylake Offers AI-Native Security Without Relying on Cloud Services

oss-sec: Re: Re: Telnetd Vulnerability Report Posted by Pat Gunn on Mar 07 I think it would be refreshing to see distros still using telnet to entirely ditch the environment-propagation mechanism; in my view it never was a good idea. A few arguments: A) telnet was usable between different distros, operating systems, and systems configurations. The meaning (and applicability) of different environments between those differs; a system running DYNIX might not have the same termcap entries as one running Ultrix, and someone...

Re: Re: Telnetd Vulnerability Report

oss-sec: Re: Telnetd Vulnerability Report Posted by Justin Swartz on Mar 07 LANG and LC_* were cargo-culted in as they are honoured by OpenSSHd. I don't mind poking at the InetUtils telnet client once I've done my best to leave the telnetd implementation in a better state than I found it in. Yes, inherited from inetd. Your reasoning makes sense, so I'll get rid of exorcise_env() and leave the inetd/tcpd supplied environment intact for telnetd (or some site-specific wrapper) to inherit. ... Agreed....

Re: Telnetd Vulnerability Report

oss-sec: CVE-2026-30909: Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows Posted by Timothy Legge on Mar 07 ======================================================================== CVE-2026-30909 CPAN Security Group ======================================================================== CVE ID: CVE-2026-30909 Distribution: Crypt-NaCl-Sodium Versions: through 2.002 MetaCPAN: https://metacpan.org/dist/Crypt-NaCl-Sodium VCS Repo:...

CVE-2026-30909: Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows

oss-sec: Re: Telnetd Vulnerability Report Posted by Solar Designer on Mar 07 Makes sense to me. Note that this list is different from Linux NetKit's, which is: /* * Allow only these variables. */ if (!strcmp(varp, "TERM")) return 1; if (!strcmp(varp, "DISPLAY")) return 1; if (!strcmp(varp, "USER")) return 1; if (!strcmp(varp, "LOGNAME")) return 1; if (!strcmp(varp, "POSIXLY_CORRECT")) return 1; I also checked the major *BSDs....

Re: Telnetd Vulnerability Report

Critical Zero-Click Command Injection in AVideo Platform Allows Stream Hijacking A critical vulnerability in AVideo, a widely used open-source video hosting and streaming platform. Tracked as CVE-2026-29058, this zero-click flaw carries a maximum severity rating, allowing unauthenticated attackers to execute arbitrary operating system commands on the targeted server. Discovered by security researcher Arkmarta, the vulnerability specifically affects AVideo version 6.0. It has been officially patched in version 7.0 and later releases. Classified under CWE-78 for the improper neutralization of special elements in an OS command , this network-based attack requires no system privileges or user interaction. If successfully exploited, attackers could achieve full server compromise, steal sensitive configuration secrets, and completely hijack live video streams. AVideo Platform Vulnerability The root cause of this severe vulnerability lies within the objects/getImage.php component of the AVideo platform. The issue occurs when the application processes network requests that contain a base64Url parameter. The platform Base64-decodes this user-supplied input and interpolates it directly into a double-quoted ffmpeg shell command. While the software attempts to validate the input using standard URL filters, this function only checks for basic URL syntax. It entirely fails to neutralize dangerous shell metacharacters or command substitution sequences. Because the application does not properly escape this untrusted data before executing the command, remote attackers can easily append malicious instructions. This allows unauthorized users to run arbitrary code , exfiltrate internal credentials, or intentionally disrupt the server’s streaming capabilities. According to the advisory on GitHub , administrators running AVideo-Encoder version 6.0 should upgrade to version 7.0 or later to secure their environments. The official patched release resolves the issue by applying strict shell argument escaping, utilizing functions like escapeshellarg(). This crucial fix ensures that all user-supplied input is properly sanitized before it ever interacts with the underlying command line, effectively preventing attackers from breaking out of the intended command structure. If an immediate software upgrade is not feasible, security teams must deploy temporary workarounds to protect their streaming infrastructure. Administrators should strongly restrict access to the vulnerable objects/getImage.php endpoint at the web server or reverse proxy layer using strict IP allowlisting. Additionally, organizations should apply Web Application Firewall (WAF) rules designed to inspect and actively block suspicious Base64-encoded shell command patterns. As a final protective measure, administrators can turn off the image retrieval component entirely if it is not required for the platform’s daily operations. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post Critical Zero-Click Command Injection in AVideo Platform Allows Stream Hijacking appeared first on Cyber Security News .

Critical Zero-Click Command Injection in AVideo Platform Allows Stream Hijacking

CVE-2026-30910: Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows

Aeternum C2 Botnet Abuses Polygon Blockchain to Hide Malware Commands and Evade Takedowns - Cyberwarzone Security researchers have uncovered a new botnet loader called Aeternum C2 that stores encrypted command-and-control instructions on the Polygon blockchain, making traditional takedown efforts significantly harder and signaling a new evolution in resilient malware infrastructure.

Aeternum C2 Botnet Abuses Polygon Blockchain to Hide Malware Commands and Evade Takedowns

UAT-10027 Targets U.S. Healthcare with Dohdoor Malware Using DoH C2 - Cyberwarzone Researchers have uncovered a previously undocumented cyber campaign tracked as UAT-10027 targeting U.S. healthcare and education organizations with a new backdoor called Dohdoor that uses DNS-over-HTTPS to evade detection and deploy Cobalt Strike beacons.

UAT-10027 Targets U.S. Healthcare with Dohdoor Malware Using DoH C2

FBI probing intrusion into system managing sensitive surveillance information The FBI is probing suspicious activity on an internal system containing sensitive surveillance and investigation data.

FBI probing intrusion into a system managing sensitive surveillance information

March 6-7, 2026 March 6-7, 2026 Partnering with Mozilla to improve Firefox’s security \ Anthropic Anthropic is an AI safety and research company that's working to build...

March 6-7, 2026

OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues

OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues

Pluralistic: The web is bearable with RSS (07 Mar 2026) – Pluralistic: Daily links from Cory Doctorow Today's links The web is bearable with RSS : And don't forget "Reader Mode." Hey look at this : Delights to delectate. Object permanence : Eyemodule x Disneyland; Scott Walker lies; Brother's demon-haunted printer; 4th Amendment luggage tape; Sanders x small donors v media; US police killings tallied. Upcoming appearances : Where to find me. Recent appearances : Where I've been. Latest books : You keep readin' em, I'll keep writin' 'em. Upcoming books : Like I said, I'll keep writin' 'em. Colophon : All the rest. The web is bearable with RSS ( permalink ) Never let them tell you that enshittification was a mystery. Enshittification isn't downstream of the "iron laws of economics" or an unrealistic demand by "consumers" to get stuff for free. Enshittification comes from specific policy choices, made by named individuals, that had the foreseeable and foreseen result of making the web worse: https://pluralistic.net/2025/10/07/take-it-easy/#but-take-it Like, there was once a time when an ever-increasing proportion of web users kept tabs on what was going on with RSS. RSS is a simple, powerful way for websites to publish "feeds" of their articles, and for readers to subscribe to those feeds and get notified when something new was posted, and even read that new material right there in your RSS reader tab or app. RSS is simple and versatile. It's the backbone of podcasts (though Apple and Spotify have done their best to kill it, along with public broadcasters like the BBC, all of whom want you to switch to proprietary apps that spy on you and control you). It's how many automated processes communicate with one another, untouched by human hands. But above all, it's a way to find out when something new has been published on the web. RSS's liftoff was driven by Google, who released a great RSS reader called "Google Reader" in 2007. Reader was free and reliable, and other RSS readers struggled to compete with it, with the effect that most of us just ended up using Google's product, which made it even harder to launch a competitor. But in 2013, Google quietly knifed Reader. I've always found the timing suspicious: it came right in the middle of Google's desperate scramble to become Facebook, by means of a product called Google Plus (G+). Famously, Google product managers' bonuses depended on how much G+ engagement they drove, with the effect that every Google product suddenly sprouted G+ buttons that either did something stupid, or something that confusingly duplicated existing functionality (like commenting on Youtube videos). Google treated G+ as an existential priority, and for good reason. Google was running out of growth potential, having comprehensively conquered Search, and having repeatedly demonstrated that Search was a one-off success, with nearly every other made-in-Google product dying off. What successes Google could claim were far more modest, like Gmail, Google's Hotmail clone. Google augmented its growth by buying other peoples' companies (Blogger, YouTube, Maps, ad-tech, Docs, Android, etc), but its internal initiatives were turkeys. Eventually, Wall Street was going to conclude that Google had reached the end of its growth period, and Google's shares would fall to a fraction of their value, with a price-to-earnings ratio commensurate with a "mature" company. Google needed a new growth story, and "Google will conquer Facebook's market" was a pretty good one. After all, investors didn't have to speculate about whether Facebook was profitable, they could just look at Facebook's income statements, which Google proposed to transfer to its own balance sheet. The G+ full-court press was as much a narrative strategy as a business strategy: by tying product managers' bonuses to a metric that demonstrated G+'s rise, Google could convince Wall Street that they had a lot of growth on their horizon. Of course, tying individual executives' bonuses to making a number go up has a predictably perverse outcome. As Goodhart's law has it, "Any metric becomes a target, and then ceases to be a useful metric." As soon as key decision-makers' personal net worth depending on making the G+ number go up, they crammed G+ everywhere and started to sneak in ways to trigger unintentional G+ sessions. This still happens today – think of how often you accidentally invoke an unbanishable AI feature while using Google's products (and products from rival giant, moribund companies relying on an AI narrative to convince investors that they will continue to grow): https://pluralistic.net/2025/05/02/kpis-off/#principal-agentic-ai-problem Like I said, Google Reader died at the peak of Google's scramble to make the G+ number go up. I have a sneaking suspicion that someone at Google realized that Reader's core functionality (helping users discover, share and discuss interesting new web pages) was exactly the kind of thing Google wanted us to use G+ for, and so they killed Reader in a bid to drive us to the stalled-out service they'd bet the company on. If Google killed Reader in a bid to push users to discover and consume web pages using a proprietary social media service, they succeeded. Unfortunately, the social media service they pushed users into was Facebook – and G+ died shortly thereafter. For more than a decade, RSS has lain dormant. Many, many websites still emit RSS feeds. It's a default behavior for WordPress sites, for Ghost and Substack sites, for Tumblr and Medium, for Bluesky and Mastodon. You can follow edits to Wikipedia pages by RSS, and also updates to parcels that have been shipped to you through major couriers. Web builders like Jason Kottke continue to surface RSS feeds for elaborate, delightful blogrolls: https://kottke.org/rolodex/ There are many good RSS readers. I've been paying for Newsblur since 2011, and consider the $36 I send them every year to be a very good investment: https://newsblur.com/ But RSS continues to be a power user-coded niche, despite the fact that RSS readers are really easy to set up and – crucially – make using the web much easier. Last week, Caroline Crampton (co-editor of The Browser) wrote about her experiences using RSS: https://www.carolinecrampton.com/the-view-from-rss/ As Crampton points out, much of the web (including some of the cruftiest, most enshittified websites) publish full-text RSS feeds, meaning that you can read their articles right there in your RSS reader, with no ads, no popups, no nag-screens asking you to sign up for a newsletter, verify your age, or submit to their terms of service. It's almost impossible to overstate how superior RSS is to the median web page. Imagine if the newsletters you followed were rendered with black, clear type on a plain white background (rather than the sadistically infinitesimal, greyed-out type that designers favor thanks to the unkillable urban legend that black type on a white screen causes eye-strain). Imagine reading the web without popups, without ads, without nag screens. Imagine reading the web without interruptors or "keep reading" links. Now, not every website publishes a fulltext feed. Often, you will just get a teaser, and if you want to read the whole article, you have to click through. I have a few tips for making other websites – even ones like Wired and The Intercept – as easy to read as an RSS reader, at least for Firefox users. Firefox has a built-in "Reader View" that re-renders the contents of a web-page as black type on a white background. Firefox does some kind of mysterious calculation to determine whether a page can be displayed in Reader View, but you can override this with the Activate Reader View, which adds a Reader View toggle for every page: https://addons.mozilla.org/en-US/firefox/addon/activate-reader-view/ Lots of websites (like The Guardian) want you to login before you can read them, and even if you pay to subscribe to them, these sites often want you to re-login every time you visit them (especially if you're running a full suite of privacy blockers). You can skip this whole process by simply toggling Reader View as soon as you get the login pop up. On some websites (like The Verge and Wired), you'll only see the first couple paragraphs of the article in Reader View. But if you then hit reload, the whole article loads. Activate Reader View puts a Reader View toggle on every page, but clicking that toggle sometimes throws up an error message, when the page is so cursed that Firefox can't figure out what part of it is the article. When this happens, you're stuck reading the page in the site's own default (and usually terrible) view. As you scroll down the page, you will often hit pop-ups that try to get you to sign up for a mailing list, agree to terms of service, or do something else you don't want to do. Rather than hunting for the button to close these pop-ups (or agree to objectionable terms of service), you can install "Kill Sticky," a bookmarklet that reaches into the page's layout files and deletes any element that isn't designed to scroll with the rest of the text: https://github.com/t-mart/kill-sticky Other websites (like Slashdot and Core77) load computer-destroying Javascript (often as part of an anti-adblock strategy). For these, I use the "Javascript Toggle On and Off" plugin, which lets you create a blacklist of websites that aren't allowed to run any scripts: https://addons.mozilla.org/en-US/firefox/addon/javascript-toggler/ Some websites (like Yahoo) load so much crap that they defeat all of these countermeasures. For these websites, I use the "Element Blocker" plug-in, which lets you delete parts of the web-page, either for a single session, or permanently: https://addons.mozilla.org/en-US/firefox/addon/element-blocker/ It's ridiculous that websites put so many barriers up to a pleasant reading experience. A slow-moving avalanche of enshittogenic phenomena got us here. There's corporate enshittification, like Google/Meta's monopolization of ads and Meta/Twitter's crushing of the open web. There's regulatory enshittification, like the EU's failure crack down on companies the pretend that forcing you to click an endless stream of "cookie consent" popups is the same as complying with the GDPR. Those are real problems, but they don't have to be your problem, at least when you want to read the web. A couple years ago, I wrote a guide to using RSS to improve your web experience, evade lock-in and duck algorithmic recommendation systems: https://pluralistic.net/2024/10/16/keep-it-really-simple-stupid/#read-receipts-are-you-kidding-me-seriously-fuck-that-noise Customizing your browser takes this to the next level, disenshittifying many websites – even if they block or restrict RSS. Most of this stuff only applies to desktop browsers, though. Mobile browsers are far more locked down (even mobile Firefox – remember, every iOS browser, including Firefox, is just a re-skinned version of Safari, thanks to Apple's ban rival browser engines). And of course, apps are the worst . An app is just a website skinned in the right kind of IP to make it a crime to improve it in any way: https://pluralistic.net/2024/05/07/treacherous-computing/#rewilding-the-internet And even if you do customize your mobile browser (Android Firefox lets you do some of this stuff), many apps (Twitter, Tumblr) open external links in their own browser (usually an in-app Chrome instance) with all the bullshit that entails. The promise of locked-down mobile platforms was that they were going to "just work," without any of the confusing customization options of desktop OSes. It turns out that taking away those confusing customization options was an invitation to every enshittifier to turn the web into an unreadable, extractive, nagging mess. This was the foreseeable – and foreseen – consequence of a new kind of technology where everything that isn't mandatory is prohibited: https://memex.craphound.com/2010/04/01/why-i-wont-buy-an-ipad-and-think-you-shouldnt-either/ Hey look at this ( permalink ) The Real Litmus Test for Democratic Presidential Candidates https://www.hamiltonnolan.com/p/the-real-litmus-test-for-democratic Users fume over Outlook.com email 'carnage' https://www.theregister.com/2026/03/04/users_fume_at_outlookcom_email/ You Bought Zuck’s Ray-Bans. Now Someone in Nairobi Is Watching You Poop. https://blog.adafruit.com/2026/03/04/you-bought-zucks-ray-bans-now-someone-in-nairobi-is-watching-you-poop/ Indefinite Book Club Hiatus https://whatever.scalzi.com/2026/03/03/indefinite-book-club-hiatus/ Art Bits from HyperCard https://archives.somnolescent.net/web/mari_v2/junk/hypercard/ Object permanence ( permalink ) #25yrsago 200 Eyemodule photos from Disneyland https://craphound.com/030401/ #20yrsago Fourth Amendment luggage tape https://ideas.4brad.com/node/367 #15yrsago Glenn Beck’s syndicator runs a astroturf-on-demand call-in service for radio programs https://web.archive.org/web/20110216081007/http://www.tabletmag.com/life-and-religion/58759/radio-daze/ #15yrsago 20 lies from Scott Walker https://web.archive.org/web/20110308062319/https://filterednews.wordpress.com/2011/03/05/20-lies-and-counting-told-by-gov-walker/ #10yrsago The correlates of Trumpism: early mortality, lack of education, unemployment, offshored jobs https://web.archive.org/web/20160415000000*/https://www.washingtonpost.com/news/wonk/wp/2016/03/04/death-predicts-whether-people-vote-for-donald-trump/ #10yrsago Hacking a phone’s fingerprint sensor in 15 mins with $500 worth of inkjet printer and conductive ink https://web.archive.org/web/20160306194138/http://www.cse.msu.edu/rgroups/biometrics/Publications/Fingerprint/CaoJain_HackingMobilePhonesUsing2DPrintedFingerprint_MSU-CSE-16-2.pdf #10yrsago Despite media consensus, Bernie Sanders is raising more money, from more people, than any candidate, ever https://web.archive.org/web/20160306110848/https://www.washingtonpost.com/politics/sanders-keeps-raising-money–and-spending-it-a-potential-problem-for-clinton/2016/03/05/a8d6d43c-e2eb-11e5-8d98-4b3d9215ade1_story.html #10yrsago Calculating US police killings using methodologies from war-crimes trials https://granta.com/violence-in-blue/ #1yrago Brother makes a demon-haunted printer https://pluralistic.net/2025/03/05/printers-devil/#show-me-the-incentives-i-will-show-you-the-outcome #1yrago Two weak spots in Big Tech economics https://pluralistic.net/2025/03/06/privacy-last/#exceptionally-american Upcoming appearances ( permalink ) San Francisco: Launch for Cindy Cohn's "Privacy's Defender" (City Lights), Mar 10 https://citylights.com/events/cindy-cohn-launch-party-for-privacys-defender/ Barcelona: Enshittification with Simona Levi/Xnet (Llibreria Finestres), Mar 20 https://www.llibreriafinestres.com/evento/cory-doctorow/ Berkeley: Bioneers keynote, Mar 27 https://conference.bioneers.org/ Montreal: Bronfman Lecture (McGill) Apr 10 https://www.eventbrite.ca/e/artificial-intelligence-the-ultimate-disrupter-tickets-1982706623885 London: Resisting Big Tech Empires (LSBU) https://www.tickettailor.com/events/globaljusticenow/2042691 Berlin: Re:publica, May 18-20 https://re-publica.com/de/news/rp26-sprecher-cory-doctorow Berlin: Enshittification at Otherland Books, May 19 https://www.otherland-berlin.de/de/event-details/cory-doctorow.html Hay-on-Wye: HowTheLightGetsIn, May 22-25 https://howthelightgetsin.org/festivals/hay/big-ideas-2 Recent appearances ( permalink ) The Virtual Jewel Box (U Utah) https://tanner.utah.edu/podcast/enshittification-cory-doctorow-matthew-potolsky/ Tanner Humanities Lecture (U Utah) https://www.youtube.com/watch?v=i6Yf1nSyekI The Lost Cause https://streets.mn/2026/03/02/book-club-the-lost-cause/ Should Democrats Make A Nuremberg Caucus? (Make It Make Sense) https://www.youtube.com/watch?v=MWxKrnNfrlo Making The Internet Suck Less (Thinking With Mitch Joel) https://www.sixpixels.com/podcast/archives/making-the-internet-suck-less-with-cory-doctorow-twmj-1024/ Latest books ( permalink ) "Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce "Enshittification: Why Everything Suddenly Got Worse and What to Do About It," Farrar, Straus, Giroux, October 7 2025 https://us.macmillan.com/books/9780374619329/enshittification/ "Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 ( https://us.macmillan.com/books/9781250865908/picksandshovels ). "The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 ( thebezzle.org ). "The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 ( http://lost-cause.org ). "The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 ( http://seizethemeansofcomputation.org ). Signed copies at Book Soup ( https://www.booksoup.com/book/9781804291245 ). "Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com . "Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com Upcoming books ( permalink ) "The Reverse-Centaur's Guide to AI," a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026 "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2026 "The Post-American Internet," a geopolitical sequel of sorts to Enshittification , Farrar, Straus and Giroux, 2027 "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, 2027 "The Memex Method," Farrar, Straus, Giroux, 2027 Colophon ( permalink ) Today's top sources: Currently writing: "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America (1012 words today, 45361 total) "The Reverse Centaur's Guide to AI," a short book for Farrar, Straus and Giroux about being an effective AI critic. LEGAL REVIEW AND COPYEDIT COMPLETE. "The Post-American Internet," a short book about internet policy in the age of Trumpism. PLANNING. A Little Brother short story about DIY insulin PLANNING This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net. https://creativecommons.org/licenses/by/4.0/ Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution. How to get Pluralistic: Blog (no ads, tracking, or data-collection): Pluralistic.net Newsletter (no ads, tracking, or data-collection): https://pluralistic.net/plura-list Mastodon (no ads, tracking, or data-collection): https://mamot.fr/@pluralistic Bluesky (no ads, possible tracking and data-collection): https://bsky.app/profile/doctorow.pluralistic.net Medium (no ads, paywalled): https://doctorow.medium.com/ https://twitter.com/doctorow Tumblr (mass-scale, unrestricted, third-party surveillance and advertising): https://mostlysignssomeportents.tumblr.com/tagged/pluralistic " When life gives you SARS, you make sarsaparilla " -Joey "Accordion Guy" DeVilla READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer. ISSN: 3066-764X

Pluralistic: The web is bearable with RSS (07 Mar 2026)

Reading White House President Trump’s Cyber Strategy for America (March 2026) White House released President Trump’s Cyber Strategy for America, framing cyberspace as a strategic domain to project power and counter growing cyber threats

Reading White House President Trump’s Cyber Strategy for America (March 2026)

Termite ransomware breaches linked to ClickFix CastleRAT attacks Ransomware threat actors tracked as Velvet Tempest are using the ClickFix technique and legitimate Windows utilities to deploy the DonutLoader malware and the CastleRAT backdoor.

Termite ransomware breaches linked to ClickFix CastleRAT attacks

oss-sec: CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling Posted by Andor Molnar on Mar 07 Severity: important Affected versions: - Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.9.0 through 3.9.4 - Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.8.0 through 3.8.5 Description: Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are...

CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Microsoft: Hackers abusing AI at every stage of cyberattacks Microsoft says threat actors are increasingly using artificial intelligence in their operations to accelerate attacks, scale malicious activity, and lower technical barriers across all aspects of a cyberattack.

Microsoft: Hackers abusing AI at every stage of cyberattacks

oss-sec: CVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager Posted by Andor Molnar on Mar 07 Severity: important Affected versions: - Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.9.0 through 3.9.4 - Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.8.0 through 3.8.5 Description: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the...

CVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

oss-sec: Re: CVE-2026-28372: Telnetd Vulnerability Report Posted by Salvatore Bonaccorso on Mar 07 Hi, I just need to clarify one thing here: The CVE was not assigned by the Debian CNA, but as there was no CVE assigned by the issue reported by Ron, I requested one from MITRE. There was none assigned in time when we released the DSA, and at that point TTBOMK the more general issue/root cause indication by Justin Swartz was not known. So the CVE request to MITRE was done specifically as for the issue found by Ron. Later, after the DSA release...

Re: CVE-2026-28372: Telnetd Vulnerability Report

oss-sec: Re: CVE-2026-28372: Telnetd Vulnerability Report Posted by Guillem Jover on Mar 07 Hi! Right, sorry, as it seems like I forgot about this (where I was even CCed in later emails mentioning this)! Thanks, Guillem

Re: CVE-2026-28372: Telnetd Vulnerability Report

oss-sec: Re: Telnetd Vulnerability Report Posted by Justin Swartz on Mar 07 Greetings all, Based on my interpretation of the whitelisting and path sanitization concepts discussed in this thread, and of the feedback I have received since starting this thread, I have submitted a patch set (including a cover letter [1]) to bug-inetutils which implements: WHITELISTING The obsolete blacklist, implemented by scrub_env(), has been removed. The daemon now clears the inherited environment and enforces a default whitelist...

Re: Telnetd Vulnerability Report

Best infosec-related long reads for the week of 2/28/26

Best infosec-related long reads for the week of 2/28/26

Cognizant TriZetto Data Breach Exposes Health Information of 3.4 Million Patients TriZetto Provider Solutions, a healthcare technology subsidiary of the IT services giant Cognizant, has officially disclosed a massive cybersecurity data breach affecting the sensitive health information of 3,433,965 patients. The healthcare organization recently filed a formal data breach notification revealing that malicious threat actors successfully compromised their external systems. This extensive breach heavily underscores the ongoing security threats directly targeting the healthcare supply chain and vital third-party service providers. Breach Timeline and Attack Impact The unauthorized external network access initially occurred on November 19, 2024. However, the organization did not officially discover the intrusion until November 28, 2025. This severe security dwell time allowed the malicious attackers to remain completely undetected inside TriZetto’s external infrastructure for slightly over an entire year. The breach is currently classified as an external system hacking incident . During the intrusion, cybercriminals successfully extracted full names and other critical personal identifiers directly combined with sensitive healthcare data. This extensively delayed discovery raises immediate critical questions about network monitoring capabilities and threat hunting practices within the broader healthcare technology sector. Maine’s Attorney General received the official breach notice on February 6, 2026, submitted by legal counsel Edward Zacharias from McDermott Will & Schulte. While millions are impacted nationwide, the filing specifies that 1,128 victims are residents of Maine. The massive scale of this data exfiltration event easily places it among the largest and most severe healthcare supply chain breaches reported recently. Incident Metric Technical Details Target Organization TriZetto Provider Solutions (Earth City, MO) Total Victims Impacted 3,433,965 Attack Vector External System Breach (Hacking) Initial Compromise November 19, 2024 Intrusion Discovered November 28, 2025 Remediation and Victim Protection Following the eventual discovery of the compromised infrastructure, TriZetto initiated an incident response investigation and began officially notifying affected consumers on February 6, 2026. Because the stolen databases include highly sensitive personal identifiers linked with medical records, impacted victims now face a significantly elevated risk of targeted spear-phishing campaigns , medical identity theft, and severe financial fraud. The technology provider is currently delivering written notification letters to all affected patients to maintain strict compliance with regulatory breach disclosure laws. To help mitigate the potential ongoing fallout from this massive data exposure, TriZetto partnered directly with the security firm Kroll. The company is currently offering affected patients 12 months of complimentary single-bureau credit monitoring and dedicated identity theft protection services. Independent cybersecurity researchers strongly advise all affected patients to proactively freeze their credit reports and continuously monitor their personal medical billing statements for any unauthorized or fraudulent healthcare claims. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post Cognizant TriZetto Data Breach Exposes Health Information of 3.4 Million Patients appeared first on Cyber Security News .

Cognizant TriZetto Data Breach Exposes Health Information of 3.4 Million Patients

Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model

Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model

Malicious imToken Chrome Extension Caught Stealing Mnemonics and Private Keys Socket’s Threat Research Team has discovered a malicious Google Chrome extension named “lmΤoken Chromophore” that actively steals cryptocurrency wallet credentials. Masquerading as a harmless hex color visualizer, the extension actually impersonates the popular non-custodial wallet brand imToken. Since its launch in 2016, imToken has served more than 20 million customers globally, making it a highly lucrative target for phishing campaigns. The official imToken team has warned users that their platform is strictly a mobile application and they have never released a Chrome extension. However, this malicious add-on lures victims by mirroring the trusted visual identity of the brand. Its true objective is to trick victims into handing over their 12 or 24-word seed phrases or plaintext private keys, which results in an immediate wallet takeover. Published on February 2, 2026 by Socket’s Threat Research Team , the extension masks its danger behind fake five-star reviews and a fraudulent privacy policy claiming no data collection. ​ Phishing Workflow and Evasion Tactics Upon installation, the extension completely ignores its advertised color-picking functionality. Instead, it acts as a lightweight redirector. Its background code automatically fetches a target website from a hardcoded remote endpoint hosted on JSONKeeper. It then opens a new browser tab directed to the attacker’s infrastructure. This setup allows the threat actors to easily change the phishing destination at any time without having to update the extension code in the Chrome Web Store. ​ The final step opens the real  token.im  site as a decoy after the wallet secret has already been collected. (Source: Socket) The initial redirect sends victims to a deceptive phishing domain named  chroomewedbstorre-detail-extension[.]com . To bypass automated security scanners and trick manual reviewers, the attackers use mixed-script Unicode homoglyphs. By replacing standard Latin letters with visually identical Cyrillic and Greek characters in both the page title and the import path, the attackers easily evade simple text-matching detection systems. ​ Once on the phishing page, victims see a fraudulent wallet import interface powered by external JavaScript files like  sjcl-bip39.js  and  wordlist_english.js . The site prompts users to input their secret mnemonic seed phrase or private key. To maintain the illusion of legitimacy after harvesting the sensitive data, the workflow asks users to set a local password and displays a fake “upgrading” loading screen. Finally, the attack sequence redirects the victim to the official  token.im  website, minimizing suspicion while the attackers secretly drain the compromised accounts. ​ Remediation and Threat Indicators Security teams must scrutinize browser extensions with the same rigor applied to traditional third-party software. Organizations are strongly advised to restrict extension installations in sensitive browser profiles. Users should always verify all wallet software through official vendor distribution channels. If any user has entered a seed phrase, private key, or wallet password into a suspected phishing page , they must treat the wallet as completely compromised and immediately rotate their funds to new, secure keys. Security tools should monitor for extensions whose primary behaviour is to fetch remote content and open external destinations. ​ Security analysts should integrate the following Indicators of Compromise (IOCs) into their detection pipelines to block this threat: Malicious Extension ID:  bbhaganppipihlhjgaaeeeefbaoihcgi ​ Publisher Email Address:  liomassi19855@gmail[.]com ​ Primary Phishing Landing Page:  chroomewedbstorre-detail-extension[.]com ​ Remote Configuration Payload:  jsonkeeper[.]com/b/KUWNE ​ Malicious Script Infrastructure:  compute-fonts-appconnect.pages[.]dev Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post Malicious imToken Chrome Extension Caught Stealing Mnemonics and Private Keys appeared first on Cyber Security News .

Malicious imToken Chrome Extension Caught Stealing Mnemonics and Private Keys