60
USN-8763-1: kitty vulnerabilities
Ubuntu patches three kitty terminal flaws including remote command execution via crafted escape sequences.
Ubuntu Security Notice USN-8763-1 fixes multiple vulnerabilities in the kitty terminal emulator. CVE-2026-42850 allows a remote attacker to execute arbitrary commands via improperly escaped error messages triggered by crafted terminal escape sequences. CVE-2026-42851 enables arbitrary code execution with the user's privileges through mishandled remote edit requests in terminal output. CVE-2026-54055 lets a local attacker overwrite arbitrary files via destination paths in kitty's file transmission protocol.
42
57
60
30
60
60
30
60
35
42
42
Researching Employment Scams
Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.
The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.
30
30
57
45
60
57
55
42
42
57
60
30
57
42
60
42
57
57
60
60
60
55
60
60
55
30
57
42