Search: “openDesk”

29 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Phishing & fraud 1 Policy & legal 1

SeverityAll critical 0 high 0 medium 1 low 0 info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ZDI-26-698: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI-26-698: Linux Kernel NTFS3 out-of-bounds read (CVSS 5.2) allows local attackers to disclose sensitive information on affected systems.

ZDI advisory ZDI-26-698 describes an out-of-bounds read in the Linux Kernel NTFS3 driver rated CVSS 5.2. Exploitation requires the attacker to first obtain the ability to execute low-privileged code on the target. The impact is limited to local information disclosure. No CVE identifier is listed in the advisory.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability 3 sources

Switzerland's Federal Government Is Replacing Microsoft on 3k Computers

Switzerland's Federal Chancellery launched a pilot replacing Microsoft 365 with open-source openDesk on 3,000 federal workstations by end of 2027.

Switzerland launched a CHF 9 million pilot to migrate 3,000 federal workstations (about 7% of the federal workforce) from Microsoft 365 to the German open-source openDesk suite, targeting completion by end of 2027. The move follows a successful 172-employee proof of concept (PoC BOSS) and the 2024 EMBAG open-source law, driven by digital sovereignty concerns about foreign access to Swiss government data. The Swiss Army's Cyber Command plans a faster migration, replacing Microsoft 365 with openDesk by October 2026, while Microsoft is investing over CHF 325 million in Swiss AI and cloud infrastructure.

Hacker News · securitySep 7, 05:33 UTC · 9d agoPolicy & legal HN 354↑ · 278 comments

Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal

Ukraine's top prosecutor Ruslan Kravchenko resigned after NABU arrested a deputy for taking bribes protecting scam call centers running fake investment platforms.

Ukraine's anti-corruption bureau NABU arrested Serhiy Kropyva, Deputy Head of International Cooperation at the Prosecutor General's Office, alleging officials took monthly protection fees from a network of 100-500 scam call centers luring victims into fake investment platforms, with bribes reportedly growing from $700,000 to $3.5 million per month. Prosecutor General Ruslan Kravchenko resigned on Monday, calling it a political decision, while Kropyva was fired with bail set at 120 million hryvnias ($2.7 million) and over 100 call centers shut down in the past month. The newsletter also briefly covers a cyberattack crippling more than 80 Luxembourg medical practices via payment vendor BMS Engineering, ShinyHunters' claimed theft of 200,000 Florida DMV driver records, a cyberattack on the American Meteor Society, and school closures in Springfield, Massachusetts.

Risky Business NewsSep 9, 06:06 UTC · 7d agoPhishing & fraud

ZDI-26-687: Linux Kernel Open vSwitch Flow Delete Use-After-Free Information Disclosure Vulnerability

ZDI discloses Linux Kernel Open vSwitch use-after-free (CVE-2026-80994) letting low-privileged local attackers disclose sensitive kernel information, CVSS 6.4.

ZDI-26-687 covers a use-after-free information disclosure vulnerability in the Linux Kernel's Open vSwitch flow deletion handling, tracked as CVE-2026-80994 with a CVSS rating of 6.4. Exploitation requires the ability to execute low-privileged code on the target system. The flaw allows local attackers to disclose sensitive information from affected installations.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-80994

ZDI-26-688: Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability

ZDI discloses Linux Kernel Open vSwitch race condition (CVE-2026-74465) allowing low-privileged local attackers to escalate privileges, CVSS 7.8.

ZDI-26-688 describes a race condition local privilege escalation vulnerability in the Linux Kernel's Open vSwitch implementation, tracked as CVE-2026-74465 with a CVSS rating of 7.8. An attacker must first obtain the ability to execute low-privileged code on the target system. Successful exploitation grants elevated privileges on affected installations.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-744651

ZDI-26-694: Linux Kernel Net Scheduler Clsact Qdisc Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-23413, a use-after-free in the Linux kernel net scheduler clsact qdisc allowing local privilege escalation, CVSS 8.2.

ZDI advisory ZDI-26-694 describes a use-after-free vulnerability in the Linux kernel's net scheduler clsact qdisc component. Successful exploitation allows local attackers to escalate privileges on affected installations, and ZDI assigned a CVSS score of 8.2. The flaw is tracked as CVE-2026-23413. The advisory notes an attacker must first obtain the ability to execute high-privileged code on the target system to exploit the vulnerability.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-234132

OpenArch – PyTorch implementations of modern LLM architectures

OpenArch provides PyTorch reference implementations of modern LLM architectures for developers and researchers.

OpenArch is a GitHub project offering PyTorch implementations of modern large language model architectures. The repository attracted 43 points and 7 comments on Hacker News. It targets developers and researchers who want readable, runnable versions of current LLM architectures.

Hacker News · AISep 14, 07:55 UTC · 2d agoAI tools & infra HN 43↑ · 7 comments

ZDI-26-573: Linux Kernel KSMBD Response Header Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI disclosed an unauthenticated out-of-bounds read (CVE-2026-68431) in Linux Kernel KSMBD causing sensitive information disclosure, CVSS 9.3.

The Zero Day Initiative published ZDI-26-573 describing an out-of-bounds read in the Linux Kernel KSMBD response header handling. Unauthenticated remote attackers can disclose sensitive information, but only systems with ksmbd enabled are affected. ZDI assigned a CVSS score of 9.3 and the identifier CVE-2026-68431.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-68431

Chaotic Eclipse Released GreenSection, A PoC For NVIDIA Memory Corruption Zero-Day

Researcher Chaotic Eclipse released GreenSection, a PoC exploiting an unpatched out-of-bounds write in NVIDIA Windows user-mode shared memory.

Security researcher Chaotic Eclipse disclosed an out-of-bounds write in NVIDIA's Windows user-mode components, which share a global memory section (\BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}) with full read/write access to all users. The PoC crashes applications running Vulkan or OpenGL; the researcher says the bug could cross user boundaries or compromise dwm.exe but did not fully assess the impact. No CVE has been assigned and no patch is mentioned. The researcher recently released zero-day PoCs against Kaspersky, Avast, and CrowdStrike Falcon.

Security AffairsSep 7, 13:42 UTC · 8d agoExploit / PoC 2 sources

ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability

ZDI discloses CVE-2026-64397, a CVSS 9.0 unauthenticated remote code execution race condition in Linux Kernel KSMBD.

ZDI-26-684 describes a race condition in the Linux Kernel KSMBD subsystem's Query Directory Request handling that allows unauthenticated remote attackers to execute arbitrary code. Only systems with KSMBD enabled are vulnerable. ZDI assigned a CVSS rating of 9.0 and CVE-2026-64397.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoAdvisory CVE-2026-64397

Notes on gotchas while migrating 35kb preprompts from Opus to self-hosted Ollama

Opinion piece urges migrating 35KB preprompts from Anthropic/OpenAI to self-hosted Ollama, citing session privacy risks and safety filters blocking security research.

The author documents gotchas migrating 35KB preprompts from Claude Opus to self-hosted Ollama, motivated by fears that frontier providers train on user sessions, citing the OpenAI Navier-Stokes controversy. The piece argues inference providers cannot audit their own retention or training pipelines and that only self-hosted hardware offers verifiable privacy. It also criticizes frontier safety filters for refusing vulnerability research tasks and calls for models that support exploitability testing in CI/CD pipelines.

Hacker News · AISep 14, 13:59 UTC · 1d agoAI industry HN 41↑ · 13 comments1

ZDI-26-701: Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI discloses Linux Kernel TLS protocol out-of-bounds read (CVE-2026-64046) allowing high-privileged local attackers to disclose sensitive information, CVSS 6.7.

ZDI-26-701 covers an out-of-bounds read information disclosure vulnerability in the Linux Kernel TLS protocol implementation, tracked as CVE-2026-64046 with a CVSS rating of 6.7. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-640461

ZDI-26-686: Linux Kernel nftables Race Condition Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-74565, a CVSS 7.8 nftables race condition letting local low-privileged attackers escalate privileges on Linux.

ZDI-26-686 describes a race condition in the Linux Kernel nftables subsystem that allows local attackers to escalate privileges. Exploitation requires the ability to execute low-privileged code on the target system. ZDI assigned a CVSS rating of 7.8 and CVE-2026-74565.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoAdvisory CVE-2026-74565

ZDI-26-569: Linux Kernel Net Scheduler True Link Equalizer Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-569, a CVSS 7.5 race condition local privilege escalation in the Linux kernel net scheduler true link equalizer.

The Zero Day Initiative disclosed a race condition in the Linux kernel's net scheduler true link equalizer component enabling local privilege escalation. Exploitation requires the attacker to first run high-privileged code on the target system. The advisory carries a CVSS rating of 7.5; no CVE id is listed in the disclosure text.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Advisory

ZDI-26-572: Linux Kernel XFRM Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-572, a CVSS 7.5 race condition local privilege escalation in the Linux kernel's XFRM subsystem.

The Zero Day Initiative disclosed a race condition in the Linux kernel's XFRM (transform) subsystem allowing local attackers to escalate privileges. Exploitation requires the attacker to first run high-privileged code on the affected system. The advisory carries a CVSS rating of 7.5; no CVE id is listed in the disclosure text.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Advisory

The GNU C Library security advisory update for 2026-09-10

glibc advisory GLIBC-SA-2026-0016: nscd can crash from a stack overflow when an untrusted DNS server returns oversized responses.

A new GNU C Library advisory (GLIBC-SA-2026-0016) describes a stack overflow in the nscd service caused by unbounded alloca use. glibc 2.3.4 and newer may crash when a malicious DNS server returns an oversized response, resulting in degraded DNS resolution. Exploitation requires nscd to be enabled and the system to be using an untrusted DNS server. The advisory was posted to oss-security by glibc maintainer Siddhesh Poyarekar.

oss-securityupdated Sep 14, 19:54 UTC · 1d agofirst Sep 11, 01:59 UTC · 5d agoVulnerability 2 sources2

ZDI-26-568: Linux Kernel Net Scheduler Race Condition Local Privilege Escalation Vulnerability

ZDI disclosed a race condition (CVSS 7.5) in the Linux kernel net scheduler enabling local privilege escalation; no CVE assigned in the advisory text.

ZDI advisory ZDI-26-568 describes a race condition in the Linux kernel's net scheduler that allows local attackers to escalate privileges on affected installations. Exploitation requires the attacker to first execute high-privileged code on the target system. ZDI assigned a CVSS rating of 7.5; no CVE identifier is listed in the advisory text.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability

ZDI-26-608: Linux Kernel KVM IOAPIC Use-After-Free Local Privilege Escalation Vulnerability

The Linux kernel KVM IOAPIC has a use-after-free (CVSS 8.2) allowing local privilege escalation, but exploitation requires high-privileged code execution first.

ZDI-26-608 describes a use-after-free vulnerability in the Linux kernel's KVM IOAPIC component, with a CVSS score of 8.2. An attacker must first obtain the ability to execute high-privileged code on the target system, which limits the practical impact of the privilege escalation. The advisory text does not list an assigned CVE identifier.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability

ZDI-26-571: Linux Kernel Net Scheduler Packet Classifier API Use-After-Free Local Privilege Escalation Vulnerability

ZDI disclosed a use-after-free local privilege escalation flaw (CVE-2026-64530) in the Linux Kernel net scheduler packet classifier API.

The Zero Day Initiative published ZDI-26-571 describing a use-after-free in the Linux Kernel net scheduler packet classifier API. Local attackers who can already execute low-privileged code can escalate privileges. ZDI assigned a CVSS score of 8.8 and the identifier CVE-2026-64530.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-645301

ZDI-26-676: Adobe Acrobat Reader DC DigSig Use-After-Free Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-81973, a use-after-free in Adobe Acrobat Reader DC digital signature handling that enables remote code execution.

Zero Day Initiative advisory ZDI-26-676 describes a use-after-free vulnerability in the DigSig (digital signature) feature of Adobe Acrobat Reader DC. Exploitation requires the target to open a malicious file or visit a malicious page, after which arbitrary code can execute. The flaw carries a CVSS score of 7.8. No in-the-wild exploitation is reported.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 19 sources CVE-2026-81973

ZDI-26-612: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-612, an unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-612, an out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Successful exploitation allows remote code execution on affected installations. User interaction is required, as the target must visit a malicious page or open a malicious file; ZDI assigned a CVSS score of 7.8 and lists the flaw as a 0day.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 BlogSep 4, 12:00 UTC · 12d agoThreat actor in the wild1

ZDI-26-680: Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses a Linux kernel crypto subsystem use-after-free (CVE-2026-31719, CVSS 8.8) letting local low-privileged attackers escalate to root.

ZDI advisory ZDI-26-680 covers a use-after-free vulnerability in the Linux kernel crypto subsystem, tracked as CVE-2026-31719 with a CVSS score of 8.8. A local attacker who can already execute low-privileged code can exploit it to escalate privileges on affected installations. The advisory does not report any exploitation in the wild.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-31719

ZDI-26-570: Linux Kernel IGMP Subsystem Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-570, a CVSS 7.5 race condition local privilege escalation in the Linux kernel's IGMP subsystem.

The Zero Day Initiative disclosed a race condition in the Linux kernel's IGMP subsystem that allows local attackers to escalate privileges. Exploitation requires the attacker to first execute high-privileged code on the target system. ZDI assigned a CVSS rating of 7.5 to this finding; no CVE id is stated in the advisory text.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Advisory

ZDI-26-693: Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability

ZDI-26-693: authenticated race condition in Linux kernel ksmbd share configuration allows remote code execution on ksmbd-enabled systems; CVSS 8.5.

ZDI advisory ZDI-26-693 discloses a race condition in the Linux kernel's ksmbd share configuration that allows remote attackers to execute arbitrary code on affected installations. Exploitation requires authentication, and only systems with ksmbd enabled are vulnerable. ZDI assigned a CVSS rating of 8.5; no CVE is listed in the advisory text.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability1

From Report to Patch, the OpenBSD Errata Processnew

A talk walks through the OpenBSD errata process, tracing how vulnerability reports become coordinated, tested, and published security patches.

A Lobsters-linked presentation describes the OpenBSD errata process, covering how a security report travels from initial disclosure to a published patch and errata notice. The linked page itself contains no additional technical detail beyond the title.

Lobsters · security11:20 UTC · 43m agoResearch

ZDI-26-611: (0Day) pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

ZDI published ZDI-26-611, an unpatched out-of-bounds read in pdfforge PDF Architect App Object enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-611, an out-of-bounds read vulnerability in the App Object component of pdfforge PDF Architect that can lead to remote code execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI rated the issue 7.8 on the CVSS scale and marks it as a 0day pending a vendor patch.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability

ZDI-26-696: Linux Kernel NTFS3 journal heap-based buffer overflow (CVE-2026-72196, CVSS 8.8) enables local arbitrary code execution.

ZDI advisory ZDI-26-696 describes a heap-based buffer overflow in the Linux Kernel NTFS3 journal handling, tracked as CVE-2026-72196 with a CVSS score of 8.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to execute arbitrary code. No in-the-wild exploitation is mentioned.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-721961

ZDI-26-552: OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI discloses CVE-2026-18293, a CVSS 7.8 out-of-bounds write in OriginLab Origin Viewer OPJ file parsing enabling remote code execution via malicious files.

ZDI advisory ZDI-26-552 describes an out-of-bounds write in OriginLab Origin Viewer's OPJ file parsing, tracked as CVE-2026-18293 with a CVSS score of 7.8. The flaw allows remote attackers to execute arbitrary code on affected installations. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-18293