Search: “secure-boot”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

USN-8727-1: Linux kernel (OEM) vulnerabilities

Ubuntu issued kernel security update USN-8727-1 for OEM kernels, fixing an Arm TLB invalidation flaw (CVE-2025-10263) allowing local privilege escalation.

Ubuntu released USN-8727-1, a security update for the OEM variant of the Linux kernel. It fixes CVE-2025-10263, in which certain Arm processors complete broadcast TLB invalidation before related memory writes are globally observed, potentially letting local attackers bypass memory protections or escalate privileges. The notice also corrects additional kernel flaws across ARM64, ARM32, RISC-V, S390 and other subsystems.

Ubuntu Security Notices·updated Sep 7, 09:12 UTC · 9d ago·first Sep 7, 09:02 UTC · 9d agoAdvisory 6 sourcesCVE-2025-10263

22

Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

Cisco disclosed a UEFI Secure Boot bypass in UCS servers and UCS-based appliances letting authenticated or physically present attackers execute unauthorized software.

Cisco published an advisory for a vulnerability in the UEFI Shell implementation of UCS servers and UCS-based appliances. Memory write commands remain available in the UEFI Shell while Secure Boot is enabled, allowing an attacker to modify UEFI memory and bypass validation checks to run unauthorized software. Exploitation requires either valid credentials for a user or admin account, or unauthenticated physical access to select the UEFI Shell boot option at boot time. The issue affects firmware boot integrity rather than the running operating system.

Cisco Security Advisories·Sep 8, 16:00 UTC · 7d agoAdvisory

20

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.

CERT/CC's VU#718077, reported by Eclypsium researcher Stas Lyakhov, describes how a UEFI Shell embedded in SPI flash can be abused by attackers who can modify UEFI boot configuration, creating multiple boot entries that bypass controls preventing the Shell from launching under Secure Boot. The Shell's dmem and mm commands allow arbitrary physical memory read/write, letting attackers overwrite Secure Boot values and execute unauthorized pre-boot code that can persist across reboots and OS reinstalls while degrading EDR effectiveness. AMI confirmed its Aptio UEFI BDS module is affected (CVE-2026-33197), and Cisco published an advisory for a variation affecting UCS Servers and UCS-based appliances (CVE-2026-20293). Firmware patches are being rolled out through OEM and IBV BIOS build pipelines.

CERT/CC Vulnerability Notes·Sep 8, 15:05 UTC · 7d agoVulnerabilityCVE-2026-20293CVE-2026-33197CVE-2026-6485

55

GNU GRUB 2.14: serial-MMIO lockdown bypass in Canonical-signed gcdx64.efi

Canonical-signed GRUB2 serial command accepts arbitrary MMIO addresses, letting local attackers with grub.cfg control bypass Secure Boot lockdown.

A vulnerability in Canonical's grub-efi-amd64-signed (gcdx64.efi, GRUB 2.14) exposes a serial command that accepts a caller-supplied 64-bit MMIO base address. The lockdown path does not restrict this command even when lockdown=y under UEFI Secure Boot, and the serial implementation does not validate that the requested register span belongs to a real UART rather than ordinary RAM. A local attacker with control of GRUB's boot configuration can abuse this to bypass the Secure Boot lockdown.

oss-security·Sep 13, 13:59 UTC · 2d agoVulnerability2

55

TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage

Researchers present TPMSpy, a platform-agnostic method validating TPM Measured Boot via low-level tracing, finding inconsistent Linux systemd measurements that break remote attestation and LUKS decryption.

An arXiv paper (2609.05011) introduces TPMSpy, a method that analyzes virtualized system–TPM interactions to independently reconstruct and validate TPM Event Logs without relying on the quoting mechanism, applicable to open and closed systems and demonstrated on Linux and Windows. A longitudinal analysis of Linux systems running systemd versions 245–258 (2020–2025) found wide divergence in Measured Boot usage, undocumented behavioral changes, and no common usage pattern. The authors report inconsistent measurement of user-space systemd services, which prevents reliable remote attestation and LUKS disk decryption on affected systems.

arXiv cs.CR·Sep 4, 11:23 UTC · 12d agoResearch

40

USN-8514-2: OpenSSH vulnerabilitynew

Ubuntu backports an OpenSSH fix to older LTS releases for an scp flaw enabling setuid file placement and privilege escalation.

USN-8514-2 extends the USN-8514-1 OpenSSH fix to Ubuntu 14.04 LTS, 18.04 LTS, and 20.04 LTS. The flaw stems from incorrect file permission handling when downloading files as root using the legacy scp protocol without the preserve-mode option. An attacker could exploit this to install setuid or setgid files on the system, potentially leading to privilege escalation.

Ubuntu Security Notices·08:46 UTC · 3h agoVulnerability

35

Trusting-Trust Attack against an Entire Linux Distribution (via the strip utility)

ArXiv paper shows the trusting-trust compiler backdoor technique can compromise an entire Linux distribution via the strip utility.

The paper (arXiv 2607.24888) demonstrates that Ken Thompson's trusting-trust attack, long viewed as a compiler-specific threat, can backdoor an entire Linux distribution by targeting the strip utility. A compromised tool reproduces its backdoor in subsequent rebuilds of itself, generalizing the attack surface beyond compilers. The finding has supply-chain implications for build reproducibility and distribution trust, though it is a research result with no observed real-world exploitation.

Lobsters · security·Sep 5, 10:58 UTC · 11d agoResearch

48

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.

Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.

CSO Online·Sep 10, 11:51 UTC · 6d agoMalware in the wildCVE-2025-53521

72

MacOS 27 - First Boot, (Tue, Sep 15th)

SANS ISC documents the expected network traffic macOS 27 'Golden Gate' generates on first boot to help defenders baseline their networks.

Johannes Ullrich of SANS Internet Storm Center captured roughly 300 packets from a macOS 27 'Golden Gate' system before user login, covering DHCP, IPv6 duplicate address discovery, DNS, and TCP behavior. macOS 27 resolves hostnames like albert.apple.com (device activation, certificate-pinned), push messaging hosts, and ipv4only.arpa for NAT64 networks. The OS still uses a TCP window scale of 6, ECN, and random timestamps, with only four TCP connections observed during boot. The analysis provides a reference baseline for security teams monitoring Apple endpoints.

SANS Internet Storm Center·Sep 15, 15:23 UTC · 21h agoResearch

18

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security News·Sep 15, 13:52 UTC · 22h agoVulnerability

65

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security News·Sep 14, 03:10 UTC · 2d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2025-25249+3 CVEs3

80

Any user process can escalate to root

A disclosed local privilege escalation flaw allows any user process to escalate to root on the affected system.

A Lobsters-linked security write-up describes a vulnerability in which any user process can escalate its privileges to root. The feed text provides no product name, CVE identifier, CVSS score, or exploitation details, limiting available detail. Local privilege escalation flaws are commonly chained with other issues for full system compromise, so defenders should review the full write-up for affected versions and patches.

Lobsters · security·Aug 31, 13:46 UTC · 15d agoVulnerability

15

Omarchy: Any User Process Can Escalate to Root

A security write-up details how any user process on the Omarchy Linux setup can escalate privileges to root.

A post on 0xcc.io describes a local privilege escalation issue in Omarchy, the Arch-based Linux configuration, where any user process can escalate to root. The disclosure appears to describe a design-level weakness in the distribution's security model. No CVE identifier is mentioned in the available text.

Lobsters · security·Aug 30, 18:11 UTC · 16d agoVulnerability

38

ZDI-26-680: Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses a Linux kernel crypto subsystem use-after-free (CVE-2026-31719, CVSS 8.8) letting local low-privileged attackers escalate to root.

ZDI advisory ZDI-26-680 covers a use-after-free vulnerability in the Linux kernel crypto subsystem, tracked as CVE-2026-31719 with a CVSS score of 8.8. A local attacker who can already execute low-privileged code can exploit it to escalate privileges on affected installations. The advisory does not report any exploitation in the wild.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-31719

45

Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root

JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.

JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.

Cyber Security News·updated 11:29 UTC · 1h ago·first 09:24 UTC · 3h agoVulnerability 2 sourcesCVE-2026-90894

62

USN-8752-1: Konsole vulnerability

Ubuntu patches Konsole URL-handling flaw that could let a remote attacker execute arbitrary code under specific circumstances.

USN-8752-1 fixes a Konsole vulnerability where certain URLs are incorrectly handled under specific circumstances. A remote attacker could possibly exploit this to execute arbitrary code on a victim's system. Ubuntu released updated packages for affected releases.

Ubuntu Security Notices·Sep 14, 11:52 UTC · 2d agoAdvisory

30

Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages

Debian 13.7 'trixie' point release bundles 92 security advisories and 106 package updates, including kernel, glibc, u-boot and qemu fixes.

Debian shipped version 13.7 of 'trixie', folding in 92 previously published security advisories and corrections to 106 source packages, including six Linux kernel advisories (DSA-6381, DSA-6393, DSA-6405, DSA-6415, DSA-6466, DSA-6477). glibc fixes a buffer overflow (CVE-2026-5928) and buffer underflow (CVE-2026-5450), with 17 packages rebuilt against the updated library; qemu carries 25 CVEs including a secure boot bypass (CVE-2026-16288), imagemagick 24, wolfssl 15 and perl 13. Boot-chain fixes include a u-boot FIT image verification bypass (CVE-2026-46728), a BOOTP/DHCP buffer overread (CVE-2024-42040), and corrected intermediate certificate verification in sbsigntool. The installer was rebuilt with kernel ABI 6.12.107+deb13, and existing systems receive the fixes through normal package mirror updates.

Help Net Security·Sep 14, 07:40 UTC · 2d agoAdvisoryCVE-2026-5928CVE-2026-5450CVE-2026-34873+17 CVEs

30

Product showcase: mSecure makes one vault do more than remember passwords

Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.

mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.

Help Net Security·Sep 15, 05:30 UTC · 1d agoTools1

12

Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more

oss-security thread discusses newly disclosed Linux kernel local privilege escalations, including ZcopyReaper (CVE-2026-43502) and about 20 more flaws.

An oss-security mailing list thread discusses newly disclosed Linux kernel local privilege escalation (LPE) issues, headlined by ZcopyReaper (CVE-2026-43502) along with roughly 20 more. Discussants ask whether the many reports could be summarized and note that locking kernel module loading after boot has repeatedly proven an effective mitigation. The visible discussion does not state whether any of the flaws are exploited in the wild or give specific patch guidance beyond the individual reports.

oss-security·Sep 8, 17:02 UTC · 7d agoVulnerabilityCVE-2026-43502

45

USN-8745-1: KissFFT vulnerabilities

Ubuntu released USN-8745-1 fixing two KissFFT flaws that could cause denial of service or arbitrary code execution.

Ubuntu security notice USN-8745-1 fixes CVE-2025-34297, where large Fourier transform sizes on 32-bit architectures are mishandled, and CVE-2026-41445, involving multidimensional Fourier transform sizes. Either issue could crash KissFFT, resulting in denial of service or arbitrary code execution. Users should apply the updated packages.

Ubuntu Security Notices·updated Sep 11, 12:03 UTC · 5d ago·first Sep 10, 15:36 UTC · 5d agoAdvisory 13 sourcesCVE-2025-34297CVE-2026-41445

13