Siemens SIMATIC S7-1500 Signal Handler Race Condition (CVE-2025-4598)

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non- SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the origin...

Siemens SIMATIC S7-1500 Signal Handler Race Condition (CVE-2024-6387)

A security regression CVE-2006-5051 was discovered in OpenSSH's server sshd. There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. This plugin...

Siemens SIMATIC S7-1500 Signal Handler Race Condition (CVE-2024-6409)

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server sshd. If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not...

CVE-2025-40113 remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E The ADSP firmware on X1E has separate firmware binaries for the main firmware and the DTB. The same applies for the "lite" firmware loaded by the boot firmware. When preparing ...

Injecting Falsehoods: Adversarial Man-In-The-Middle Attacks Undermining Factual Recall in LLMs

LLMs are now an integral part of information retrieval. As such, their role as question answering chatbots raises significant concerns due to their shown vulnerability to adversarial man-in-the-middle MitM attacks. Here, we propose the first principled attack evaluation on LLM factual memory unde...

perf: Fix hang while freeing sigtrap event

...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990431)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990431 advisory. In the Linux kernel, the following vulnerability has been resolved: vsock: remove vsock from connected table when connect is interrupted by a signal vsockconnect...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990240)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990240 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Skip task with pid=1 in sendsignalcommon The following kernel panic can be triggered when a...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989601)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989601 advisory. In the Linux kernel, the following vulnerability has been resolved: arm64: compat: Do not treat syscall number as ESRELx for a bad syscall If a compat process tries ...

CVE-2025-47368 Buffer Over-read in DSP Service

Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing...

CVE-2025-12357

By manipulating the Signal Level Attenuation Characterization SLAC protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. This vulnerability may be exploitable wirelessly, within close...

CLSA-2025-1762179793 glib2: Fix of CVE-2024-34397

CVE-2024-34397: fix GDBus signal subscriptions from unicast spoofing...

The Evolution of SOC Operations: How Continuous Exposure Management Transforms Security Operations

Security Operations Centers SOC today are overwhelmed. Analysts handle thousands of alerts every day, spending much time chasing false positives and adjusting detection rules reactively. SOCs often lack the environmental context and relevant threat intelligence needed to quickly verify which aler...

EUVD-2025-37371

By manipulating the Signal Level Attenuation Characterization SLAC protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. This vulnerability may be exploitable wirelessly, within close...

CVE-2025-12357

By manipulating the Signal Level Attenuation Characterization SLAC protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. This vulnerability may be exploitable wirelessly, within close...

CVE-2025-12357 International Standards Organization ISO 15118-2 Improper Restriction of Communication Channel to Intended Endpoints

By manipulating the Signal Level Attenuation Characterization SLAC protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. This vulnerability may be exploitable wirelessly, within close...

CVE-2025-12357 International Standards Organization ISO 15118-2 Improper Restriction of Communication Channel to Intended Endpoints

By manipulating the Signal Level Attenuation Characterization SLAC protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. This vulnerability may be exploitable wirelessly, within close...

CVE-2025-12357

CVE-2025-12357 concerns the SLAC protocol used in ISO 15118-2-compliant EV charging systems. The Red Hat/NVD/EUVD entries describe that an attacker can manipulate SLAC measurements to perform a man-in-the-middle between an electric vehicle and the charging station, potentially enabling wireless M...

PT-2025-44639

Name of the Vulnerable Software and Affected Versions ISO 15118-2 compliant EV charging systems affected versions not specified Description A flaw exists in the Signal Level Attenuation Characterization SLAC protocol used in electric vehicle EV charging systems that adhere to the ISO 15118-2...

Signal’s Post-Quantum Cryptographic Implementation

Signal has just rolled out its quantum-safe cryptographic implementation. Ars Technica has a really good article with details: Ultimately, the architects settled on a creative solution. Rather than bolt KEM onto the existing double ratchet, they allowed it to remain more or less the same as it ha...