A week in security (September 22 – September 28)

Last week on Malwarebytes Labs: Hackers threaten parents: Get nursery to pay ransom or we leak your child’s data Google and Flo to pay $56 million after misusing users’ health data Neon App pays users to record their phone calls, sells data for AI training updated New SVG-based phishing campaign ...

Ensure That GPG Verification Is Configured for the Yum Repositories

Software packages may be tampered with by attackers during network transmission or local storage. If the integrity verification is not performed on the software packages, software tampered with by attackers may be installed. As a result, the server or even the entire network cluster is attacked. ...

SUSE CVE-2022-50333

In the Linux kernel, the following vulnerability has been resolved: fs: jfs: fix shift-out-of-bounds in dbDiscardAG This should be applied to most URSAN bugs found recently by syzbot, by guarding the dbMount. As syzbot feeding rubbish into the bmap descriptor...

GHSA-2QGR-GFVJ-QPCR Dragonfly incorrectly handles a task structure’s usedTrac field

Impact The processPieceFromSource method figure 4.1 is part of a task processing mechanism. The method writes pieces of data to storage, updating a Task structure along the way. The method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to...

CVE-2023-53311 nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of nilfsroot in dirtying inodes via iput During unmount process of nilfs2, nothing holds nilfsroot structure after nilfs2 detaches its writer in nilfsdetachlogwriter. Previously, nilfsevictinode could...

EulerOS Virtualization 2.13.1 : gnupg2 (EulerOS-SA-2025-2162)

According to the versions of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that...

SUSE CVE-2023-53244

In the Linux kernel, the following vulnerability has been resolved: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish When the driver calls tw68riscbuffer to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer buf-cpu. Later when we free t...

UBUNTU-CVE-2022-50333

In the Linux kernel, the following vulnerability has been resolved: fs: jfs: fix shift-out-of-bounds in dbDiscardAG This should be applied to most URSAN bugs found recently by syzbot, by guarding the dbMount. As syzbot feeding rubbish into the bmap descriptor...

PT-2025-37635

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A shift-out-of-bounds issue was identified and resolved in the JFS filesystem within the Linux kernel, specifically within the dbDiscardAG function. This issue stemmed from syzbot...

Ninja

This is an open-source C2 server created for stealth red team operations, specifically designed to bypass AMSI Advanced Threat and Malware Protection and other security measures. The server is written in PowerShell and utilizes various modules to achieve its goals. The server includes several...

The vulnerability of GnuPG’s information encryption and digital signatures programs lies in its insufficient checking of unusual or exceptional states, allowing attackers to trigger a service failure.

The vulnerability of GnuPG’s information encryption and digital signatures lies in the insufficient testing of unusual or exceptional states. Exploiting this vulnerability could allow a perpetrator to cause service failures...

PT-2025-42777

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc3 Description A flaw exists in the Linux kernel related to out-of-bounds access to shadow memory within the Kernel Memory Sanitizer KMSAN. Specifically, when running sha224 kunit on a KMSAN-enabled kerne...

Pre-approved GLP-1 prescription scam could be bad for your health

A co-worker received a text which is, unfortunately, becoming more common. The text pretends to come from a doctor and states a weight-loss medication prescription has been approved. “Good morning. This is Dr. Santos. I pre-approved your GLP1 prescription. You may start treatment as of 09/04...

Linux Distros Unpatched Vulnerability : CVE-2015-3027

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Clang in LLVM, as used in Apple Xcode before 6.3, performs incorrect register allocation in a way that triggers stack storage for stack cookie pointers, which...

Huawei EulerOS: Security Advisory for gnupg2 (EulerOS-SA-2025-2095)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP12 : gnupg2 (EulerOS-SA-2025-2037)

According to the versions of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect...

Security update for microcode_ctl

This update for microcodectl fixes the following issues: Intel CPU Microcode was updated to the 20250812 release bsc1248438 CVE-2025-20109: Improper Isolation or Compartmentalization in the stream cache mechanism for some Intel Processors may allow an authenticated user to potentially enable...

UBUNTU-CVE-2025-39707

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpudmcapabilities HUBBUB structure is not initialized on DCE hardware, so check if it is NULL to avoid null dereference while accessing amdgpudmcapabilities file in debugfs...

U.S. Dept Of Defense: Exposed wp-config.php file in ███ National Guard website

A WordPress configuration file containing sensitive information, such as the MySQL database password, was found exposed on a website of the National Guard. The file was accessible at a public endpoint...

Linux Distros Unpatched Vulnerability : CVE-2024-48869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper restriction of software interfaces to hardware features for some IntelR XeonR 6 processor with E-cores when using IntelR Trust Domain Extensions IntelR...