Iran-Linked Hackers Hit Israeli Sectors with New MuddyViper Backdoor in Targeted Attacks

Israeli entities spanning academia, engineering, local government, manufacturing, technology, transportation, and utilities sectors have emerged as the target of a new set of attacks undertaken by Iranian nation-state actors that have delivered a previously undocumented backdoor called MuddyViper...

This Week in Spring - December 2nd, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring. By mistake, I inadvertently published older content in this installment, then tried to fix it and ended up re-publishing the same content. And, what's worse, I somehow ended up deleting the draft I had written for this...

Fedora 43 : source-to-image (2025-dc3c993169)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-dc3c993169 advisory. Update to 1.5.1, migrate to Go Vendor Tools Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Google Chrome 安全漏洞

Google Chrome is a web browser developed by Google Inc. Google Chrome suffers from a mal-implementation vulnerability that stems from a DevTools mal-implementation, which can be exploited by an attacker to sandbox escape by convincing a user to install a malicious extension, possibly using a...

Fedora 42 : source-to-image (2025-96f340d7a0)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-96f340d7a0 advisory. Update to 1.5.1, migrate to Go Vendor Tools Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

EUVD-2025-199882

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib...

EUVD-2025-200056

Malicious code in kubernetes-controller-tools npm...

MAL-2025-191513 Malicious code in kubernetes-controller-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42961dff6a9f6fd9e6dce1e6906ba8e15d64622a3856a65dc61ec9fd6974252b The package kubernetes-controller-tools was found to contain malicious code...

Malicious code in kubernetes-controller-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42961dff6a9f6fd9e6dce1e6906ba8e15d64622a3856a65dc61ec9fd6974252b The package kubernetes-controller-tools was found to contain malicious code...

Malicious Package

Overview tailwind-grid-tools is a malicious package. This package contains malicious code associated with a social engineering campaign called "Contagious Interview." The attackers target developers through fake job interviews or coding test assignments that require the installation of this...

[SECURITY] Fedora 41 Update: rnp-0.18.1-1.fc41

RNP is a set of OpenPGP RFC4880 tools...

[SECURITY] Fedora 42 Update: rnp-0.18.1-1.fc42

RNP is a set of OpenPGP RFC4880 tools...

[SECURITY] Fedora 43 Update: rnp-0.18.1-1.fc43

RNP is a set of OpenPGP RFC4880 tools...

RLSA-2025:15904 Important: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: podman: Podman kube play command may overwrite host files CVE-2025-9566 For more details about the security issues, including the impact, a CVSS score, acknowledgments...

container-tools:rhel8 security update

An update is available for module.crun, fuse-overlayfs, module.slirp4netns, python-podman, module.runc, container-selinux, module.podman, module.udica, module.aardvark-dns, module.fuse-overlayfs, cockpit-podman, aardvark-dns, module.conmon, containers-common, libslirp, criu,...

RLSA-2023:2802 Moderate: container-tools:4.0 security and bug fix update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang: go/parser: stack exhaustion in all Parse functions CVE-2022-1962 golang:...

RLSA-2025:21232 Important: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: runc: container escape via 'masked path' abuse due to mount race conditions CVE-2025-31133 runc: container escape with malicious config due to /dev/console mount and...

RLSA-2023:2758 Moderate: container-tools:rhel8 security, bug fix, and enhancement update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang: go/parser: stack exhaustion in all Parse functions CVE-2022-1962 golang:...

container-tools:4.0 security and bug fix update

An update is available for cockpit-podman, module.libslirp, module.cockpit-podman, libslirp, criu, module.oci-seccomp-bpf-hook, oci-seccomp-bpf-hook, module.criu. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RLSA-2023:6938 Moderate: container-tools:4.0 security and bug fix update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents CVE-2022-3064 golang: html/template: improper handling of JavaScri...