An email address on GNU Savannah opened a path to code on the server
A flaw in Savane allowed any registered user to execute code on the GNU Savannah server and from there reach superuser rights. The FSF closed 26 vulnerabilities.
Read the newsXORit / JOURNAL
Journal▸
What's new in IT, AI, and science.
Briefly about what's interesting.
Anthropic: Claude identified vulnerability chains in popular systems
Anthropic’s internal research model helped find vulnerabilities in Chrome, Safari, Android, Windows, and Linux. The company said developers of the affected products were informed and released fixes.
Read the news
A bot checked a fake server with four NVIDIA H100s 38 times
In its first 12.5 hours, a Cowrie SSH honeypot recorded 1,846 connections from 126 addresses. One bot returned 38 times.
Read the news
VirusTotal: Some Malicious AI Skills Hide Instructions
Of 6,637 malicious skills for AI agents, 90 concealed instructions using blank lines, HTML comments, or invisible Unicode characters.
Read the news
A RingRTC vulnerability could have prevented Signal calls from ending
In RingRTC versions before 2.72.0, saturating the call finite-state machine queue could have prevented a call from ending on the user’s device.
Read the news
Qwen3-Coder is more often vulnerable in tests for a US contractor
In a Hirundo study, 70% of applications for a US defense contractor and 59% for a Chinese contractor were found vulnerable.
Read the news
Man suspected of sending phishing emails from Kobe hotel
Police allege that in May 2025, the man and others sent emails from a hotel room posing as credit card companies.
Read the news
GitLab Reports Critical Vulnerability with a CVSS Score of 10
CVE-2026-110264 could have allowed arbitrary code execution on a GitLab server without authentication.
Read the news
OpenAI releases a PHP version checker for php2shell
The tool compares the PHP version from a site’s HTTP headers or the `php -v` command with the threshold for the specified branch.
Read the news
PHP fixes two critical vulnerabilities enabling remote code execution
PHP releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address vulnerabilities that could allow unauthenticated remote code execution.
Read the news
Weak Keys Found in Eight eMudhra Certificates
Researcher Scott Helme recovered the private keys of eight eMudhra intermediate certificates in less than a second: each contained just one non-zero byte.
Read the news
Vulnerabilities found in Android data-transfer apps
Researchers from TU Graz and A-SIT found vulnerabilities in apps from seven Android manufacturers. An attacker nearby could intercept or modify data being transferred.
Read the news