Security Saturday — the vulnerabilities, advisories, and incidents from the past week worth knowing about.

Security

  • Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git (The Hacker News)
    Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. An ordinary authenticated user triggers it by committing tw
  • Friday Squid Blogging: Illex Squid Catch in the Falklands (Schneier on Security)
    Lower catch this year . As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
  • BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery (The Hacker News)
    The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineer
  • Why AI Needs a “Genie Coefficient” (Schneier on Security)
    This essay was written with Barath Raghavan, and originally appeared in IEEE Spectrum . Major benchmarks measure what AI can do. None measure whether it does what you mean: the distance between what you ask an AI to do and the unspoken assu
  • LG to Ban Residential Proxies from Smart TV Apps (KrebsOnSecurity)
    The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on residential proxy node. The move comes less than a month after researchers found th

Enjoying these roundups?
Subscribe for daily follow-ups on AI news, trending open-source tools, and Security Saturdays.
Subscribe free →