{"id":37011,"date":"2026-11-08T11:42:44","date_gmt":"2026-11-08T19:42:44","guid":{"rendered":"https:\/\/www.podfeet.com\/blog\/?p=37011"},"modified":"2026-11-08T11:42:44","modified_gmt":"2026-11-08T19:42:44","slug":"sb-2026-11-08","status":"publish","type":"post","link":"https:\/\/www.podfeet.com\/blog\/2026\/11\/sb-2026-11-08\/","title":{"rendered":"Security Bits \u2014 8 November 2026"},"content":{"rendered":"<h2>Feedback &amp; Followups<\/h2>\n<aside class=\"small-aside\">Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time.<\/aside>\n<ul>\n<li>Unsurprisingly: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild\/\">PHP2Shell security flaws now sucessfully exploited in the wild \u2014 www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>\u26a0\ufe0f <strong>Windows PHP Users:<\/strong> <a href=\"https:\/\/thehackernews.com\/2026\/10\/php-issues-second-windows-security.html\">PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Some good news on the residential proxy front: <a href=\"https:\/\/krebsonsecurity.com\/2026\/11\/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies\/\">Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies \u2014 krebsonsecurity.com\/\u2026<\/a>\n<ul>\n<li><strong>Related:<\/strong> some evidence this dangerous malware can sneak in anywhere without good cybersecurity practices: <a href=\"https:\/\/cyberinsider.com\/white-house-network-residential-proxy-traffic\/\">Residential proxy services found routing traffic through White House network \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>\u2757 Action Alerts<\/h2>\n<aside class=\"small-aside\">Calls to action; if any stories in this section are relevant to you, there is some action you should take.<\/aside>\n<ul>\n<li>Apple patch all their OSes \u2014 <a href=\"https:\/\/isc.sans.edu\/diary\/rss\/33458\">isc.sans.edu\/\u2026<\/a>\n<ul>\n<li>\uf8ffOS 27.2 includes a patche for a zero-day bug in CoreGraphics<\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/apple\/apple-backports-coregraphics-zero-day-patches-to-older-iphones\/\">Apple backports CoreGraphics zero-day patches to older iPhones \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li>A good reminder of why we need to patch promptly: <a href=\"https:\/\/thehackernews.com\/2026\/11\/hackers-exploit-patched-apple-flaw-to.html\">Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/android-november-2026-security-update-sms-of-death\/\">Android November update fixes critical flaws and \u2018SMS of Death\u2019 bug \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/11\/microsoft-paint-rce-fix-now-available.html\">Microsoft Paint RCE Fix Now Available, but Windows Update Won&#8217;t Deliver It \u2014 thehackernews.com\/\u2026<\/a>\n<ul>\n<li>Handled via the Windows Store<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/10\/telegram-android-flaw-lets-attackers.html\">Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls \u2014 thehackernews.com\/\u2026<\/a> (Patches released last month, so be sure to stay patched!)<\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/10\/tailscale-patches-ssh-flaws-that-could.html\">Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<li>\u26a0\ufe0f <strong>Linux Users:<\/strong>\n<ul>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers\/\">Critical Linux kernel flaw allows remote root attacks on MPTCP servers \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li>Affects the major RedHat-based distributions and Ubuntu, among others<\/li>\n<li>There&#8217;s a lot of conflicting information about how exactly this vulnerability can be triggered, so best to assume the worst, and be sure your Linux servers are fully patched!<\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/11\/debian-and-ubuntu-apt-flaw-lets-mitm.html\">Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts\/\">OpenSSH flaw lets attackers log into password-disabled Linux accounts \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li>Only affects distros that have replaced glibc with musl<\/li>\n<li>The only major regular affected is Alpine Linux<\/li>\n<li>OpenWrt is also affected<\/li>\n<\/ul>\n<\/li>\n<li>\u26a0\ufe0f <strong>PC Gamers:<\/strong> <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware\/\">NIKKE PC game launcher hacked to spread remote access, data-stealing malware \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<\/ul>\n<h2>Worthy Warnings<\/h2>\n<aside class=\"small-aside\">Potentially relevant warnings from government organisations, public interest groups, or the security community.<\/aside>\n<ul>\n<li>\u26a0\ufe0f <strong>Android Users:<\/strong> <a href=\"https:\/\/cyberinsider.com\/ghostmap-android-crash-loop-vulnerability\/\">Unfixed GhostMap Android flaw can trap phones in crash loops \u2014 cyberinsider.com\/\u2026<\/a>\n<ul>\n<li>Installing a malicious app can put an Android phone in an un-recoverable boot loop<\/li>\n<li>Only fix is a factory reset, losing all data not backed up to the cloud<\/li>\n<li>Google have refused to fix, so the researchers have reluctantly released the details so people are aware of the danger<\/li>\n<li>Be extra careful installing apps, especially by side-loading!<\/li>\n<\/ul>\n<\/li>\n<li>\u26a0\ufe0f <strong>Claude Code Users:<\/strong> <a href=\"https:\/\/thehackernews.com\/2026\/11\/claude-codes-dont-ask-again-file.html\">Claude Code&#8217;s Don&#8217;t Ask Again File \u2014 thehackernews.com\/\u2026<\/a>\n<ul>\n<li>Be sure never to publish your <code>.claude\/settings.local.json<\/code> to a public repo!<\/li>\n<li>Or, better yet, don&#8217;t give Claude your secrets, instead use an appropriate tool to give it <em>access<\/em> to your secrets instead.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Reminder:<\/strong> only install browser plugins that have earned your trust, and only as many as you need: <a href=\"https:\/\/cyberinsider.com\/microsoft-sleeperwidget-extensions\/\">Microsoft finds 250 browser extensions linked to tracking campaign \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<li>Be sure your NAS is patched, especially if it&#8217;s exposed to the internet:\n<ul>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks\/\">Synology warns of C3RB3R ransomware attacks targeting NAS devices \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/qnap-plex2shell-attacks-nas-devices\/\">QNAP warns of ongoing Plex2Shell attacks on NAS devices \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Defenders, be careful where you get your tools from: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/fake-security-tools-on-github-push-backdoors-and-infostealers\/\">Fake security tools on GitHub push backdoors and infostealers \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<\/ul>\n<h2>Notable News<\/h2>\n<ul>\n<li><a href=\"https:\/\/appleinsider.com\/articles\/26\/11\/03\/if-schools-turn-off-googles-ai-search-dies-with-it\">If schools turn off Google&#8217;s AI, Search dies with it \u2014 appleinsider.com\/\u2026<\/a>\n<ul>\n<li><strong>Opinion from Bart:<\/strong> a move worthy of Meta \ud83d\ude41<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/appleinsider.com\/articles\/26\/11\/04\/iclouds-anyone-with-the-link-option-will-trigger-apple-content-checks\">iCloud&#8217;s &#8216;Anyone with the Link&#8217; option will trigger Apple content checks \u2014 appleinsider.com\/\u2026<\/a>\n<ul>\n<li>Does not break end-to-end encryption \u2014 publicly shared files need to be saved un-encrypted by definition.<\/li>\n<li>Does no breach user privacy \u2014 the users publicly share these files!<\/li>\n<li><strong>Opinion:<\/strong> this is a very clever way to fight abuses of Apple&#8217;s services without sacrificing user privacy or security.<\/li>\n<\/ul>\n<\/li>\n<li>We&#8217;ve entered a new era in the AI cybersecurity threat \u2014 open source tools combined with open-weight models are now powerful enough to do real-world damage from a single powerful workstation: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/runaway-ai-hacking-agent-behind-workos-breach-after-escaping-sandbox\/\">Runaway AI hacking agent behind WorkOS breach after escaping sandbox \u2014 www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>Single researcher running the open source ARTEX harness powered by whatever LLM he had installed<\/li>\n<\/ul>\n<\/li>\n<li>\ud83c\uddfa\ud83c\uddf8 <a href=\"https:\/\/cyberinsider.com\/nist-post-quantum-cryptography-roadmap\/\">NIST publishes post-quantum migration roadmap with 2030 deadline \u2014 cyberinsider.com\/\u2026<\/a>\n<ul>\n<li>Many nations outside the US also follow the NIST standards for their public institutions<\/li>\n<\/ul>\n<\/li>\n<li>Some small changes that make us all a little safer\n<ul>\n<li><a href=\"https:\/\/cyberinsider.com\/mozilla-firefox-ai-assisted-security-fixes-patch-gap\/\">Mozilla plans Firefox patch changes to disrupt AI-assisted attacks \u2014 cyberinsider.com\/\u2026<\/a> (Details are quite nerdy, but very clever!)<\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/ipvanish-independent-no-logs-audit-2026\/\">IPVanish passes independent audit confirming its no-logs policy \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/truffle-security-launches-program-to-revoke-14-million-live-secrets\/\">Nearly 1.5 million exposed secrets targeted in new revocation program \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li>The researchers initially tried contacting affected developers directly, but after 6 months 80% remained un-revoked<\/li>\n<li>New approach is to work with the sites that issued the secrets to revoke them<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Interesting Insights<\/h2>\n<aside class=\"small-aside\">High-quality opinion and editorial content recommended by Bart.<\/aside>\n<ul>\n<li>The Screenshots in this ClickFix attack report give a good insight into how people can fall for this very popular attack \u2014 <a href=\"https:\/\/isc.sans.edu\/diary\/rss\/33466\">isc.sans.edu\/\u2026<\/a><\/li>\n<\/ul>\n<h2>Palate Cleansers<\/h2>\n<aside class=\"small-aside\">Anything upbeat and nerdy Bart and\/or Allison think you might enjoy.<\/aside>\n<h3>From Allison<\/h3>\n<p>Brett Halle started his career selling the Apple II as a student and joined Apple in 1991. He led the Core OS team behind Mac OS X after the acquisition of NeXT, ran Final Cut, and was instrumental in moving the Mac from PowerPC to Intel. \u00a0He also lost his vision completely in 2015. He was an avid fan of the Double Tap podcast (my favorite blind and low vision podcast, hosted by Steven Scott and Shaun Price). In July 2024, they had a fantastic two-part interview with Brett where he talks about his career and the huge contributions he made to Apple.<\/p>\n<p>Sadly, Brett passed away on October 1st. Steven and Sean reran this amazing interview on October 10 as a tribute to him. I highly recommend listening if you want to learn more about the transition to NeXT and more. Below are links to the video version (which is audio only). Or you can subscribe in your podcatcher of choice to Double Tap.\u00a0<\/p>\n<ul>\n<li>\ud83c\udfa6 <a href=\"https:\/\/www.youtube.com\/watch?v=GTx1BS0-Sds&#038;t=21s\">Part 1: Remembering Brett Halle: The Apple Engineer Who Helped Build Mac OS X YouTube.com\/&#8230;<\/a>  <\/li>\n<li>\ud83c\udfa6 <a href=\"https:\/\/www.youtube.com\/watch?v=O_9NcNUB-nw\">Part 2: Too Busy to Be Blind: An Apple Engineer\u2019s Second Act \u2014 YouTube.com\/&#8230;<\/a><\/li>\n<\/ul>\n<h3>From Bart<\/h3>\n<ul>\n<li><a href=\"https:\/\/xkcd.com\/3272\">XKCD 3272: Time Change<\/a><br \/>\n<img decoding=\"async\" src=\"https:\/\/imgs.xkcd.com\/comics\/time_change.png\" alt=\"A speaker at a podium saying we all hate spring forward but love fall back, so we should only abolish the spring change, the audience point out some obvious flaws!\" title=\"All discussions of daylight saving time policy are doomed by a mix of contradictory, inconsistent, and impossible preferences, which is why I think the only thing we can really hope to do is to make it worse.\" \/><\/li>\n<li>\u26a0\ufe0f <strong>Not Safe for Work:<\/strong> ever wondered what words the iOS keyboard won&#8217;t type for you? Any why? This site has the answers! \u2014 <a href=\"https:\/\/swipeblocked.com\/labels#V\">swipeblocked.com\/\u2026<\/a><\/li>\n<\/ul>\n<h2>Legend<\/h2>\n<p>When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by <a href=\"https:\/\/bartb.ie\/\">Bart<\/a>.<\/p>\n<table>\n<thead>\n<tr>\n<th align=\"center\">Emoji<\/th>\n<th align=\"left\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td align=\"center\">\ud83c\udfa7<\/td>\n<td align=\"left\">A link to <strong>audio content<\/strong>, probably a podcast.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\u2757<\/td>\n<td align=\"left\">A <strong>call to action<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\"><em>flag<\/em><\/td>\n<td align=\"left\">The story is particularly relevant to people living in a <strong>specific country<\/strong>, or, the organisation the story is about is affiliated with the government of a specific country.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udcca<\/td>\n<td align=\"left\">A link to <strong>graphical content<\/strong>, probably a chart, graph, or diagram.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83e\uddef<\/td>\n<td align=\"left\">A story that has been <strong>over-hyped<\/strong> in the media, or, <em>&#8220;no need to light your hair on fire&#8221;<\/em> \ud83d\ude42<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udcb5<\/td>\n<td align=\"left\">A link to an article behind a <strong>paywall<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udccc<\/td>\n<td align=\"left\">A <strong>pinned<\/strong> story, i.e. one to keep an eye on that&#8217;s likely to develop into something significant in the future.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83c\udfa9<\/td>\n<td align=\"left\">A <strong><em>tip of the hat<\/em><\/strong> to thank a member of the community for bringing the story to our attention.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83c\udfa6<\/td>\n<td align=\"left\">A link to <strong>video content<\/strong>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>Feedback &amp; Followups Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time. Unsurprisingly: PHP2Shell security flaws now sucessfully exploited in the wild \u2014 www.bleepingcomputer.com\/\u2026 \u26a0\ufe0f Windows PHP Users: PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw \u2014 thehackernews.com\/\u2026 Some [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":28385,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[147,214],"tags":[5548],"class_list":["post-37011","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-posts","category-security-bits","tag-cybersecurity"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/www.podfeet.com\/blog\/wp-content\/uploads\/2023\/05\/Security-Bits-Logo_1040x520.png","_links":{"self":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/37011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/comments?post=37011"}],"version-history":[{"count":4,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/37011\/revisions"}],"predecessor-version":[{"id":37015,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/37011\/revisions\/37015"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media\/28385"}],"wp:attachment":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media?parent=37011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/categories?post=37011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/tags?post=37011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}