During July & August, we will continue to accept security bug reports for DOMPurify.
If anything serious is found, we will patch it immediately and release an update. As always.
We call this approach the 'summer of responsible OSS maintenance' and prefer it to ignoring security bugs and waiting for Wikifeet to call us.
Some good news for today. The gcc sc approved the wasm for inclusion on the gcc trunk pending technical reviews.
Here is your last #OpenBSD story before the summer break: that one time OpenSSH was used in a supply-chain attack, before that expression was even coined.
Big new WIRED story:
Meta has been quietly shipping to code to run face recognition from its smart glasses. The code is now on millions of phones
From my colleagues Dhruv and Dell
https://www.wired.com/story/meta-smart-glasses-face-recognition-nametag-connections/
For years, Rust binaries made reversing a nightmare. Modern decompilers only support C, lacking meaningful types, constructs, and language-specific functions. Led by @34r7hm4n, we're releasing our S&P work Oxidizer, the first deep Rust decompiler, built on angr!
Interested? 🧵👇
OH NO I JUST REALIZED THIS IS NOT ACTUALLY PROPERLY FIXED AND STILL WORKS 💀💀
Carrot disclosure: Forgejo — https://dustri.org/b/carrot-disclosure-forgejo.html
PSA: new linux LPE with no patches https://www.openwall.com/lists/oss-security/2026/05/07/8
What went wrong with this case?
Theori appear to have only contacted the linux kernel devs with the vulnerability, as opposed to going the usual CVD route that includes all of the major Linux distros.
Why is this a problem? Since the linux kernel became a CNA, there has been a flood of CVEs for the Linux kernel. The Linux kernel devs' arguments is that any given kernel flaw could presumably be leveraged to behave as a vulnerability, and it's not worth their time to determine "vulnerability" or "not a vulnerability". Everything gets a CVE.
Now the case with copy.fail? It was indeed reported to the kernel devs. And it got a CVE. A single CVE buried in flood of all of the Linux kernel CVEs.
And it appears that every distro on the planet was blindsided by this proven-exploitable vulnerability because they were not given any warning. Or even any suggestion to pick this single CVE out of the sea of Linux kernel CVEs as worth cherry picking.
Much to the chagrin of the Linux devs, RHEL doesn't use up-to-date Linux kernels. They cherry pick CVEs to backport to their chosen kernel version. (e.g. the latest and greates RHEL 10.1 uses 6.12.0, which was released November 17 2024). And in this world where bad actors like Theori don't involve vendors in vulnerability coordination, and just about every Linux kernel bug gets a CVE, this workflow fails. Hard.
Good times...
In case you're curious, here's what AI-generated bug reports look like. These are 4 non-security bugs, but still bugs in the Temporal specification.
https://bugzilla.mozilla.org/show_bug.cgi?id=2028880
https://bugzilla.mozilla.org/show_bug.cgi?id=2029756
https://bugzilla.mozilla.org/show_bug.cgi?id=2028872
https://bugzilla.mozilla.org/show_bug.cgi?id=2029455
We are going to put some of the MoreVMs'26 talks online.
First up:
How Many Compilers Is Too Many? A Look at V8’s History, Tradeoffs, and Architectural Choices
By Leszek Swirski from Google's V8 team
I spent nearly 4 months investigating the inner workings of a North Korean state-sponsored hacking group. Here's what I found:
- The group used generative AI tools to aid in almost every part of their operations.
- They exfiltrated 26,584 cryptocurrency wallets from victim systems, with a combined value totaling as much $12 million dollars.
- In several cases, the threat actors set up entire front companies to lure in developers via fake job posting, then infected them with malware.
- The threat actors successfully pulled off a supply-chain attack by compromising a VS Code extension developer's system.
🔗 Full article: https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/
New version of Firefox released.
It's got uh... (checks notes) 354 vuln fixes. So pretty impressed by the platform team for pulling that off in a 4-week cycle.
Actually, a 4 week cycle would include the 41 vulns we fixed in the dot release, so that would be 395 vulns.... Exciting times.
https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/
https://www.mozilla.org/en-US/security/advisories/mfsa2026-25/
From the same author as BlueHammer we now have RedSun.
This works ~100% reliably to go from unprivileged user to SYSTEM against Windows 11 and Windows Server 2019+ with April 2026 updates, as well as Windows 10, as long as you have Windows Defender enabled. Any system that has cldapi.dll should be affected.
this is a lovely post, where someone takes formally verified code, fuzzes it, and finds real problems.
while reading the piece, I was thinking about my own very similar experience ~15 years ago fuzzing CompCert. and then the author makes this precise comparison :)
https://kirancodes.me/posts/log-who-watches-the-watchers.html
This morning we got one of our pending #curl security flaws reported a **4th** time.
Everyone is using (the same) AI tools now.
CrackArmor: Multiple vulnerabilities in AppArmor
Article about a variety of vulnerabilities found in the AppArmor LSM implementation, including a few kernel memory corruptions. Authors exploited them to achieve LPE on Ubuntu and Debian.
There is at least one Adobe Reader 0day being exploited in the wild:
https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html
TL;DR: One 0day is being used to simply communicate details to a C2 server to get further commands. Specifically, there is a vulnerability that allows reading arbitrary local files using Reader JavaScript. In this case, ntdll.dll and friends, so that the C2 knows specifically what version of Windows the victim is running.
Nobody knows what secondary payload the C2 is delivering to selected targets. But it's a direct pipeline to allow the C2 to run arbitrary JavaScript on the victim system.
So I'll bet dollars to donuts that there is a second more powerful vulnerability that the attackers have up their sleeves. Or at the very least, the same vulnerability that allows the privileged file read might be able to be leveraged to do something nasty. And the whole AES-encrypted C2 stuff is merely to not put the payload statically in the exploit PDF, allowing a dynamic payload for any given target.
Edit: This is now fixed as CVE-2026-34621.
From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow
https://osec.io/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape/
Short summary: https://hackerworkspace.com/article/from-virtio-snd-0-day-to-hypervisor-escape-exploiting-qemu-with-an-uncontrolled-heap-overflow