openSUSE removes Deepin from its repositories after long string of security issues and unauthorised security bypass
The openSUSE team has decided to remove the Deepin Desktop Environment from openSUSE, after the project’s packager for openSUSE was found to have added workaround specifically to bypass various security requirements openSUSE has in place for RPM packages. Recently we noticed a policy violation in the pa … ⌘ Read more
curl bans “AI” security reports as Zuckerberg claims we’ll all have more “AI” friends than real ones
Daniel Stenberg, creator and maintainer of curl, has had enough of the neverending torrent of “AI”-generated security reports the curl project has to deal with. That’s it. I’ve had it. I’m putting my foot down on this craziness. 1. Every reporter submitting security reports on Hackerone for curl now needs to answer this question: “Did you … ⌘ Read more
Securing Apache2 + PHP: Practical guide for safer web hosting
A practical security checklist to harden your Apache2 + PHP stack and protect your web applications from common vulnerabilities.
[Continue reading on InfoSec Write-ups »](https:// … ⌘ Read more
Securing Model Context Protocol: Safer Agentic AI with Containers
Model Context Protocol (MCP) tools remain primarily in the hands of early adopters, but broader adoption is accelerating. Alongside this growth, MCP security concerns are becoming more urgent. By increasing agent autonomy, MCP tools introduce new risks related to misalignment between agent behavior and user expectations and uncontrolled execution. These systems also present a novel… ⌘ Read more
Announcing OpenReports: Standardized Kubernetes Reporting
The Kubernetes ecosystem, while powerful, is a sprawling landscape of tools. As organizations scale their deployments, ensuring compliance and security becomes paramount. But how do you effectively track and report on your Kubernetes policies and scanners… ⌘ Read more
foss-north 2025
I attended foss-north, a free / open source conference covering both
software and hardware from the technical perspective, at Chalmers
Conference Center in Gothenburg on April 14 & 15. A great conference.
Lots of interesting talks:
https://foss-north.se/2025/speakers-and-talks.html
My own presentation was “Forking QEMU to emulate and secure the
Tillitis TKey”. Recording is here:
Welcome to Maintainer Month: Events, exclusive discounts, and a new security challenge
This May marks the fifth annual Maintainer Month, and there are lots of treats in store: new badges, special discounts, events with experts, and more.
The post [Welcome to Maintainer Month: Events, exclusive discounts, and a new security challenge](https://github.blog/open-source/maintainers/welcome-to-maintainer-month-events-exclusive-discounts-and-a-ne … ⌘ Read more
Introducing Docker MCP Catalog and Toolkit: The Simple and Secure Way to Power AI Agents with MCP Tools
Model Context Protocols (MCPs) are quickly becoming the standard for connecting AI agents to external tools, but the developer experience hasn’t caught up. Discovery is fragmented, setup is clunky, and security is too often bolted on last. Fixing this experience isn’t a solo mission—it will take an industry-wide effort. A secure, scalable, and trusted MCP… ⌘ Read more
Secure your Python applications: Best practices for developers
Practical security tips every Python developer should know — from dependency safety to protecting against injection attacks and securing…
[Continue reading on InfoSec Write … ⌘ Read more
** DevSecOps Phase 3: Build Stage — CI/CD Security Gate with SAST + SCA** ⌘ Read more
The Ultimate Guide to Email Input Field Vulnerability Testing
Real-world methods and payloads for testing email field security
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-ultimate-guide-to-email- … ⌘ Read more
10 Worst Political Marriages in History
Most royals today are free to marry whomever they please (at least, up to a certain point). But for most of history, marriage was about securing power and wealth, not love. If you hated your husband from the day you met him, well, too bad! You’re stuck with him for the rest of your life […]
The post 10 Worst Political Marriages in History appeared first on [Listverse](https:// … ⌘ Read more
** DevSecOps Phase 1: Planning & Security Requirements Engineering** ⌘ Read more
DORA Has Entered the Chat: EU’s New Cyber Rulebook Reshaping Financial Security ⌘ Read more
9 Sources of Security & Privacy Threats in LLM Agents ⌘ Read more
Active Storage’s Big Mistake: A $4,323 Lesson in Session Security
Understanding Kubernetes Gateway API: A Modern Approach to Traffic Management
Traffic management in Kubernetes can be complex, especially with modern applications composed of multiple services like frontends, APIs, and backends spread across hybrid and multi-cloud environments. As these environments grow, ensuring secure, efficient, and reliable communication… ⌘ Read more
Let’s Encrypt: Why You should (and Shouldn’t) use free SSL certificates
Free, fast, and secure — but is Let’s Encrypt the right SSL solution for your website?
[Continue reading on InfoSec Write-ups »](https://infosecwriteup … ⌘ Read more
Limits of Malware Detection ⌘ Read more
CNCF and Synadia Align on Securing the Future of the NATS.io Project
SAN FRANCISCO and San Mateo, CA – May 1, 2025 – The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, and leading edge innovator Synadia today announced that the widely-adopted NATS… ⌘ Read more
CNCF and Synadia align on securing the future of the NATS.io project
CNCF and Synadia have come to an agreement to ensure that NATS continues to thrive as a healthy open source project within CNCF, with Synadia’s continued support and involvement. Please see our joint announcement for more… ⌘ Read more
Enforcing Artifact Security with Trivy and OPA
In cloud-native development, ensuring the integrity and security of software artifacts (such as Docker images, Python wheels, and Helm charts) is a fundamental challenge. With the growing adoption of continuous integration and delivery pipelines, there’s a… ⌘ Read more
** Bypassing OTP: Unlocking Vulnerabilities & Securing Your App ** ⌘ Read more
9 Security Threats in Generative AI Agents ⌘ Read more
** CISA Sounds the Alarm: Broadcom and Commvault Flaws Under Active Exploitation! ️**
Buckle up, cybersecurity enthusiasts! The U.S. Cybersecurity and Infrastructure Security Agency (CISA) j … ⌘ Read more
Kubestronaut in Orbit: Jana Vonšák
Get to know Jana We’re thrilled to recognize Jana Vonšák from Slovakia as our first-ever female Golden Kubestronaut. A dedicated DevOps Security Engineer with a background in software development, Jana brings a rare blend of development… ⌘ Read more
Cutting through the noise: How to prioritize Dependabot alerts
Learn how to effectively prioritize alerts using severity (CVSS), exploitation likelihood (EPSS), and repository properties, so you can focus on the most critical vulnerabilities first.
The post Cutting through the noise: How to prioritize Dependabot alerts appeared first on [The … ⌘ Read more
** Rack::Static Vulnerability Exposes Ruby Servers to Data Breaches! **
Hold onto your keyboards, Ruby developers! 😱 A critical security flaw in the Rack::Static middleware has been uncovered, potentially…
[Continue reading on InfoS … ⌘ Read more
Top 5 Open Source Tools to Scan Your Code for Vulnerabilities
These tools help you find security flaws in your code before attackers do.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/top-5-open-source-tools-to-s … ⌘ Read more
FBI arrests Wisconsin judge on charges of obstructing immigrant arrest
Article URL: https://www.washingtonpost.com/national-security/2025/04/25/wisconsin-judge-arrest-fbi-ice-immigration-enforcement/
Comments URL: https://news.ycombinator.com/item?id=43794576
Points: 513
# Comments: 2 … ⌘ Read more
CNCF Announces Graduation of in-toto Security Framework, Enhancing Software Supply Chain Integrity Across Industries
NYU Tandon-developed software security framework achieves highest CNCF maturity level, combating rising software supply chain attacks SAN FRANCISCO, CA, April 23, 2025 – The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native… ⌘ Read more
OSTIF Announces NATS Security Audit Results
OSTIF is proud to share the results of our security audit of NATS. NATS is an open source project made by Synadia Communications for secure always-on messaging for a variety of digital formats and clients. With… ⌘ Read more
Istio publishes results of ztunnel security audit
Passes with flying colors Istio’s ambient mode splits the service mesh into two distinct layers: Layer 7 processing (the “waypoint proxy”), which remains powered by the traditional Envoy proxy; and a secure overlay (the “zero-trust tunnel”… ⌘ Read more
️ Hacking and Securing Kubernetes: A Deep Dive into Cluster Security
Disclaimer: This document is for educational purposes only. Exploiting systems without authorization is illegal and punishable by … ⌘ Read more
The mysterious inetpub folder is actually a crucial part of a Windows security fix
Remember the odd inetpub folder that seemingly randomly appeared on people’s root drives after installing a Windows 11 update? Everybody assumed it was something left over from an update script, and that the folder was safe to remove. Well, it turns out that’s not the case, as the empty folder is actually a crucial part of a security fix for a serious vulnerability. I … ⌘ Read more
Windows Recall failed the moose test, and nobody will ever forget it
Ars Technica took a look at how the current version of Windows Recall works, including the improvements Microsoft made since the initial security nightmare of a rollout, and concludes: Recall continues to demand an extraordinary level of trust that Microsoft hasn’t earned. However secure and private it is—and, again, the version people will actually get is much better than the version that caused … ⌘ Read more
These Kubernetes mistakes will make you an easy target for hackers
Kubernetes is exceedingly powerful for orchestrating containerized applications at scale. But without proper monitoring and observability—especially in self-managed infrastructure—it can quickly become a security disaster waiting to happen. This is not due to inherent flaws in… ⌘ Read more
Thanks again to our outgoing sponsor: Nova Custom
We’d like to thank our outgoing sponsor, Nova Custom, for sponsoring OSNews! Nova Custom, based in The Netherlands, makes laptops focused on privacy, customisation, and freedom. Nova Custom laptops ship with either Linux, Windows, or no operating system, and they’re uniquely certified for Qubes OS (the V54 model will be certified soon), the ultra-secure and private operating system. On top of that, Nova Custom laptops come with Dasha … ⌘ Read more
“A handbag belonging to the homeland security secretary Kristi Noem containing her passport, department security badge and $3,000 in cash was stolen on Sunday night at a restaurant in Washington, the department confirmed.”
I Clicked a Random Button in Google Slides — Then Google Paid Me $2,240
The strange trick that exposed a hidden security flaw (and how you can find bugs like this too).
[Continue reading on InfoSec Write-ups »](https://in … ⌘ Read more
** CVSS 10.0 Critical Vulnerability in Erlang/OTP’s SSH: Unauthenticated Remote Code Execution Risk**
A critical security vulnerability (CVE-2025–32433) with a CVSS … ⌘ Read more
ActiveX disabled by default in Microsoft 365
ActiveX is a powerful technology that enables rich interactions within Microsoft 365 applications, but its deep access to system resources also increases security risks. Starting this month, the Windows versions of Microsoft Word, Microsoft Excel, Microsoft PowerPoint, and Microsoft Visio will have a new default configuration for ActiveX controls: Disable all controls without notification. ↫ Zaeem Patel at the Microsoft 365 Insider Blog Be ho … ⌘ Read more
Hacking and Securing Docker Containers: A Deep Dive into Common Vulnerabilities and Test Cases
Disclaimer: This document is for educational purposes only. Exploiti … ⌘ Read more