Welcome!
A bit of an ancient
web2.0 design,
Couple lines of code,
thoughts, photo and a charm. Read more
Linux
Everything that concerns. Go to category
Electronics
micro, radio,
and usual. Go to category
Photo
From different categories. View category
A good addition to the collection.
The news needs to be given time to settle, and then the details can be savored.
What could be wrong here?
Let’s rebuild Nginx with CVE-2026-9256 patch according to the Debian-way.
A critical vulnerability in nginx allows remote code execution with the privileges of the nginx worker process by sending a specially crafted HTTP request.
But that’s not the point.
The problem is that Debian maintainers are in no hurry to release a new patch package.
1 2 3 4 5 | apt --no-install-recommends \ --no-install-suggests install \ build-essential \ fakeroot \ devscripts |
nano /etc/apt/sources.list
1 2 3 4 | # trixie sources
deb-src https://deb.debian.org/debian/ trixie main contrib non-free non-free-firmware
deb-src http://security.debian.org/debian-security/ trixie-security main contrib non-free non-free-firmware
deb-src https://deb.debian.org/debian/ trixie-updates main contrib non-free non-free-firmware
|
Only six months had passed, but the news feed continued to bring new funny vulnerabilities.
As usual, I don’t focus on system vulnerabilities in snapd / Rust Coreutils / Flatpak, or kernel (Copy Fail, Dirty Frag, Fragnesia, pidfd, PinTheft, GRO Frag) or AppArmor.
No matter how dangerous they may be, they are “conditionally” passive, meaning that if they are present, a number of factors and active actions from within or outside are required for successful exploitation.
I’m much more interested in tracking compromises of package distribution systems, libraries, and other package repositories.
Because these are “active” and direct attacks, they require almost no combination of factors; after downloading, they will immediately hit the developer’s repository, then collect their personal/financial/authorization information, and then continue to act in a chain fashion on all servers to which they had access.
