Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog

Category: cybercrime/malcode – Page 12

CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting the Sudo command-line utility for Linux and Unix-like operating systems to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.

The vulnerability in question is CVE-2025–32463 (CVSS score: 9.3), which affects Sudo versions prior to 1.9.17p1. It was disclosed by Stratascale researcher Rich Mirch back in July 2025.

“Sudo contains an inclusion of functionality from an untrusted control sphere vulnerability,” CISA said. “This vulnerability could allow a local attacker to leverage sudo’s-R (—chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.”

GitHub notifications abused to impersonate Y Combinator for crypto theft

A massive phishing campaign targeted GitHub users with cryptocurrency drainers, delivered via fake invitations to the Y Combinator (YC) W2026 program.

Y Combinator is a startup accelerator that funds and mentors projects in their early stages, and connects founders with a network of alumni and venture capital firms.

The attacker abused GitHub’s notification system to deliver the fraudulent messages, by creating issues across multiple repositories and tagging targeted users.

Paper information

🌍 Exciting News! 🌍

Our research team is honored to have two papers accepted at the International Astronautical Congress (IAC) 2025 in Sydney 🇦🇺. Both sessions are scheduled for October 2nd, 2025:

📄 Hybrid GEO–LEO Satellite Network for Multi-Service 5G/6G NTN Connectivity in Australia 🕙 10:15 AM | Room C4.

📄 Leveraging GEO Satellite Virtualization for Enhanced Real-Time Security in Hybrid Satellite Networks 🕜 1:30 PM | Interactive Poster B2.

Although I won’t be able to attend in person, my co-author @Muãwia Tirmizëy will be there to present on behalf of our team.

You can find more details in my LinkedIn announcement here: 👉 [ https://www.linkedin.com/feed/update/urn: li: li:

We’re looking forward to contributing to the global conversation on multi-orbit networks, 5G/6G NTN, and secure satellite connectivity. 🚀

Continue reading “Paper information” | >

Microsoft Edge to block malicious sideloaded extensions

Microsoft is planning to introduce a new Edge security feature that will protect users against malicious extensions sideloaded into the web browser.

Edge enables developers to install extensions locally (also known as sideloading) for testing purposes before publishing them to the Microsoft Edge Add-ons store by toggling the “Developer Mode” option on the Extensions management page and clicking the “Load unpacked” button.

However, users can also sideload third-party extensions that aren’t distributed through official channels and aren’t scanned for malware.

/* */