Mastodawn

A few insects from Langridge, near #Bath - Green Pot Beetle, Dingy Skipper, Small Heath and Silver-Y Moth.
#Nature #Wildlife #Insects #Beetle #Butterfly #WildlifePhotography #NaturePhotography

cmars 🅅 18m ago

Jan Schaumann 39m ago

#DirtyFrag status/advisories:

AlmaLinux:
https://almalinux.org/blog/2026-05-07-dirty-frag/

Debian:
https://security-tracker.debian.org/tracker/CVE-2026-43500
https://security-tracker.debian.org/tracker/CVE-2026-43284

Gentoo:
https://bugs.gentoo.org/974307

RedHat:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-43284
https://access.redhat.com/security/cve/cve-2026-43284
nothing yet on CVE-2026-43500

Rocky:
https://kb.ciq.com/article/rocky-linux/rl-dirty-frag-mitigation

SUSE / OpenSUSE:
https://www.suse.com/security/cve/CVE-2026-43500.html
https://www.suse.com/security/cve/CVE-2026-43284.html
https://www.suse.com/c/addressing-copy-fail2-aka-dirtyfrag-in-suse-virtualization/

Ubuntu:
https://ubuntu.com/security/CVE-2026-43284
https://ubuntu.com/security/CVE-2026-43500
https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available

AWS:
https://aws.amazon.com/security/security-bulletins/rss/2026-027-aws/
https://explore.alas.aws.amazon.com/CVE-2026-43284.html

Dirty Frag vulnerability fix is ready for testing

The AnnouncementA week after Copy Fail, researcher Hyunwoo Kim disclosed a second Linux kernel flaw in the same broad area — IPsec ESP and rxrpc — that they have named Dirty Frag. The bug lives in the in-place decryption fast paths of esp4, esp6, and rxrpc: when a socket buffer carries paged fragments that are not privately owned by the kernel (e.g. pipe pages attached via splice(2)/sendfile(2)/MSG_SPLICE_PAGES), the receive path decrypts directly over those externally-backed pages, exposing or corrupting plaintext that an unprivileged process still holds a reference to.

AlmaLinux OS

cmars 🅅 7h ago

ACARS Drama - Top Shelf Drama 7h ago

Air to Ground Message:

HI WE NEED BIO HAZARD CLEANING AFTER LDG TAIL XXXX LDG SFB

Area: Charlotte, NC, USA
Type: Airbus A320
A: #a007315b6c8
F: #fb0ba3035b1

#acars #vdlm2

cmars 🅅 7h ago

Show thread

David Chisnall (*Now with 50% more sarcasm!*)1d ago

@mariusor

I think the Firefox translation models are downloaded on demand, the first time you request on-device translation from a specific language. Each language pair is about 60 MiB.

These are an amazing piece of engineering. They’re designed so that they can be trained on a single (powerful) desktop and they’re trained from corpora that are specifically built (and licensed) for improving machine translation.

cmars 🅅 7h ago

Show thread

WTL 7h ago

@TheBreadmonkey To me, it is rather fascinating and appreciated how influencer-resistant the Fediverse is. All of their usual tricks don’t work, they get mad, and they leave us in (relative) peace and quiet.

cmars 🅅 7h ago

Hannah Grace 9h ago

Excited to announce that the @EUCommission has updated it's follow buttons on the website footer!
What's that first platform there? Could that be #Mastodon?
And where did the link to #X go?
All the posts and comments here on Mastodon calling for this, trust me we read them!

#SocialMedia #EU #EuropeanCommission #FollowUs

cmars 🅅 17h ago

O RLY CYBER 19h ago

(bishopfox.com) SSRF and Token Passthrough in MCP Servers: Old Vulnerabilities in New Integrations

Critical SSRF-to-RCE chain (CVE-2026-27826) in mcp-atlassian highlights resurgent risks in MCP server integrations. Attackers exploit lax URL validation to access internal systems, cloud metadata, or achieve RCE via path traversal (CVE-2026-27825).

In brief - SSRF and token passthrough vulnerabilities in MCP servers (e.g., Atlassian, Microsoft) enable unauthorized access to internal resources, credential exfiltration, and RCE. Mitigations include strict destination validation and network segmentation.

Technically - MCP servers accepting arbitrary URIs without validation (e.g., mcp-atlassian’s custom header injection) allow SSRF targeting localhost/cloud metadata (AWS 169.254.169.254). Token passthrough flaws violate OAuth principles, enabling security control bypass. Mitigations: block private IP ranges, enforce allowlists, and adopt RFC 8693 for scoped token exchange.

Source: https://bishopfox.com/blog/otto-support-ssrf-token-passthrough-with-mcp

#Cybersecurity #ThreatIntel