Loading story…
The Yocto Project released Blacksail 6.1 as its new stable release, with maintenance scheduled through April 2027. Bootlin engineers contributed vulnerability fixes for GLib and Python 3, alongside improvements to software bill of materials (SBOM) vulnerability checking and vulnerability databases. The announcement describes security and build-tooling improvements, not an exploitation campaign or breach.
Security tooling changes include offline SBOM CVE checking, updated SPDX source handling, and documentation addressing removal of the older cve-check functionality. Bootlin also contributed shared-state signing documentation and reproducibility testing improvements. Separately, BitBake 2.18 documentation covers environment setup using the bitbake-setup tool. Embedded Linux teams adopting Blacksail should review the vulnerability-checking changes, validate their SBOM workflows, and account for the April 2027 maintenance endpoint in upgrade planning.
See affected versions and whether adversaries are exploiting it.
10 events from the most recent confirmed update back to the earliest known activity.
The Yocto Project released Blacksail 6.1 as its new stable release, incorporating more than 200 commits authored by Bootlin engineers during the release cycle. Maintenance was scheduled to continue through April 2027.
Bootlin engineer Thomas Perrot re-enabled BitBake's npm and npmsw fetchers with checksums supplied through SRC_URI. He also restored and extended their test coverage.
Bootlin engineer Mathieu Dubois-Briand added fake-time support to reproducibility tests and imported and corrected the libfaketime recipe.
Antonin Godard added documentation covering shared-state signing and shared-state mirror setup.
Documentation maintainer Antonin Godard documented the removal of the older cve-check functionality, newer SBOM CVE-checking features, and SBOM_CVE_CHECK_SHOW_WARNINGS. He also updated vulnerability-handling documentation to require rather than recommend Upstream-Status metadata.
Benjamin Robin simplified SPDX patched-source handling, switched it from WORKDIR to UNPACKDIR, and corrected kernel source directory naming. He also corrected package debug-source information handling and updated python3-spdx-python-model to version 0.0.6.
Benjamin Robin enabled offline operation for sbom-cve-check and updated python3-sbom-cve-check through version 1.3.5. Related contributions updated the CVE List and NVD database recipes and excluded database-update recipes from rm_work.
Benjamin Robin backported a fix for CVE-2026-11972 affecting Python 3 into openembedded-core.
Benjamin Robin backported a fix for CVE-2026-11940 affecting Python 3 into openembedded-core.
Bootlin engineer Benjamin Robin backported a fix for CVE-2026-58016 affecting glib-2.0 into openembedded-core.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GRUB2 maintainers released a 73-patch security update bundle addressing **21 disclosed vulnerabilities** across filesystem parsers, `gettext`, JPEG parsing, networking, GPG hooks, command handling, and module unloading. The flaws include heap out-of-bounds reads and writes, integer overflows, use-after-free conditions, information disclosure, denial of service, and potential arbitrary code execution. Oracle disclosed the CVEs publicly alongside the fixes, and researchers **Nils Langius, B Horn, and Jonathan Bar Or** were credited with responsible disclosure, with Oracle, Red Hat, and SUSE contributors helping prepare and upstream the patches. Several of the vulnerabilities were described as capable of enabling **Secure Boot bypass**, while `CVE-2025-0624` affects network boot and could allow **remote code execution** from the same network segment. Maintainers said full mitigation requires not only updated GRUB2 but also refreshed **shim** and other boot artifacts plus updated **SBAT revocation** data from vendors and Linux distributions; the **UEFI `dbx` revocation list** is not being used for this remediation round. The fixes were added upstream to the GRUB2 repository, with major distributions expected to ship updated packages.
Feb 18, 2025
Binarly disclosed six critical vulnerabilities in **U-Boot**'s FIT signature verification logic that can be triggered by a malicious FIT image *before* signature checks complete, breaking the intended Verified Boot trust model. The flaws affect code paths present since `U-Boot v2013.07`, potentially spanning more than 50 stable releases and numerous vendor forks used in embedded devices, routers, IoT products, and server **BMCs**; two of the issues may allow arbitrary code execution during boot, while the others can cause denial of service. Researchers warned that exploitation may not require physical access if devices accept firmware through insecure remote update paths such as exposed BMC interfaces, raising the risk of device bricking or persistent firmware implants below the operating system. U-Boot maintainers handled the issues through coordinated disclosure and merged fixes into the mainline repository, and downstream users were urged to update or backport patches because the long-lived, widely reused bootloader code creates broad supply-chain exposure.
Jul 11, 2026
Multiple vendors issued fixes for **high-impact vulnerabilities** that could enable privilege escalation, tenant-wide compromise, security feature bypass, or remote code execution. OpenStack patched **CVE-2026-22797** in *keystonemiddleware* affecting deployments using `external_oauth2_token`, where failure to sanitize incoming identity headers allows authenticated users to forge headers (e.g., `X-Is-Admin-Project`, `X-Roles`, `X-User-Id`) to **escalate privileges or impersonate other users**; fixes were released across supported branches and the issue was reported by a Red Hat researcher. Microsoft patched **CVE-2026-20965** in *Windows Admin Center*’s Azure SSO (fixed in Azure Extension **v0.70.00**), where improper token validation could let an attacker with local admin on a WAC-enabled Azure VM/Arc machine combine a stolen `WAC.CheckAccess` token with a forged PoP token to enable **lateral movement and tenant-wide access** under certain conditions. Separately, Microsoft addressed **CVE-2026-20824** in *Windows Remote Assistance*, an **Important** security feature bypass that can allow attackers to evade **Mark of the Web (MOTW)** protections via social engineering. Progress Software also released patches for **CVE-2025-13444** and **CVE-2025-13447** (CVSS 8.4) affecting *LoadMaster* and *MOVEit WAF*, where crafted UI/API requests can trigger **command injection leading to remote code execution**; the vendor stated it had no evidence of in-the-wild exploitation at the time of release.
Jan 16, 2026