June 2026 - wlug - list.wlug.org.nz

Windows and Linux users: The deadline to update Secure Boot keys is near
by Peter Reutemann 22 Jun '26

22 Jun '26

'The clock is ticking for Windows and Linux users to update cryptographic keys that protect their systems against firmware-based UEFI infections, a pernicious form of malware that loads before operating system and anti-malware protections start. Beginning June 24, three certificates that cryptographically verify that each piece of firmware and software that loads during system boot will expire. The Microsoft-signed certificates are the linchpins of Secure Boot, a Microsoft-designed chain of trust. Secure Boot checks the digital signatures of all firmware that loads during system startup to ensure it originates from a trusted provider, such as the manufacturer of the motherboard the system runs on.' -- source: https://arstechnica.com/security/2026/06/windows-and-linux-users-the-deadli… Cheers, Peter

1 0

Euro-Office 1.0 Is Here
by Lawrence D'Oliveiro 12 Jun '26

12 Jun '26

An EU-sponsored project to create an open-source office suite to act as a drop-in replacement for Microsoft Office/365 has put out a version 1.0 release <https://www.zdnet.com/article/euro-office-is-here-libreoffice-supporters-ar…>. One hiccup along the way was the copyright holders on the original code, Ascensio, have put a strange requirement on their source, namely that it was released under AGPLv3, but with a further condition saying that its trademarks and logos and stuff *could not* be removed from the code. And yet, at the same time, there was also a declaration that the source code did *not* come with a licence to use said trademarks and logos -- a copyright booby-trap if ever there was one. Bradley Kühn, author of the “A” part of the AGPL, takes this apart here <https://sfconservancy.org/blog/2026/apr/16/badgeware-onlyoffice-nextcloud-a…>. The general verdict seems to be that Ascensio’s legal threats are toothless, and the EU consortium is free to do all the usual things with the source code as per the terms of the AGPLv3, including strip out any proprietary trademarks and logos. That’s not the only controversy over the project, of course; many people are pointing out that it would have been much less troublesome to start from a well-established code base like LibreOffice. But it seems like the EU specifically wanted something that would work as seamlessly as possible with Microsoft’s native document formats, rather than any open standard.

1 0

High-Severity Vulnerability In Linux Caused By a Single Errant Character
by Peter Reutemann 10 Jun '26

10 Jun '26

'Ars Technica reports: Researchers have analyzed a high-severity vulnerability in Linux that's able to escalate untrusted users to root by exploiting a bug you don't often see: a single errant character inside the kernel. The vulnerability, tracked as CVE-2026-23111, is located in nf_tables, a subsystem of the Linux kernel that provides packet filtering capabilities. It's used to manage firewall rules and replaces older subsystems such as iptables, ip6tables, arptables, and ebtables. The presence of a single mis-issued exclamation point in code implementing nf_tables introduced a use-after-free, a class of vulnerability that corrupts memory by placing malicious code at memory addresses that haven't been properly freed of their previous contents. CVE-2026-23111 can be exploited by an unprivileged user or process to elevate system rights to root. The exploit works by disrupting the deletion of verdicts -- a determination within the nf_tables framework that determines if a packet matches a rule calling for a certain action to be performed. This process can use what are known as catchall elements, which act as a wildcard in the event a lookup doesn't match any other element in the set. When a verdict map is deleted from memory, catchall elements are deactivated and a chain's reference counter is decremented. When errors occur the deletion can be reversed and the counter incremented. CVE-2026-53111 allows for that process to be altered. As a result, the exploit can decrement the variable an arbitrary number of times and then delete and free the chain when some objects still point to it. Although the kernel vulnerability was fixed in February, multiple proof-of-concept exploits have since emerged, including one from FuzzingLabs in April and another from Exodus Intelligence that works on Debian and Ubuntu.' -- source: https://it.slashdot.org/story/26/06/09/181245 Cheers, Peter

1 0

“Line In The Sand”: Children’s Commissioner Says Social Media Ban Isn’t Enough
by Lawrence D'Oliveiro 02 Jun '26

02 Jun '26

Our Children’s Commissioner <https://www.stuff.co.nz/nz-news/360985806/line-sand-childrens-commissioner-…> says a ban on social media by underage users is a “blunt instrument”. But rather than let the platforms go back to doing as they wish, Achmad is pushing the Government to attempt something more ambitious. While a ban would take kids off social platforms, the Australian model demonstrates that it does not make tech companies liable for the harm caused, nor does it always alter how they operate. “We need legislation that is going to set requirements on these tech companies and social media platforms to prevent harm, to report harm, and to remove harmful content,” Achmad says.“I think that together, New Zealand and other countries can make that collective effort and draw a line in the sand around our expectations on how these big businesses should not be negatively impacting the rights of children.” While the social media companies hate the ban, I’m sure they would hate this even worse. Because it’s a more direct attack on their very business model, by forcing them to take more responsibility for its effects.

1 0