Aggregator

Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya. Framework has begun patching affected models, though some fixes and DBX updates are still pending. BleepingComputer reports: According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. The command provides direct read/write access to system memory and is intended for low-level diagnostics and firmware debugging. However, it can also be leveraged to break the Secure Boot trust chain by targeting the gSecurity2 variable, a critical component in the process of verifying the signatures of UEFI modules. The mm command can be abused to overwrite gSecurity2 with NULL, effectively disabling signature verification. "This command writes zeros to the memory location containing the security handler pointer, effectively disabling signature verification for all subsequent module loads." The researchers also note that the attack can be automated via startup scripts to persist across reboots.

Read more of this story at Slashdot.

A glamorous Australian athlete has revealed her detailed daily beauty routine.

Hamas handed over four bodies on Tuesday night, but relatives of hostages still in the clutches of the terror group took to the streets in Tel Aviv to call for the return of their loved ones.

The BBC aired a segment featuring the family of Murad Muhammad Ridha Ahmad Abu al-Rub - without initially noting his connection to the 2006 Kedumim attack, according to critics.

Kate and Will observed the apple cider vinegar production process, before watching how the apples are pressed and bottled on site into their award-winning cider.

Ona recent city break, my wife and I booked a trip from Ljubljana in Slovenia to Umag in Croatia, costing £40 with a big international coach firm.

A 15-year-old boy is alleged to have conducted the 'premeditated' attack in retaliation to a previous incident, in which his friend was struck with a metal pole.

The Duchess of Sussex discussed life as a 'high-profile business founder' as she appeared at the summit in Washington DC on Tuesday afternoon.

BrianFagioli shares a report from NERDS.xyz: NordVPN has open sourced its Linux GUI on GitHub, giving the community full access to the code behind its graphical client. The move follows a 70 percent surge in daily active Linux users since the GUI's debut earlier this year, showing clear demand for a user friendly VPN experience on the platform. Alongside the previously open sourced command line tool, the GUI codebase is now available for anyone to audit, modify, and contribute to. While NordVPN's core backend infrastructure remains proprietary, the company says the open source release reflects its commitment to transparency and collaboration with the Linux community. The GUI can also now be installed with a single command using Snap, simplifying setup and ensuring automatic updates across distributions.

Read more of this story at Slashdot.

The Radio 2 presenter, 41, took to his Instagram on Tuesday to issue a health update and to voice his gratitude for the 'amazing' NHS that took care of him.

The presenter, 50, lived with painful heavy bleeding, vomiting, fainting and severe aching every two and a half weeks for 32 years before a private doctor finally diagnosed her with Adenomyosis.

As Formula One WAGs rake in six-figure brand deals and build empires made up of millions of followers, who is the most powerful of them all?

British YouTubers Dan Howell and Phil Lester look just like the happy double act they have always been. But photos shared exclusively with the Daily Mail mark a brand new chapter.

Prime minister Benjamin Netanyahu ruled out doubling the number of trucks to deliver the much-needed supplies amid mounting anger at the terror group's violation of the peace plan.

The 'exciting' results offer hope to millions of cancer patients suffering from the debilitating wasting syndrome cachexia.

It has been more than two years since Martin Cosser watched his son Charlie walk down the driveway and jump into a friend's car. Charlie, 17, never returned.

An adviser to RFK Jnr has broken cover to reveal a chilling theory about the state of Donald Trump's health.

Reeves' pledges to 'fix the foundations' of the British economy have subsided. The Chancellor's refrain that she would never take the risks the Conservatives took has proved hollow.

Sir Keir Starmer, inflating himself like something rubbery and faintly spermicidal, told Kemi Badenoch she was not a 'serious statesperson'.

I felt it in my bones, the shock of unlocking the door and stepping into the silent house knowing he wasn't at home and never would be again.