JEDI-SEC | Security Research & Digital Defense https://validator.w3.org/feed/docs/rss2.html Israel Used a U.S.-Made Missile to Kill Six at Gaza’s Nasser Hospital Congress Might Sneakily Use Lame Duck to Deeply Intertwine the U.S. and Israeli Militaries Ethics Watchdog Urges Investigation Into Top Health Official, Alleging Conflict of Interest Over Hormone Therapy Policy Android’s Clipboard Warning Can Be Hidden, and Google Has Closed the Report GHSA-ffr9-mgrr-wcvr: NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop GHSA-8fx7-8jr8-84rv: NLTK: Unbounded CPU consumption in SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars GNSS Spoofing and Jamming: What They Do to RTK Positioning and How Field Teams Can Spot Them ARTEX and beyond: AI-enabled penetration testing platforms Industry guidelines for offensive cyber tools unveiled through international Pall Mall Process GHSA-qg35-44qx-7vrr: NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox This year’s bug count just passed 100K GHSA-mw6w-2fmv-pvw3: SvelteKit: adapter-node crashes with an unhandled URIError when `reroute` rewrites malformed pathnames GHSA-jf9x-2fg2-hx4w: SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static GHSA-5wg4-q3ww-283h: SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare` GHSA-rqw3-x7hx-mm3p: SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch` GHSA-5cjw-f85j-cv6r: Tornado: Open redirect via triple-slash redirect paths Ransomware claim: Paragon Mechanical (akira) Ransomware claim: Replogle Globes (akira) Ransomware claim: Advantage Archives (inc ransom) GHSA-vvf4-9×63-8xvv: dnspython has excessive memory and CPU use Instagram Username decoding Curious about “Curious Worm” City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Trezor confirms crypto-stealing implants in three wallets, releases fix GHSA-r99w-jh2x-3mg9: Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes Ransomware claim: Company #216 (n0n) Ransomware claim: Company #213 (n0n) Ransomware claim: Company #212 (n0n) Ransomware claim: Texas Truck Center (n0n) Ransomware claim: Native Touch Inc. (n0n) Ransomware claim: LEO Pharma A/S (n0n) Ransomware claim: Female Daily Network (n0n) Podcast: Election Fallout Behind the Blog: Priorities, Priorities The Hegseth Vote Was Jeffries’s First Big Test. He Failed. Microsoft 365 Crawls Back to Life After a 24-Hour Outage NYC to bar surveillance pricing as momentum for bans grows nationwide With the new shift in the U.S. Congress, time is running out on bills targeting drug patents GHSA-mjrq-cffv-q4qc: Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file GHSA-h7wh-q2qr-458c: rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls GHSA-jv6m-48w5-5rpr: envd: Host file disclosure through requirements path traversal and TOCTOU GHSA-cpgf-5mjf-73p7: rails-html-sanitizer: Possible regular expression denial of service with certain configurations German military drone operations disrupted by cyberattack University of Texas at Arlington warns personal information stolen during cyberattack Apify Breach: A Hacker Got Into Customer Accounts on the Web-Scraping Platform The Microsoft Outage Is a Warning for the World PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE New York City votes to ban surveillance pricing Home Research & Field Notes