Homebrew, a popular package manager for installing command-line tools and desktop apps on macOS and Linux, released version 7.0.0 on Sunday, with eight security advisories closed in the process. The most severe of the 18 reported issues is an unsigned removal metadata vulnerability for a cask, a formula in Homebrew's format for prebuilt app installs, allowing arbitrary sudo commands. Homebrew removed the vulnerable recovery code and associated API accessors. Seven of the advisories were addressed in earlier 6.0.x releases, which means auto-updating machines already carry those fixes. The eighth is new and would let a malicious cask execute code outside the sandbox of a macOS via LaunchServices. Homebrew classified the issues as one High, two Moderate, and five Low. The High severity sudo path issue was fixed in 6.0.12, where a Moderate was also addressed for preventing the installer from reading Git config owned by the Homebrew prefix, which could run programs as root.  The second Moderate is the LaunchServices escape mentioned earlier, which is fixed in 7.0.0 by restricting launching of applications, Mach services, and Unix socket connection. The five Low-level issues were fixed earlier and involved redirects and file paths pointing to unintended locations, including headers leaks, tap-restriction bypasses, and files being written outside of staged source trees. The new 7.0.0 brings a built-in scanner (`brew vulns`) that checks for known vulnerabilities in installed formulae, with flags such as `--severity=high` and `--fix-available` to narrow the results, against a database of known vulnerabilities in formulae versions that have been shipped.  It includes backported fixes for some issues and minimizes false positives, with Homebrew's data on vulnerabilities being in the OSV format with a CC0 license and published through the Homebrew API. Provenance checks are now performed for third-party tap bottles, in addition to the Homebrew core tap, with new taps publishing these by default. Homebrew notes that tap trust remains the primary defense against malicious casks, with sandboxing not making "untrusted software safe to run" due to apps running with the user's privilege and a vendor's installer not running inside the sandbox.  Nonetheless, 7.0.0 provides sandboxing of formula and cask operations, provides setup instructions as signed data instead of arbitrary Ruby code, and deprecates old post-install blocks in favor of declaring steps. On Linux, Bubblewrap sandboxing is replaced with Landlock, a new kernel feature that requires no additional dependencies. Intel Macs are moved to Tier 3 status following the end of reliable build infrastructure and cessation of routine Intel bottles, with support continuing until September 1, 2027, and MacPorts suggested as an alternative. macOS 10.15 is dropped with the release, while Sonoma 14 is moved to Tier 3.

  Cybersecurity researchers have uncovered a remote Spectre attack targeting Cloudflare Workers that was capable of extracting a JSON Web Token (JWT) from a co-located Worker in a production environment at speeds of up to 12 bits per second. This represents a significant increase over an earlier attack demonstrated in 2021, which achieved just 2 bits per minute. The researchers conducted an end-to-end experiment involving an attacker-controlled Worker and a victim Worker, with the JWT deliberately stored in the victim's memory. According to the research paper, the experiment did not involve accessing any customer information. Cloudflare said it has already addressed the issue in its production environment by strengthening Dynamic Process Isolation (DyPrIs), integrating the V8 Sandbox and introducing Memory Protection Keys (MPK)-based in-process isolation. The company also said it found no evidence of active exploitation related to the issue during the past three years. "We demonstrate that the production implementation of DyPrIs was insufficient," the researchers said in the paper. Cloudflare Workers executes code belonging to multiple tenants using separate V8 isolates within the same operating-system process. Rather than relying solely on strict process-level separation, the platform uses language-level isolation to help maintain faster startup times. According to Cloudflare, a memory-read attack within a shared Worker process could potentially enable information to leak across tenants. However, the attack requires both the attacker and victim Workers to be placed in separate V8 isolates within the same Worker process. The researchers said the attacker must control legitimate code within its own isolate. The technique does not rely on native code execution, a V8 vulnerability or a sandbox escape. Cloudflare Workers also limits access to local timing mechanisms by freezing or reducing the precision of timers during CPU execution. Worker scripts do not have access to shared memory or multithreading. However, the researchers discovered that WebSocket communications could act as a remote timing channel. They also found that Durable Objects could keep a Worker isolate running continuously for periods ranging from five hours to more than 20 hours. Under DyPrIs, suspicious scripts are moved into a separate process after an invocation ends. The researchers found that long-running Durable Object invocations could remain active before this isolation mechanism was triggered. Another weakness involved WebSocket-intensive input/output activity. The researchers observed that such activity increased instruction translation lookaside buffer (iTLB) activity, weakening the normalized branch-misprediction signal monitored by DyPrIs and pushing it below the mechanism's detection threshold. Cloudflare characterized the problem as a limitation in how DyPrIs was implemented. The research paper, however, argued that the weaknesses represented more fundamental limitations of the detection methodology rather than simple implementation errors. The researchers recommended monitoring for such activity during execution and using signals that cannot be suppressed through I/O activity. The researchers conducted their production testing on Linux servers powered by AMD EPYC Zen 2 and Zen 3 processors. Measurements were intentionally performed at night, when CPU utilization was between 10% and 25%, to determine the highest achievable leakage rate. According to the paper, heavier system workloads reduced the amount of data that could be leaked, although the attack remained possible at slower speeds under greater CPU load. The study recorded a peak leakage rate of 12 bits per second with 99.16% accuracy. By comparison, the earlier attack achieved approximately 2 bits per minute. The latest disclosure arrives nearly five years after Cloudflare and Graz University of Technology (TU Graz) published research detailing a remote Spectre attack against Workers. That earlier work demonstrated a leakage rate of 120 bits per hour and introduced DyPrIs as a defense mechanism. The 2021 research reported a false-positive rate of 0.61% and concluded that DyPrIs offered, statistically, security guarantees comparable to strict process isolation against the Spectre attacks evaluated at that time. Cloudflare subsequently outlined additional security hardening measures for Workers in September 2025. The company's mitigations include: * Enhanced DyPrIs: Improvements designed to strengthen the detection capabilities of the existing isolation mechanism. * V8 Sandbox: A security layer designed to restrict transient access to 64-bit pointers. * MPK-based in-process isolation: Worker heaps are placed behind hardware-enforced Memory Protection Keys. Cloudflare said modern x64 systems provide approximately 12 keys that can be used for this purpose. Its architecture combines MPK with the V8 Sandbox and a rotating memory layout to prevent neighboring sandboxes from being assigned the same protection key. Cloudflare's September 2025 documentation noted that randomly assigning MPK keys would block roughly 92% of cross-isolate access attempts because two isolates could receive the same key. The company said its stricter rotating memory layout eliminates that remaining gap within the threat model covered by the in-sandbox protections.

 A security vulnerability in the game Meccha Chameleon enabled malicious custom maps stored on Steam Workshop to infect users with malware. The vulnerability was patched by the game’s developers, who noted that the issue was related to the custom content feature. The issue was initially uncovered when some players reported that a command prompt window was flashing as Steam was downloading a custom workshop map.  Security researcher Feint investigated the matter and found that one of the maps entitled Laser Tag Neon had the ability to deploy malware dropper despite having passed the Steam Workshop review process. Feint shared his findings on social media, noting that another map entitled Chroma Grid Arena had replaced the malicious content, which indicated that the threat was still present. It appears that the vulnerability could enable threat actors to utilize the game’s custom workshop feature to deploy malware onto users’ computers disguised as legitimate content. Meccha Chameleon developer Haganeiro confirmed that the issue had been resolved in version 3.1.0. He noted that the malware had been disabled both prior to the update and following its deployment, thus limiting the potential impact of the vulnerability.  The vulnerability was part of a larger security incident that involved the game’s Discord server, which housed 90 thousand members. The server was hacked, with the attacker rewriting its permissions and removing the developer team from the server. According to lemorion_1224, the Discord compromise occurred when the system administrator’s computer was infected with malware during the mitigation efforts of the vulnerability. The attacker was able to bypass the two-factor authentication of the server and modify its settings, banning several members of the development team.  It was revealed that the compromised machine belonged to the backup server, and it was later wiped clean. The developer warned the community against clicking the suspicious links that were distributed via the hacked discord server while mitigation measures were being implemented. It appears that a wide range of potential attack surfaces could be utilized to threaten the community. Gaming platforms have a diverse range of threat surfaces that can be utilized by attackers to compromise users’ computers.  In addition to the game binaries themselves, the custom content and third-party tools such as Discord can be threatened. Players should ensure they have the latest versions of the software and avoid interacting with suspicious links or content.

  Imagine being able to track any car in real time, find out exactly where it’s parked, and then unlock it using just your phone. Not only that, but you could cancel car shipments or access sensitive customer data—all without ever setting foot inside a dealership. Sounds like a scene from a cyber-thriller, right? Except this actually happened, thanks to a security loophole in a major car manufacturer’s dealership portal. Fortunately, the person who uncovered this alarming vulnerability wasn’t a criminal but cybersecurity researcher Eaton Zveare. According to TechCrunch, Zveare stumbled upon the issue during what he described as a “weekend project,” when he discovered “two simple API vulnerabilities” within the portal. Although he didn’t reveal the automaker’s name, he did confirm that it’s a “famous brand with several sub-brands.” By exploiting the flaw, Zveare was able to grant himself administrator-level access—the highest permissions possible. That meant he could view sensitive buyer information such as names, addresses, financial details, and even VIN numbers of vehicles parked on the street. More alarmingly, he could track rental and courtesy cars in real time and remotely unlock vehicles linked to the system. He even had the ability to cancel car shipments to more than 1,000 dealerships across the U.S. This kind of car hacking vulnerability isn’t new. In January, Subaru faced a similar exposure, raising further concerns about the growing risks of connected car technology. As Zveare noted, the smarter and more connected vehicles become, the greater the potential for hackers to exploit weak links. Modern car apps already let owners locate, track, and unlock their vehicles remotely—but when that same access falls into the wrong hands, it poses a massive cybersecurity threat to the automotive industry. This isn’t Zveare’s first big discovery. In 2023, he gained access to Toyota Mexico’s customer data and, shortly before that, infiltrated Toyota’s global supplier management network—a critical system for its supply chain. He later described that flaw as “one of the most severe vulnerabilities I have ever found.” The silver lining? Zveare responsibly reports all vulnerabilities to companies before going public, giving them time to fix the issues. He first identified the dealership portal exploit in February, and the problem has since been resolved. Still, his findings highlight a sobering reality: if one researcher can uncover these flaws, malicious hackers may already be exploiting others that remain undiscovered. So, while you might think locking your car is enough, in the age of connected vehicles and remote access hacks, that may no longer be the case.

At a regular meeting, commissioners approved multiple grant applications and purchases — including a Community Corrections grant, Community Crossings applications and an emergency firewall purchase — and heard updates on a federal VA shutdown and a Lifewise school program and film screening.