Malicious actors with code execution capability may gain root access on Linux systems using as few as 10 lines of Python, according to a researcher. A newly discovered vulnerability could affect most open-source major Linux distributions released since 2017, according to security researchers. The flaw, titled “Copy Fail,” caught the attention of the US Cybersecurity and Infrastructure Agency (CISA), who added it to the Known Exploited Vulnerabilities (KEV) catalog on Saturday, warning it poses “significant risks to the federal enterprise.” The vulnerability can allow attackers to gain root access across a wide range of Linux systems using a 732-byte Python script, though it requires prior code execution on the system to escalate privileges. Read more
Treasury Secretary Scott Bessent said that wallets the US targeted as part of Operation Economic Fury were linked to Tehran, but analysis of the wallets' characteristics suggests otherwise. Multiple wallet addresses recently sanctioned by the US Treasury Department for their ties to Iran may not be linked to the Islamic Republic, but to other state actors instead, analysis published Sunday suggests. That analysis, by blockchain intelligence firm Nominis, said that while the recent seizing of wallets holding more than $340 million by Treasury’s Office of Foreign Assets Control (OFAC) was a significant crypto enforcement event, some of those wallets’ characteristics lack a similarity to previously seized wallets linked Tehran. “While the use of cryptocurrency by the Islamic Revolutionary Guard Corps (IRGC) is well established, this case presents structural and behavioral characteristics that diverge meaningfully from previously observed patterns,” said Nominis CEO Snir Levi. Read more
Venture capital firm a16z argues that state crackdowns on platforms like Kalshi and Polymarket conflict with federal law and hurt market access for ordinary users. A16z has thrown its weight behind the Commodity Futures Trading Commission (CFTC) in a growing federal-state standoff over prediction markets, opposing state regulators that try to shut down platforms like Kalshi and Polymarket. The venture capital heavyweight submitted the letter on Thursday in response to the CFTC’s advance notice of proposed rulemaking on prediction markets. It argues that state-level crackdowns, ranging from cease-and-desist letters to criminal charges, are creating barriers that undermine the federal agency’s mandate to provide “impartial access to its markets and services.” In recent weeks alone, the CFTC has filed lawsuits against Illinois, Arizona, Connecticut, New York and Wisconsin, claiming that those states overstepped by trying to regulate markets that fall under federal jurisdiction. A16z backed that position, arguing...