News for hackers. Stuff that matters.

A comment on OSS-SEC: 432 Linux kernel CVEs (in less than 32 hours). Parent comment

Re:OSS-SEC: 432 Linux kernel CVEs (in less than 32 hours) by romaniitedomum on Wednesday July 22, 2026 @12:38AM (#49001955)
Especially in environments where manglement mandate something like Qualys, leading to demands that systems must be patched to address the critical vulnerabilities that it's reported despite said vulnerabilities being unexploitable.

One that I trot out periodically as an example of this is a CVE that would only be exploitable if running on an IBM s390 with EBCDIC codepages. Our security team nevertheless wanted it patched, because Qualys said it was a vulnerability.

[ Parent | on HN ]
Re:OSS-SEC: 432 Linux kernel CVEs (in less than 32 hours) by marysol5 on Wednesday July 22, 2026 @04:47AM (#49003630)
Had that in /old job/ years ago, every security report would list off a load of packages that needed updating. Problem was, not only were they not actual vulnerabilities but they were all for some legacy software that was in the process of being removed.

Was always fun to purge a load of systems from old shit, and watch the counter drop.

[ Parent | on HN ]