React Remote Code Execution and Smartphone Privacy Rules Lead Security News

Summary

Security Now discusses a React remote code execution vulnerability, Graphine OS encryption concerns, and India's smartphone and messaging rules, including the withdrawal of a mandatory app preinstallation order.

Key points

• The React segment describes insecure deserialization leading to remote code execution, urges developers to upgrade and scan their code, and notes that public exploit code is available.
• Graphine OS said it had removed its active servers from France and was leaving OVH, citing concerns about encryption policy and alleged pressure from French law enforcement.
• Graphine OS said its secure-element design throttles disk-encryption key derivation and requires a successful unlock before accepting newer signed firmware.
• India withdrew its mandatory preinstallation order for the Sanchar Saty app after public criticism. Privacy advocates had questioned the handling and access to device-related data.
• A separate Indian directive would require SIM binding for messaging services and periodic web-session reauthentication; the discussion notes concerns about privacy and disruption.
• A security firm suspected that SLH was shifting its focus from Salesforce to Zenesk, but the speaker said attribution of recent Zenesk attacks remained uncertain.

Products