What Is Earthshine? How to Spot the Lunar Marvel in the Skies This Week
https://www.cnet.com/science/space/what-is-earthshine-best-time-to-see-it/
The best time to see Earthshine is a few days before and a few days after each new moon during the spring.
https://www.cnet.com/science/space/what-is-earthshine-best-time-to-see-it/
The best time to see Earthshine is a few days before and a few days after each new moon during the spring.
How I Use AI to Keep Up With Pop Culture
https://www.cnet.com/tech/services-and-software/how-i-use-ai-to-keep-up-with-pop-culture/
If you can feel your bones crumbling to dust every time you hear new slang, this will help you stay young in spirit and in touch with the rapidly evolving world.
https://www.cnet.com/tech/services-and-software/how-i-use-ai-to-keep-up-with-pop-culture/
If you can feel your bones crumbling to dust every time you hear new slang, this will help you stay young in spirit and in touch with the rapidly evolving world.
Today's NYT Connections: Sports Edition Hints and Answers for April 15, #569
https://www.cnet.com/tech/gaming/todays-nyt-connections-sports-edition-hints-and-answers-for-april-15-569/
Here are hints and the answers for the NYT Connections: Sports Edition puzzle for April 15 No. 569.
https://www.cnet.com/tech/gaming/todays-nyt-connections-sports-edition-hints-and-answers-for-april-15-569/
Here are hints and the answers for the NYT Connections: Sports Edition puzzle for April 15 No. 569.
WrestleMania 42: Start Time, Where to Watch and Full Match Card
https://www.cnet.com/tech/services-and-software/wrestlemania-42-start-time-where-to-watch-full-match-card/
The two-night event heads to Las Vegas this weekend.
https://www.cnet.com/tech/services-and-software/wrestlemania-42-start-time-where-to-watch-full-match-card/
The two-night event heads to Las Vegas this weekend.
Thinking of Ditching Your Apple Watch for a Whoop Band? Read This First
https://www.cnet.com/tech/mobile/thinking-of-ditching-your-apple-watch-for-a-whoop-band-read-this-first/
I wore both fitness trackers for months to find out what each gets right, and the deal-breakers that get in the way.
https://www.cnet.com/tech/mobile/thinking-of-ditching-your-apple-watch-for-a-whoop-band-read-this-first/
I wore both fitness trackers for months to find out what each gets right, and the deal-breakers that get in the way.
It's National Anime Day, and You Can Watch Free Anime to Celebrate
https://www.cnet.com/tech/services-and-software/anime-day-where-to-watch-free-anime/
We know you're paying to stream Re:Zero and Dorohedoro right now, but why not supplement your watchlist this week?
https://www.cnet.com/tech/services-and-software/anime-day-where-to-watch-free-anime/
We know you're paying to stream Re:Zero and Dorohedoro right now, but why not supplement your watchlist this week?
Beef: When to Watch Season 2 on Netflix
https://www.cnet.com/tech/services-and-software/beef-heres-how-to-watch-season-2-starring-oscar-isaac-and-carey-mulligan/
The Emmy-winning drama returns with Oscar Isaac and Carey Mulligan.
https://www.cnet.com/tech/services-and-software/beef-heres-how-to-watch-season-2-starring-oscar-isaac-and-carey-mulligan/
The Emmy-winning drama returns with Oscar Isaac and Carey Mulligan.
FBI Wi-Fi Router Hacked List: 5 Steps to Keep Your Router Safe Now
https://www.cnet.com/home/internet/fbi-wi-fi-router-hacked-list-5-steps-to-keep-your-router-safe/
The FBI and Department of Justice recently disrupted a Russian attack targeting home and small-office business routers. Here's how to protect yours.
https://www.cnet.com/home/internet/fbi-wi-fi-router-hacked-list-5-steps-to-keep-your-router-safe/
The FBI and Department of Justice recently disrupted a Russian attack targeting home and small-office business routers. Here's how to protect yours.
Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-5WSJcYJB?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Authenticated%20Privilege%20Escalation%20Vulnerability%26vs_k=1
A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, local attacker with administrative privileges to perform a command injection attack on the underlying operating system and elevate privileges to root.
This vulnerability is due to insufficient validation of user supplied input. An attacker could exploit this vulnerability by providing crafted input to a specific CLI command. A successful exploit could allow the attacker to elevate their privileges to root on the underlying operating system.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-5WSJcYJB
Security Impact Rating: Medium
CVE: CVE-2026-20136
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-5WSJcYJB?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Authenticated%20Privilege%20Escalation%20Vulnerability%26vs_k=1
A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, local attacker with administrative privileges to perform a command injection attack on the underlying operating system and elevate privileges to root.
This vulnerability is due to insufficient validation of user supplied input. An attacker could exploit this vulnerability by providing crafted input to a specific CLI command. A successful exploit could allow the attacker to elevate their privileges to root on the underlying operating system.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-5WSJcYJB
Security Impact Rating: Medium
CVE: CVE-2026-20136
Cisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilities
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Remote%20Code%20Execution%20and%20Path%20Traversal%20Vulnerabilities%26vs_k=1
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to achieve remote code execution or conduct path traversal attacks on an affected device. To exploit these vulnerabilities, the attacker must have valid administrative credentials.
For more information about these vulnerabilities, see the Details (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Remote%20Code%20Execution%20and%20Path%20Traversal%20Vulnerabilities%26vs_k=1#details) section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ
Security Impact Rating: Critical
CVE: CVE-2026-20147,CVE-2026-20148
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Remote%20Code%20Execution%20and%20Path%20Traversal%20Vulnerabilities%26vs_k=1
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to achieve remote code execution or conduct path traversal attacks on an affected device. To exploit these vulnerabilities, the attacker must have valid administrative credentials.
For more information about these vulnerabilities, see the Details (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Remote%20Code%20Execution%20and%20Path%20Traversal%20Vulnerabilities%26vs_k=1#details) section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ
Security Impact Rating: Critical
CVE: CVE-2026-20147,CVE-2026-20148
Cisco Webex Services Certificate Validation Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Webex%20Services%20Certificate%20Validation%20Vulnerability%26vs_k=1
A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.
This vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services.
Cisco has addressed this vulnerability in the Cisco Webex service. However, customer action is necessary for affected organizations that are using SSO integration. There are no workarounds that address this vulnerability.
To avoid service interruption, customers who are using SSO should upload a new identity provider (IdP) SAML certificate to Control Hub. For more information, see Manage single sign-on integration in Control Hub (https://help.webex.com/en-us/article/nstvmyo/Manage-single-sign-on-integration-in-Control-Hub#task_394598AFBCD3D73A488E6DBB99AD3214).
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL
Security Impact Rating: Critical
CVE: CVE-2026-20184
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Webex%20Services%20Certificate%20Validation%20Vulnerability%26vs_k=1
A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.
This vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services.
Cisco has addressed this vulnerability in the Cisco Webex service. However, customer action is necessary for affected organizations that are using SSO integration. There are no workarounds that address this vulnerability.
To avoid service interruption, customers who are using SSO should upload a new identity provider (IdP) SAML certificate to Control Hub. For more information, see Manage single sign-on integration in Control Hub (https://help.webex.com/en-us/article/nstvmyo/Manage-single-sign-on-integration-in-Control-Hub#task_394598AFBCD3D73A488E6DBB99AD3214).
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL
Security Impact Rating: Critical
CVE: CVE-2026-20184
Cisco Identity Services Engine Remote Code Execution Vulnerabilities
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Remote%20Code%20Execution%20Vulnerabilities%26vs_k=1
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit these vulnerabilities, the attacker must have at least Read Only Admin credentials.
These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node Cisco ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv
Security Impact Rating: Critical
CVE: CVE-2026-20180,CVE-2026-20186
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Remote%20Code%20Execution%20Vulnerabilities%26vs_k=1
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit these vulnerabilities, the attacker must have at least Read Only Admin credentials.
These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node Cisco ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv
Security Impact Rating: Critical
CVE: CVE-2026-20180,CVE-2026-20186
Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Multiple%20Cross-Site%20Scripting%20Vulnerabilities%26vs_k=1
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interface of an affected device.
These vulnerabilities are due to insufficient sanitization of user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by convincing a user of the interface to click a specific link or view an affected web page. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U
Security Impact Rating: Medium
CVE: CVE-2026-20132
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Multiple%20Cross-Site%20Scripting%20Vulnerabilities%26vs_k=1
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interface of an affected device.
These vulnerabilities are due to insufficient sanitization of user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by convincing a user of the interface to click a specific link or view an affected web page. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U
Security Impact Rating: Medium
CVE: CVE-2026-20132
How to Keep Kids Safe Online? Europe Believes Its Age Verification App Is the Answer
https://www.cnet.com/tech/services-and-software/eu-announces-age-verification-app-for-social-media/
The European Commission's new app is "technically ready and soon available," says President Ursula von der Leyen.
https://www.cnet.com/tech/services-and-software/eu-announces-age-verification-app-for-social-media/
The European Commission's new app is "technically ready and soon available," says President Ursula von der Leyen.
Amazon's New Fire TV Stick HD Doesn't Have to Plug Into the Wall
https://www.cnet.com/tech/home-entertainment/amazon-launches-fire-tv-stick-hd/
Amazon says the slimmer, faster device will start shipping by the end of April.
https://www.cnet.com/tech/home-entertainment/amazon-launches-fire-tv-stick-hd/
Amazon says the slimmer, faster device will start shipping by the end of April.
Adobe Is Working With Anthropic to Bring a Creative AI Agent to Claude
https://www.cnet.com/tech/services-and-software/adobe-firefly-assistant-anthropic-claude-news/
Adobe's Firefly AI is getting a new agentic assistant.
https://www.cnet.com/tech/services-and-software/adobe-firefly-assistant-anthropic-claude-news/
Adobe's Firefly AI is getting a new agentic assistant.
Denon's New AVR-S980H Breaks Receiver Drought for Home Theater Fans
https://www.cnet.com/tech/home-entertainment/denon-avr-s980h-new-dolby-atmos-receiver/
The Dolby Atmos receiver includes improved streaming support and extra gaming features.
https://www.cnet.com/tech/home-entertainment/denon-avr-s980h-new-dolby-atmos-receiver/
The Dolby Atmos receiver includes improved streaming support and extra gaming features.
Nintendo's Made a Weird Animal Crossing. Tomodachi Life Has Me Living Like an Odd God
https://www.cnet.com/tech/gaming/nintendo-tomodachi-life-switch-game-a-weird-animal-crossing/
I've been collecting people into my human zoo and conducting social experiments. Tell me this is OK.
https://www.cnet.com/tech/gaming/nintendo-tomodachi-life-switch-game-a-weird-animal-crossing/
I've been collecting people into my human zoo and conducting social experiments. Tell me this is OK.
Champions League Soccer: Stream Arsenal vs. Sporting Lisbon Live
https://www.cnet.com/tech/services-and-software/champions-league-soccer-stream-arsenal-vs-sporting-lisbon-live/
Can Mikel Arteta's Gunners make it to the UCL semifinals for the second season in a row?
https://www.cnet.com/tech/services-and-software/champions-league-soccer-stream-arsenal-vs-sporting-lisbon-live/
Can Mikel Arteta's Gunners make it to the UCL semifinals for the second season in a row?
QSB-111: xfce4-screensaver login bypass
https://www.qubes-os.org/news/2026/04/15/qsb-111/
We have published Qubes Security Bulletin (QSB) 111: xfce4-screensaver login bypass (https://github.com/QubesOS/qubes-secpack/blob/0ef1bce148ea45454c19e0560ff622b951ca2581/QSBs/qsb-111-2026.txt). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions.
Qubes Security Bulletin 111
---===[ Qubes Security Bulletin 111 ]===---
2026-04-14
xfce4-screensaver login bypass
User action
------------
Continue to update normally [1] in order to receive the security updates
described in the "Patching" section below. No other user action is
required in response to this QSB.
Summary
--------
When connecting or disconnecting a display or, in some cases, when simply
activating the xfce4-screensaver login prompt on a locked screen, there
is a very short window of time during which keyboard input is not
intercepted by xfce4-screensaver and is instead sent to the application
that was active before locking.
The issue has been fixed upstream in [2].
Impact
-------
The time window is normally too short for any real harm to occur when
physically typing on a keyboard. However, if an attacker is able to
generate input events in an automated way, the attacker can attempt to
deactivate the screensaver by sending a command quickly enough.
Affected systems
-----------------
The default Qubes OS 4.3 configuration, which uses xfce4-screensaver and
the Xfce desktop environment, is affected. Other Qubes OS releases and
other screensavers are not affected.
Systems that permit an attacker physical access to a keyboard interface
are affected. Most systems permit such access in some way, since the
user's legitimate keyboard must connect to the system through such an
interface, but the degree of difficulty for the attacker varies
significantly depending on the nature of the interface.
- The easiest method for an attacker is unrestricted USB keyboard input
without a confirmation prompt, but this is disabled in Qubes OS by
default. However, users can override this default configuration to
allow unrestricted USB keyboard input, and many users do so because
they have no other way to connect a legitimate keyboard to their
systems. If the user has allowed unrestricted USB keyboard input,
then an attacker can easily and quickly generate keyboard input
events by connecting a USB device that emulates a keyboard.
- An attacker could also use a non-USB keyboard input interface, such
as a PS/2 port. However, such interfaces are less common nowadays.
Nonetheless, if the system has such an interface, and if the attacker
has physical access to it, then the system is affected, even if USB
keyboard input is restricted.
- Even when there is no keyboard input interface exposed on the outside
of the machine as a convenient port, as in the case of a laptop with
disabled USB keyboard input and no PS/2 port, it may still be
possible for the attacker to physically modify the machine in order
to gain access to such an interface. For example, built-in laptop
keyboards must still be internally connected to the laptop's
motherboard through such an interface in order to function properly.
An attacker who can gain access to the internal components of the
machine could disconnect the legitimate keyboard and attach their own
malicious device to the same interface. However, this form of attack
is significantly more complex than the foregoing attack vectors and
requires extensive physical access, making it much more difficult to
execute successfully.
Discussion
-----------
In general, we consider most attacks that require physical access to the
system to fall outside the scope of the Qubes security model. Aside from
https://www.qubes-os.org/news/2026/04/15/qsb-111/
We have published Qubes Security Bulletin (QSB) 111: xfce4-screensaver login bypass (https://github.com/QubesOS/qubes-secpack/blob/0ef1bce148ea45454c19e0560ff622b951ca2581/QSBs/qsb-111-2026.txt). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions.
Qubes Security Bulletin 111
---===[ Qubes Security Bulletin 111 ]===---
2026-04-14
xfce4-screensaver login bypass
User action
------------
Continue to update normally [1] in order to receive the security updates
described in the "Patching" section below. No other user action is
required in response to this QSB.
Summary
--------
When connecting or disconnecting a display or, in some cases, when simply
activating the xfce4-screensaver login prompt on a locked screen, there
is a very short window of time during which keyboard input is not
intercepted by xfce4-screensaver and is instead sent to the application
that was active before locking.
The issue has been fixed upstream in [2].
Impact
-------
The time window is normally too short for any real harm to occur when
physically typing on a keyboard. However, if an attacker is able to
generate input events in an automated way, the attacker can attempt to
deactivate the screensaver by sending a command quickly enough.
Affected systems
-----------------
The default Qubes OS 4.3 configuration, which uses xfce4-screensaver and
the Xfce desktop environment, is affected. Other Qubes OS releases and
other screensavers are not affected.
Systems that permit an attacker physical access to a keyboard interface
are affected. Most systems permit such access in some way, since the
user's legitimate keyboard must connect to the system through such an
interface, but the degree of difficulty for the attacker varies
significantly depending on the nature of the interface.
- The easiest method for an attacker is unrestricted USB keyboard input
without a confirmation prompt, but this is disabled in Qubes OS by
default. However, users can override this default configuration to
allow unrestricted USB keyboard input, and many users do so because
they have no other way to connect a legitimate keyboard to their
systems. If the user has allowed unrestricted USB keyboard input,
then an attacker can easily and quickly generate keyboard input
events by connecting a USB device that emulates a keyboard.
- An attacker could also use a non-USB keyboard input interface, such
as a PS/2 port. However, such interfaces are less common nowadays.
Nonetheless, if the system has such an interface, and if the attacker
has physical access to it, then the system is affected, even if USB
keyboard input is restricted.
- Even when there is no keyboard input interface exposed on the outside
of the machine as a convenient port, as in the case of a laptop with
disabled USB keyboard input and no PS/2 port, it may still be
possible for the attacker to physically modify the machine in order
to gain access to such an interface. For example, built-in laptop
keyboards must still be internally connected to the laptop's
motherboard through such an interface in order to function properly.
An attacker who can gain access to the internal components of the
machine could disconnect the legitimate keyboard and attach their own
malicious device to the same interface. However, this form of attack
is significantly more complex than the foregoing attack vectors and
requires extensive physical access, making it much more difficult to
execute successfully.
Discussion
-----------
In general, we consider most attacks that require physical access to the
system to fall outside the scope of the Qubes security model. Aside from
the general challenges of protecting against physical attacks, this is
primarily because physical protections depend heavily on the hardware
and firmware details of the system. Since Qubes OS is designed to run on
any x86 system that meets its system requirements [3], these hardware
and firmware details can vary significantly between systems and are
typically outside of Qubes' control. Nonetheless, we consider this
screensaver login bypass vulnerability to fall within the scope of the
Qubes security model, since Qubes OS does have control over keyboard
input interception on the lock screen.
Patching
---------
The following packages contain security updates that address the
vulnerabilities described in this bulletin:
For Qubes 4.3, in dom0 (no GUI domain):
- xfce4-screensaver 4.18.4-5
For systems with a GUI domain, a similar update will be provided by the
distribution of the template on which the GUI domain is based (e.g.,
Fedora or Debian).
These packages will migrate from the security-testing repository to the
current (stable) repository over the next two weeks after being tested
by the community. [4] Once available, the packages should be installed
via the Qubes Update tool or its command-line equivalents. [1]
Dom0's user session must be restarted afterward in order for the updates
to take effect. This can be accomplished by logging out of Xfce4, then
logging back in again, or by simply restarting the system.
Credits
--------
The issue was reported by Murat Altindis and Maria Kessler of AWARE7
GmbH.
Qubes issue #10720 [5] is likely a report of the same problem. This
issue was incorrectly identified as a duplicate of another issue that
sounds similar but that is not relevant to the security of Qubes OS.
References
-----------
[1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html
[2] https://gitlab.xfce.org/apps/xfce4-screensaver/-/commit/4436087c6af5e915a2438d7c1dd0fdc282f547f8
[3] https://doc.qubes-os.org/en/latest/user/hardware/system-requirements.html
[4] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html
[5] https://github.com/QubesOS/qubes-issues/issues/10720
--
The Qubes Security Team
https://www.qubes-os.org/security/
Source: qsb-111-2026.txt (https://github.com/QubesOS/qubes-secpack/blob/0ef1bce148ea45454c19e0560ff622b951ca2581/QSBs/qsb-111-2026.txt)
Marek Marczykowski-Górecki (https://www.qubes-os.org/team/#marek-marczykowski-g%C3%B3recki)’s PGP signature
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmndgcIACgkQ1lWk8hgw
4GpjTA//Uu9j7FMKVj014K5ORjHWgIv5PAVmvl6LaMQpxctGtFoBH9/PXGppv/E8
tsSv9+hFH14a0AH+yj63wflYuWc5rnMA1Z93D/29T8QKpY6ygijr1i5+L19Rb+6Q
lW2H8LefiZgdYANjImilUzBD9Pc8BjvDUXJ+jqO0ETeyiBvFLX65MgFw2GREo+yB
yGBkCOBKdCiuOdnxhWUCwCM4Cdrs4eIjfO/97aOqE3KbqzHLRM2LuBsFKq3N5kBW
NJnH3TLQZVvfHA96JNbY0WFbnSO09J4cs1b61kLK/wIUSM/JoqkQ94ieNNOGvJKa
0TQ0WyIwfjX4mIrVzZ6jbWZPbFDJfjvlNwnwicl4UuQtB3ChzPfWJ5zK/ama9ixW
MNWwD6hfyj60XoR2DIL42j5lZvEOUDcn84T7jy8bS6/bbNsa1dYgYyToaUIOqiiM
0QrDWqVu9eL4v+zA8IvNTqnayPF6xb4t4j9bB26QlNcoKRbcysnYlRPAWB2aYr1X
iV0bE/I3KJqXAyR+rvf1zPerkAodExV0o0C08NYSbgR2lN8cyoDrMBx5meHyQ6wa
seAdM7cWy0JSos4J+sdY83nRKojB0uMcpbKAankstxJ2L8Th6MQnmULWYGBT+msG
HJjFWcSIzS+P3uYvg1FlBVeIcR/oQexDDM78q/wsqqPzbyokxmo=
=AWM/
-----END PGP SIGNATURE-----
Source: qsb-111-2026.txt.sig.marmarek (https://github.com/QubesOS/qubes-secpack/blob/0ef1bce148ea45454c19e0560ff622b951ca2581/QSBs/qsb-111-2026.txt.sig.marmarek)
Simon Gaiser (aka HW42) (https://www.qubes-os.org/team/#simon-gaiser-aka-hw42)’s PGP signature
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmndisoACgkQSsGN4REu
FJAAXA/9F7StrFFMXOxW/ApJQX/MxthsaK94s/iI43dLSK60xs4KFUsCFUibYamc
lcYT/m1GdOdG+4JYKW5M9CbkaZix9f1w8IuwGBpJ6qN857IfAINStyv+bX0HEb8s
dFgR0bMIHkJiCIZWgFGSxyLKAR5GVUHS/JIJIe8OEawiAKc1NA+Z6TTRPIo0y4yX
QB1UC6vgFNVq1jRRiEo+m+vi3fLsXyWEbPGpG5KlJQZ+0T7mY/XYaumkJQtgobwb
primarily because physical protections depend heavily on the hardware
and firmware details of the system. Since Qubes OS is designed to run on
any x86 system that meets its system requirements [3], these hardware
and firmware details can vary significantly between systems and are
typically outside of Qubes' control. Nonetheless, we consider this
screensaver login bypass vulnerability to fall within the scope of the
Qubes security model, since Qubes OS does have control over keyboard
input interception on the lock screen.
Patching
---------
The following packages contain security updates that address the
vulnerabilities described in this bulletin:
For Qubes 4.3, in dom0 (no GUI domain):
- xfce4-screensaver 4.18.4-5
For systems with a GUI domain, a similar update will be provided by the
distribution of the template on which the GUI domain is based (e.g.,
Fedora or Debian).
These packages will migrate from the security-testing repository to the
current (stable) repository over the next two weeks after being tested
by the community. [4] Once available, the packages should be installed
via the Qubes Update tool or its command-line equivalents. [1]
Dom0's user session must be restarted afterward in order for the updates
to take effect. This can be accomplished by logging out of Xfce4, then
logging back in again, or by simply restarting the system.
Credits
--------
The issue was reported by Murat Altindis and Maria Kessler of AWARE7
GmbH.
Qubes issue #10720 [5] is likely a report of the same problem. This
issue was incorrectly identified as a duplicate of another issue that
sounds similar but that is not relevant to the security of Qubes OS.
References
-----------
[1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html
[2] https://gitlab.xfce.org/apps/xfce4-screensaver/-/commit/4436087c6af5e915a2438d7c1dd0fdc282f547f8
[3] https://doc.qubes-os.org/en/latest/user/hardware/system-requirements.html
[4] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html
[5] https://github.com/QubesOS/qubes-issues/issues/10720
--
The Qubes Security Team
https://www.qubes-os.org/security/
Source: qsb-111-2026.txt (https://github.com/QubesOS/qubes-secpack/blob/0ef1bce148ea45454c19e0560ff622b951ca2581/QSBs/qsb-111-2026.txt)
Marek Marczykowski-Górecki (https://www.qubes-os.org/team/#marek-marczykowski-g%C3%B3recki)’s PGP signature
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmndgcIACgkQ1lWk8hgw
4GpjTA//Uu9j7FMKVj014K5ORjHWgIv5PAVmvl6LaMQpxctGtFoBH9/PXGppv/E8
tsSv9+hFH14a0AH+yj63wflYuWc5rnMA1Z93D/29T8QKpY6ygijr1i5+L19Rb+6Q
lW2H8LefiZgdYANjImilUzBD9Pc8BjvDUXJ+jqO0ETeyiBvFLX65MgFw2GREo+yB
yGBkCOBKdCiuOdnxhWUCwCM4Cdrs4eIjfO/97aOqE3KbqzHLRM2LuBsFKq3N5kBW
NJnH3TLQZVvfHA96JNbY0WFbnSO09J4cs1b61kLK/wIUSM/JoqkQ94ieNNOGvJKa
0TQ0WyIwfjX4mIrVzZ6jbWZPbFDJfjvlNwnwicl4UuQtB3ChzPfWJ5zK/ama9ixW
MNWwD6hfyj60XoR2DIL42j5lZvEOUDcn84T7jy8bS6/bbNsa1dYgYyToaUIOqiiM
0QrDWqVu9eL4v+zA8IvNTqnayPF6xb4t4j9bB26QlNcoKRbcysnYlRPAWB2aYr1X
iV0bE/I3KJqXAyR+rvf1zPerkAodExV0o0C08NYSbgR2lN8cyoDrMBx5meHyQ6wa
seAdM7cWy0JSos4J+sdY83nRKojB0uMcpbKAankstxJ2L8Th6MQnmULWYGBT+msG
HJjFWcSIzS+P3uYvg1FlBVeIcR/oQexDDM78q/wsqqPzbyokxmo=
=AWM/
-----END PGP SIGNATURE-----
Source: qsb-111-2026.txt.sig.marmarek (https://github.com/QubesOS/qubes-secpack/blob/0ef1bce148ea45454c19e0560ff622b951ca2581/QSBs/qsb-111-2026.txt.sig.marmarek)
Simon Gaiser (aka HW42) (https://www.qubes-os.org/team/#simon-gaiser-aka-hw42)’s PGP signature
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmndisoACgkQSsGN4REu
FJAAXA/9F7StrFFMXOxW/ApJQX/MxthsaK94s/iI43dLSK60xs4KFUsCFUibYamc
lcYT/m1GdOdG+4JYKW5M9CbkaZix9f1w8IuwGBpJ6qN857IfAINStyv+bX0HEb8s
dFgR0bMIHkJiCIZWgFGSxyLKAR5GVUHS/JIJIe8OEawiAKc1NA+Z6TTRPIo0y4yX
QB1UC6vgFNVq1jRRiEo+m+vi3fLsXyWEbPGpG5KlJQZ+0T7mY/XYaumkJQtgobwb