I am saddened by continued reports that support for Mozilla's email client, Thunderbird, continues to diminish. From DesktopLinux:

The Mozilla Foundation's press release focused on the Firefox 2.12 security fixes. The Foundation also reported, though, in its MFSA (Mozilla Foundation Security Advisory), that these same bugs had been fixed in the fictitious Thunderbird 2.12...

...Still, it is upsetting that Mozilla reports that these problems have been fixed in a version of Thunderbird that doesn't exist. The latest version of Thunderbird is 2.09.

Mitchell Baker posted last September the transfer of Thunderbird from Mozilla to a yet to be seen Mailco organization. Just as DesktopLinux mentioned in their article, I've seen little information about what we can with regards to Thunderbird's future. Perhaps, I'm just not looking in the wrong places?

"WordPress 2.3.3 is an urgent security release. A flaw was found in our XML-RPC implementation such that a specially crafted request would allow any valid user to edit posts of any other user on that blog. In addition to fixing this security flaw, 2.3.3 fixes a few minor bugs. If you are interested only in the security fix, download the fixed version of xmlrpc.php and copy it over your existing xmlrpc.php. Otherwise, you can get the entire release here."

Complete Story

Update for Elgg is available to help fix a potential security vulnerability.

A security issue was detected in Elgg versions 0.8 and 0.7 which could potentially lead to a site compromise. Users are encouraged to update their system to release 0.8.1, users using version 0.7 can apply a patch, both available for immediate download from sourceforge.

Original Announcement

"We are a nation unprepared to properly defend ourselves and recover from a strategic cyberattack," said O. Sami Saydjari, president of Professionals for Cyber Defense and CEO of Cyber Defense Agency, speaking before the U.S. House of Representatives Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology. "Inaction isn't an option.""

Complete Story

"The flaw can be exploited if the Mac user has enabled an option in Safari to "open safe files after downloading," Secunia said in an advisory Thursday. The security company has rated the problem 'highly critical'."

"Another vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS)."

Complete Story

The November 20, 2006 article "Spam surge linked to hackers" from eWeeks is a must read. Unfortunately, I can't find the actual online version of the article in print. I did however find a variant of the article posted as Pump and dump spam surge linked to Russian Bot Herders.

The article discusses the increasing complexity hackers are using botnets running on tens of thousands of hijacked Windows computers to spread spam. The article focuses on the research by SecureWorks regarding the malware trojan called Troj/SpamThru. Some scary unique features have been identified with this trojan including:

• Peer to Peer Communication (hackers can have control without a server)
• Anti-Virus Scanning (Uses anti-virus software to scan against rivals)
• Template-based spam
• Almost half of the PCs infected are PCs with Windows XP SP2 installed (outside of Vista, Microsoft's most secure Windows system to date).

Do I bring this up because I don't like Microsoft products? Not at all and in fact as I write this post I'm using a Windows XP system. My point is that if you plan on using Windows XP do all of us a favor and be sure you've installed on your PC the latest software updates and security patches available.